[Snort-users] Logging "pass" rules that are hit

Dave Osbourne dave at osbourne.uk.eu.org
Thu Jun 21 16:12:32 EDT 2018


Hi,

I'm tying to debug a pcre match in a pass rule, but apart from inferring 
it's working when it doesn't fail I can seem to figure out how to get 
snort to LOG pass rules that it finds... (so that I know which rule is 
passing).

My most basic test is to set

    output alert_fast: stdout

call snort like:

    /usr/local/bin/snort -c /etc/snort/snortdelme.conf -Q -i eth1:eth2

I'm (against most basically) matching a SYN packet:

         pass tcp  0.0.0.0/0 any -> 192.168.X.Y 1433 (msg:"pass 
message"; flags: S; dsize: 0; sid:1000;)
         log tcp  0.0.0.0/0 any -> 192.168.X.Y 1433 (msg:"log message"; 
flags: S; dsize: 0; sid:2000;)

I know the packet is flowing through the bridge - because if I change 
pass/log to reject I see a message and the packet is blocked.

I just can't figure out how to make pass appear in the log!

Dave
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20180621/a349fbc5/attachment.html>


More information about the Snort-users mailing list