[Snort-users] ARPspoof preprocessor, barnyard, & BASE

Michael B miboe60 at ...125...
Sun Apr 26 06:56:16 EDT 2015

I found the issue, it is due to BASE. For a description of how I fixed it: http://www.winsnort.com/topic/136-arpspoof-preprocesser-events-not-logged-to-database/


From: miboe60 at ...125...
To: snort-users at lists.sourceforge.net
Date: Thu, 23 Apr 2015 17:01:47 +0200
Subject: [Snort-users] ARPspoof preprocessor, barnyard, & BASE

My Snort is up & running and loads of events are being logged. After weeding out some false positives, I wanted to test the arpspoof preprocessor. 
So I enabled:preprocessor arpspoof preprocessor arpspoof_detect_host: 58:6d:8f:a0:40:7f preprocessor arpspoof_detect_host: d4:3d:7e:38:37:4dAnd ran a arp attack using ettercap. The problem is that these events do not show up in my winids (and neither in mysql database). It seems to be a similar problem to this: http://seclists.org/snort/2012/q1/99Now, Ive checked my barnyard output window, and the ettercap events DO show up there, they are just not shown in the BASE UI. My feeling is thus that it is a formatting issue: the arpspoof preprocessor outputs the events in a format which barnyard cannot log to mysql OR which are incompatible with the BASE interface. What I dont know is how I can solve this.  		 	   		  

BPM Camp - Free Virtual Workshop May 6th at 10am PDT/1PM EDT
Develop your own process in accordance with the BPMN 2 standard
Learn Process modeling best practices with Bonita BPM through live exercises
http://www.bonitasoft.com/be-part-of-it/events/bpm-camp-virtual- event?utm_
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

Please visit http://blog.snort.org to stay current on all the latest Snort news! 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150426/9c151fb5/attachment.html>

More information about the Snort-users mailing list