[Snort-users] Snort won't generate alerts with single snort.rules file

Anacleto Junior suporte.anacleto at ...11827...
Fri Feb 28 12:19:56 EST 2014


Hi everyone,

Sorry for the poor english but I will try my best. I will describe my
problems after upgrading Snort rules.

Debian Linux 6.0.8 (kernel 2.6.32-5 x86_64)
Snort version: Version 2.9.6.0 GRE (Build 47)
Snort rules version: 2.9.6.0
pulledpork 0.7.0
barnyard2 2.1.13 build 327

I was using Snort v.2.9.5.6 with snortrules-snapshot-2956 for a good time.
I have upgraded to the latest version available and some issues occurred.
If this is not the right place for asking, sorry for this. I will
appreciate if someone can point me the right place to ask.

When I run snort with this command:

/usr/local/bin/snort -A console -u snort -g snort -c
/etc/snort/eth1/snort_eth1.conf -i eth1

I can't get alerts and none events are registered. This is the output after
I finish him (ctrl+c):

I got some errors like:
WARNING: /etc/snort/rules/snort.rules(15678) GID 1 SID 24017 in rule
duplicates previous rule. Ignoring old rule.

But it moves on...

4539 Snort rules read (so I assume it is reading the
    4208 detection rules
    0 decoder rules
    4 preprocessor rules
4212 Option Chains linked into 185 Chain Headers
0 Dynamic rules


Snort ran for 0 days 0 hours 3 minutes 10 seconds
   Pkts/min:        39481
   Pkts/sec:          623

Packet I/O Totals:
   Received:       118443
   Analyzed:       118443 (100.000%)
    Dropped:            0 (  0.000%)
   Filtered:            0 (  0.000%)
Outstanding:            0 (  0.000%)
   Injected:            0

Breakdown by protocol (includes rebuilt packets):
        Eth:       118567 (100.000%)
       VLAN:            0 (  0.000%)
        IP4:       118567 (100.000%)
       Frag:            0 (  0.000%)
       ICMP:          411 (  0.347%)
        UDP:         4682 (  3.949%)
        TCP:       111664 ( 94.178%)

Here's the problem, this is the info that got me concerned:
===============================================================================



*Action Stats:     Alerts:            0 (  0.000%)     Logged:            0
(  0.000%)     Passed:            0 (  0.000%)*
Limits:
      Match:            0
      Queue:            0
        Log:            0
      Event:            0
      Alert:            0
Verdicts:
      Allow:        82225 ( 69.422%)
      Block:            0 (  0.000%)
    Replace:            0 (  0.000%)
  Whitelist:        36218 ( 30.578%)
  Blacklist:            0 (  0.000%)
     Ignore:            0 (  0.000%)


All of this traffic was not even registered. I think that I was supposed to
get some alerts because of having a single file with all rules (pulledpork
rule management). Isn't suppose to activate all rules by default?

This is my snort.conf file:
http://pastebin.com/YWABcKsF


Thanks in advance.


-- 
Anacleto Júnior
Analista de TI e Redes
Linux User: #447388
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20140228/b68b9937/attachment.html>


More information about the Snort-users mailing list