[Snort-users] ARPspoof preprocessor, barnyard, & BASE

Michael B miboe60 at ...125...
Sun Apr 26 06:56:16 EDT 2015


I found the issue, it is due to BASE. For a description of how I fixed it: http://www.winsnort.com/topic/136-arpspoof-preprocesser-events-not-logged-to-database/

 


From: miboe60 at ...125...
To: snort-users at lists.sourceforge.net
Date: Thu, 23 Apr 2015 17:01:47 +0200
Subject: [Snort-users] ARPspoof preprocessor, barnyard, & BASE




My Snort is up & running and loads of events are being logged. After weeding out some false positives, I wanted to test the arpspoof preprocessor. 
So I enabled:preprocessor arpspoof preprocessor arpspoof_detect_host: 192.168.1.1 58:6d:8f:a0:40:7f preprocessor arpspoof_detect_host: 192.168.1.3 d4:3d:7e:38:37:4dAnd ran a arp attack using ettercap. The problem is that these events do not show up in my winids (and neither in mysql database). It seems to be a similar problem to this: http://seclists.org/snort/2012/q1/99Now, Ive checked my barnyard output window, and the ettercap events DO show up there, they are just not shown in the BASE UI. My feeling is thus that it is a formatting issue: the arpspoof preprocessor outputs the events in a format which barnyard cannot log to mysql OR which are incompatible with the BASE interface. What I dont know is how I can solve this.  		 	   		  

------------------------------------------------------------------------------
BPM Camp - Free Virtual Workshop May 6th at 10am PDT/1PM EDT
Develop your own process in accordance with the BPMN 2 standard
Learn Process modeling best practices with Bonita BPM through live exercises
http://www.bonitasoft.com/be-part-of-it/events/bpm-camp-virtual- event?utm_
source=Sourceforge_BPM_Camp_5_6_15&utm_medium=email&utm_campaign=VA_SF
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news! 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150426/9c151fb5/attachment.html>


More information about the Snort-users mailing list