Home page logo
/

snort logo Snort mailing list archives

Re: MySQL support for Snort 2.9.4
From: Kaya Saman <kayasaman () gmail com>
Date: Tue, 11 Dec 2012 21:26:55 +0000

On 12/11/2012 07:11 PM, Joel Esler wrote:
You aren't generating any alerts because of:

On Dec 11, 2012, at 2:06 PM, Kaya Saman <kayasaman () gmail com <mailto:kayasaman () gmail com>> wrote:

Bad Chk Sum:      9421212 ( 50.311%)

Try adding -k none to your Snort command line and see if you get anything logged that way.


Action Stats:
    Alerts:            0 (  0.000%)
    Logged:            0 (  0.000%)
    Passed:            0 (  0.000%)


See, nothing alerted.

Also,
you might want to use PulledPork to manage your ruleset, as it looks like you have a bunch of unresolved flowbit issues.

--
*Joel Esler*
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire

Thanks Joel,

I used PulledPork but it didn't get any of the *.rules files that are in the tar.gz file. I manually added them in then ran PP again out of which I got:

Reading rules...
Reading rules...
Reading rules...
Setting Flowbit State....
        Enabled 23 flowbits
        Enabled 1 flowbits
        Done
Writing /etc/snort/rules/snort.rules....
        Done
Writing /etc/snort/rules/so_rules.rules....
        Done
Generating sid-msg.map....
        Done
Writing /etc/snort/sid-msg.map....
        Done
Writing /var/log/sid_changes.log....
        Done
Rule Stats....
        New:-------0
        Deleted:---0
        Enabled Rules:----16879
        Dropped Rules:----0
        Disabled Rules:---14849
        Total Rules:------31728
        Done

I still get the flow bit errors as PP from above only enabled 24.


In the log file I noticed that I got a bunch of "unkown message" entries so I don't know if that's got anything to do with it?


Using the -k none option as suggested previously I don't get any more 'Bad chck sum' errors but I still don't get anything logged either?


Previously when I used version 2.8.6 with the Emerging Threats ruleset even when run for a few seconds Base would just spike with occurrences, mainly for p2p icmp packets.


Basically it's still not working :-(


Regards,


Kaya
------------------------------------------------------------------------------
LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial
Remotely access PCs and mobile devices and provide instant support
Improve your efficiency, and focus on delivering more value-add services
Discover what IT Professionals Know. Rescue delivers
http://p.sf.net/sfu/logmein_12329d2d
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault