[Snort-users] snort suddenly stopped to record events

waldo kitty wkitty42 at ...14940...
Mon Jul 22 13:01:20 EDT 2013


On 7/22/2013 11:59, linux at ...14373... wrote:
> Please, help me to debug ... I am lost ... Could be some new updates received
> using pulledpork?

unlikely...

> Some misconfigured rules received using pulledpork?

unlikely...

> Why snort is not logging?

you mean like alerting on any traffic? sure... we use the following rules in a 
file named local-test.rules... just like local.rules, put it in place with the 
proper permissions, add it to your snort.conf and restart snort... only let it 
run a minute because it can generate thousands of alerts per second depending on 
your traffic and your machine's capabilities... then edit your snort.conf to 
comment it out or remove it and restart your snort... then you can look at your 
alert and log files to see if traffic was recorded... if it was, then things are 
working properly... if it was not, then we have to look deeper...

----- snip -----
#
# The rules in this file are only to test a snort installation to see if it is
# seeing any traffic at all. These rules should NOT be used all the time. Once
# tested and working, this rule file should be commented out in your snort.conf
# so that it is not used.
#
#------------------
# LOCAL TEST RULES
#------------------

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"tcp traffic inbound"; 
classtype:tcp-connection; sid:1; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"tcp traffic outbound"; 
classtype:tcp-connection; sid:2; rev:1;)
alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"ip traffic inbound"; 
classtype:unknown; sid:3; rev:1;)
alert ip $HOME_NET any -> $EXTERNAL_NET any (msg:"ip traffic outbound"; 
classtype:unknown; sid:4; rev:1;)
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"udp traffic inbound"; 
classtype:misc-activity; sid:5; rev:1;)
alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"udp traffic outbound"; 
classtype:misc-activity; sid:6; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"icmp traffic inbound"; 
classtype:icmp-event; sid:7; rev:1;)
alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"icmp traffic outbound"; 
classtype:icmp-event; sid:8; rev:1;)

----- snip -----



-- 
NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.




More information about the Snort-users mailing list