[Snort-users] Logging "pass" rules that are hit
dave at osbourne.uk.eu.org
Thu Jun 21 16:12:32 EDT 2018
I'm tying to debug a pcre match in a pass rule, but apart from inferring
it's working when it doesn't fail I can seem to figure out how to get
snort to LOG pass rules that it finds... (so that I know which rule is
My most basic test is to set
output alert_fast: stdout
call snort like:
/usr/local/bin/snort -c /etc/snort/snortdelme.conf -Q -i eth1:eth2
I'm (against most basically) matching a SYN packet:
pass tcp 0.0.0.0/0 any -> 192.168.X.Y 1433 (msg:"pass
message"; flags: S; dsize: 0; sid:1000;)
log tcp 0.0.0.0/0 any -> 192.168.X.Y 1433 (msg:"log message";
flags: S; dsize: 0; sid:2000;)
I know the packet is flowing through the bridge - because if I change
pass/log to reject I see a message and the packet is blocked.
I just can't figure out how to make pass appear in the log!
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users