Newbie Q on making it work

[Faber Fedor <faber () linuxnj com>]

Hi there!

I'm setting up a Snort-based NIDS using snort (duh), and ACID.  I'll
also probably use SAM and loghog and maybe mudpit.  Before I decide to
use them, I need to get some data to crunch and that's where things are
falling down.

The short of it: my problem is that I can only see activity on the local
network to the local network.  I surf to the snort box, I see it in
ACID.  I surf to slashdot, I see nothing.

The long of it: I am running Red Hat Linux 7.3, snort-1.9.0-1snort and
snort-mysql-1.9.0-1snort with mysql-server-3.23.49-3 and acid-0.9.6b13.
I'm using two NICS on a 1.2 GHz PIII with 512M memory.  eth0 has no IP
address and eth1 has an address of 192.168.1.251.  The local subnet is
192.168.1.0/24 sitting behind a Linksys firewall with default settings
and the latest firmware upgrade.  Everything is plugged into one or more
Linksys hubs; no switches are invloved.

I execute snort from an rc script wherein the relevant lines are

    daemon /usr/sbin/snort-mysql -U -b -d -D -c /etc/snort/snort.conf -i eth0
    daemon /usr/sbin/snort-mysql -U -b -d -D -c /etc/snort/snort.conf -i eth1

I have commented out all of the rules file in /etc/snort/snort.conf
except for local.rules.  The only rule in local/rules is

alert tcp $HOME_NET any -> $EXTERNAL_NET any  (msg:"Any access";
classtype:policy-violation; sid:1436; rev:2;)

(wrapped here, but on one line in the local.rules file).

$HOME_NET and $EXTERNAL_NET are set as "any".  Logging was set as

   output database: log, mysql, user=snort password=xxxx dbname=snort host=127.0.0.1

but is now set at

   output database: alert, mysql, user=snort password=xxxx dbname=snort host=127.0.0.1

with no seeming effect.

As I mentioned above: I can see local traffic just fine, but I can't see
anything going in or out of the network.  

I tested the same setup (without the local rules and all of the default
rules turned on, including multimedia.rules, pron.rules, and mp3.rules)
on a collge network and the only data I captured was mutlicast signals
of the local Windows boxes trying to contact a UPnP server.

What am I doing wrong? 

-- 
 
Regards,
 
Faber                     

Linux New Jersey: Open Source Solutions for New Jersey
http://www.linuxnj.com





-------------------------------------------------------
This SF.net email is sponsored by: Get the new Palm Tungsten T 
handheld. Power & Color in a compact size! 
http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users