RE: My SNMP woes continue

[Gary Danko <GDanko () proflowers com>]

Hmm it isn't looking good!
I symlinked the snort 2.0.1 binary to /usr/local/bin because demarc doesn't
want to use the path I've specified. Here's what I have now.

[root@ids1 ~]$ /usr/local/bin/snort -V

-*> Snort! <*-
Version 2.0.1 (Build 88)
By Martin Roesch (roesch () sourcefire com, www.snort.org)

[root@ids1 ~]$ ldd /usr/local/bin/snort
        libcrypto.so.2 => /lib/libcrypto.so.2 (0x40027000)
        libz.so.1 => /usr/lib/libz.so.1 (0x400ea000)
        libpcap.so.0.6.2 => /usr/lib/libpcap.so.0.6.2 (0x400f8000)
        libm.so.6 => /lib/i686/libm.so.6 (0x40113000)
        libnsl.so.1 => /lib/libnsl.so.1 (0x40136000)
        libmysqlclient.so.10 => /usr/lib/mysql/libmysqlclient.so.10
(0x4014c000)
        libnetsnmp.so.5 => /usr/local/net-snmp/lib/libnetsnmp.so.5
(0x40182000)
        libssl.so.2 => /lib/libssl.so.2 (0x401ed000)
        libc.so.6 => /lib/i686/libc.so.6 (0x4021a000)
        libdl.so.2 => /lib/libdl.so.2 (0x40355000)
        libcrypt.so.1 => /lib/libcrypt.so.1 (0x40359000)
        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)

So it's all looking good.

[root@ids1 conf]$ Running in IDS mode
Log directory = /var/log/snort

Initializing Network Interface eth1
OpenPcap() device eth1 network lookup:
        eth1: no IPv4 address assigned

        --== Initializing Snort ==--
Rule application order changed to Pass->Alert->Log
Initializing Output Plugins!
Decoding Ethernet on interface eth1
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file /usr/local/demarc/conf/snorteth1.conf

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
No arguments to frag2 directive, setting defaults to:
    Fragment timeout: 60 seconds
    Fragment memory cap: 4194304 bytes
    Fragment min_ttl:   0
    Fragment ttl_limit: 5
    Fragment Problems: 0
    Self preservation threshold: 500
    Self preservation period: 90
    Suspend threshold: 1000
    Suspend period: 30
Stream4 config:
    Stateful inspection: ACTIVE
    Session statistics: INACTIVE
    Session timeout: 30 seconds
    Session memory cap: 8388608 bytes
    State alerts: INACTIVE
    Evasion alerts: INACTIVE
    Scan alerts: ACTIVE
    Log Flushed Streams: INACTIVE
    MinTTL: 1
    TTL Limit: 5
    Async Link: 0
    State Protection: 0
    Self preservation threshold: 50
    Self preservation period: 90
    Suspend threshold: 200
    Suspend period: 30
Stream4_reassemble config:
    Server reassembly: INACTIVE
    Client reassembly: ACTIVE
    Reassembler alerts: ACTIVE
    Ports: 21 23 25 53 80 110 111 143 513 1433
    Emergency Ports: 21 23 25 53 80 110 111 143 513 1433
http_decode arguments:
    Unicode decoding
    IIS alternate Unicode decoding
    IIS double encoding vuln
    Flip backslash to slash
    Include additional whitespace separators
    Ports to decode http on: 80
rpc_decode arguments:
    Ports to decode RPC on: 111 32771
    alert_fragments: INACTIVE
    alert_large_fragments: ACTIVE
    alert_incomplete: ACTIVE
    alert_multiple_requests: ACTIVE
telnet_decode arguments:
    Ports to decode telnet on: 21 23 25 119
database: compiled support for ( mysql )
database: configured to use mysql
database:          user = snort
database: database name = snort
database: password is set
database:          host = 10.1.30.60
database:   sensor name = ids1
database:     sensor id = 2
database: inconsistent cid information for sid=2
          Recovering by rolling forward the cid=26673
database: schema version = 106
database: using the "log" facility
snmp_parse_args1585 Snort rules read...
1585 Option Chains linked into 222 Chain Headers
0 Dynamic rules
+++++++++++++++++++++++++++++++++++++++++++++++++++

Rule application order: ->pass->activation->dynamic->alert->log

        --== Initialization Complete ==--

-*> Snort! <*-
Version 2.0.1 (Build 88)
By Martin Roesch (roesch () sourcefire com, www.snort.org)

SNMP seems to have loaded up. But Demarc, which uses the same configuration
file and binary complains....

Running in IDS mode
Log directory = /usr/local/demarc/tmp
TCPDUMP file reading mode.
Reading network traffic from "/usr/local/demarc/cgi/stub_traffic_file" file.
snaplen = 96

        --== Initializing Snort ==--
Initializing Output Plugins!
Parsing Rules file /usr/local/demarc/tmp/snort.conf

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
Initializing Preprocessors!
Initializing Plug-ins!
No arguments to frag2 directive, setting defaults to:
    Fragment timeout: 60 seconds
    Fragment memory cap: 4194304 bytes
    Fragment min_ttl:   0
    Fragment ttl_limit: 5
    Fragment Problems: 0
    Self preservation threshold: 500
    Self preservation period: 90
    Suspend threshold: 1000
    Suspend period: 30
Stream4 config:
    Stateful inspection: ACTIVE
    Session statistics: INACTIVE
    Session timeout: 30 seconds
    Session memory cap: 8388608 bytes
    State alerts: INACTIVE
    Evasion alerts: INACTIVE
    Scan alerts: ACTIVE
    Log Flushed Streams: INACTIVE
    MinTTL: 1
    TTL Limit: 5
    Async Link: 0
    State Protection: 0
    Self preservation threshold: 50
    Self preservation period: 90
    Suspend threshold: 200
    Suspend period: 30
Stream4_reassemble config:
    Server reassembly: INACTIVE
    Client reassembly: ACTIVE
    Reassembler alerts: ACTIVE
    Ports: 21 23 25 53 80 110 111 143 513 1433 
    Emergency Ports: 21 23 25 53 80 110 111 143 513 1433 
http_decode arguments:
    Unicode decoding
    IIS alternate Unicode decoding
    IIS double encoding vuln
    Flip backslash to slash
    Include additional whitespace separators
    Ports to decode http on: 80 
rpc_decode arguments:
    Ports to decode RPC on: 111 32771 
    alert_fragments: INACTIVE
    alert_large_fragments: ACTIVE
    alert_incomplete: ACTIVE
    alert_multiple_requests: ACTIVE
telnet_decode arguments:
    Ports to decode telnet on: 21 23 25 119 
command line overrides rules file alert plugin!
ERROR: unknown output plugin: 'trap_snmp'Fatal Error, Quitting..


########################################
Issued following command:
/usr/local/bin/snort  -N -A none -p -T -r
/usr/local/demarc/cgi/stub_traffic_file -l /usr/local/demarc/tmp -c
/usr/local/demarc/tmp/snort.conf 2>&1
########################################

Demarc works a little differently. You paste your Snort.conf into an edit
window and save. Demarc then saves that to a file. I think its also stored
in the DB.

Nonetheless, I pasted the snmp output plugin into the Snort.conf in Demarc
but it still isn't loading.

Argh.


-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users