Home page logo
/

snort logo Snort mailing list archives

Re: MySQL support for Snort 2.9.4
From: Russ Combs <rcombs () sourcefire com>
Date: Wed, 12 Dec 2012 09:49:21 -0500

On Wed, Dec 12, 2012 at 9:32 AM, waldo kitty <wkitty42 () windstream net>wrote:

On 12/11/2012 17:08, Kaya Saman wrote:
Starting Snort does give me a few warnings:

Running in IDS mode

--== Initializing Snort ==--
Initializing Output Plugins!
[...]
pcap DAQ configured to passive.
Acquiring network traffic from "trunk0".
Reload thread starting...
Reload thread started, thread 0x205d9a600 (18685)

pretty much ok to here...

Decoding Ethernet

this bothers me... why? because it seems to indicate that only ethernet is
being
sniffed and not tcp/ip...


FYI - this is just an indication of the outermost layer decoder (the
datalink type obtained from the DAQ).  Snort can handle others, but
Ethernet will be the most common.



--== Initialization Complete ==--

,,_ -*> Snort! <*-
o" )~ Version 2.9.3.1 IPv6 GRE (Build 40)
'''' By Martin Roesch & The Snort Team:
http://www.snort.org/snort/snort-team
Copyright (C) 1998-2012 Sourcefire, Inc., et al.
Using libpcap version 1.3.0
Using PCRE version: 8.30 2012-02-04
Using ZLIB version: 1.2.3

Rules Engine: SF_SNORT_DETECTION_ENGINE Version 1.16 <Build 18>
Preprocessor Object: SF_DNP3 (IPV6) Version 1.1 <Build 1>
Preprocessor Object: SF_MODBUS (IPV6) Version 1.1 <Build 1>
Preprocessor Object: SF_GTP (IPV6) Version 1.1 <Build 1>
Preprocessor Object: SF_REPUTATION (IPV6) Version 1.1 <Build 1>
Preprocessor Object: SF_SIP (IPV6) Version 1.1 <Build 1>
Preprocessor Object: SF_SDF (IPV6) Version 1.1 <Build 1>
Preprocessor Object: SF_DCERPC2 (IPV6) Version 1.0 <Build 3>
Preprocessor Object: SF_SSLPP (IPV6) Version 1.1 <Build 4>
Preprocessor Object: SF_DNS (IPV6) Version 1.1 <Build 4>
Preprocessor Object: SF_SSH (IPV6) Version 1.1 <Build 3>
Preprocessor Object: SF_SMTP (IPV6) Version 1.1 <Build 9>
Preprocessor Object: SF_IMAP (IPV6) Version 1.0 <Build 1>
Preprocessor Object: SF_POP (IPV6) Version 1.0 <Build 1>
Preprocessor Object: SF_FTPTELNET (IPV6) Version 1.2 <Build 13>
Commencing packet processing (pid=18685)

something else that bothers me a bit is all the above indicating IPv6 and
i'm
sure you have IPv4 traffic... is it possible that your IPv4 traffic is not
being
looked at at all??

The -v option does show a lot of traffic going through.....

what kind of traffic? IPv4 or IPv6 or both?


------------------------------------------------------------------------------
LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial
Remotely access PCs and mobile devices and provide instant support
Improve your efficiency, and focus on delivering more value-add services
Discover what IT Professionals Know. Rescue delivers
http://p.sf.net/sfu/logmein_12329d2d
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest
Snort news!

------------------------------------------------------------------------------
LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial
Remotely access PCs and mobile devices and provide instant support
Improve your efficiency, and focus on delivering more value-add services
Discover what IT Professionals Know. Rescue delivers
http://p.sf.net/sfu/logmein_12329d2d
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault