[Snort-users] Snort not alerting although tcpdump shows packet

Kumarswamy H N (kumhn) kumhn at ...589...
Fri Apr 17 08:05:54 EDT 2015


Snort will only alert if your traffic  matches any of the snort rules with action set to alert. So you must provide a configuration file which includes an appropriate rule to alert for your traffic.  To start with, you can add a simple rule to snort.conf that matches your traffic or enable appropriate rule protocol-icmp.rules .



Regards,
Kumar

From: Gaurav Srivastava [mailto:gaurav.srivastava7 at ...11827...]
Sent: Friday, April 17, 2015 5:16 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Snort not alerting although tcpdump shows packet

Dear all,

I have a strange issue. I am running snort to observe traffic mirrored from another VM.
But Snort is not alerting. To verify whether the packets are received or not I did a tcpdump using following command

sudo tcpdump -w icmp.pcap -i eth0 icmp

And when I read the file using snort using below command:

snort -r icmp.pcap

It displays the ICMP packet logs. But the alert was not generated when snort was running.

Please suggest. I am stuck here.


Thanks and Regards,
Gaurav
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150417/a6cc04ad/attachment.html>


More information about the Snort-users mailing list