Re: help with rules - data capturing

["Will Metcalf" <william.metcalf () gmail com>]

are you sending port 13001 traffic to the QUEUE target in iptables? -Q
tells snort to read from ipqueue instead of listen on an interface. So
if you intend to QUEUE traffic something like

iptables -I FORWARD -p tcp --sport 13001 -j QUEUE
iptables -I FORWARD -p tcp --dport 13001 -j QUEUE

or if local to the box

iptables -I INPUT -p tcp --dport 13001 -j QUEUE
iptables -I OUTPUT -p tcp --sport 13001 -j QUEUE

or if you don't want to be inline just replace -Q with -i eth0 or
whatever interface you want to listen on

On Dec 26, 2007 6:29 PM, Timothy Ding <iolabs () gmail com> wrote:
> Thank you all for responding, I compiled 2.81 and see snort running however
> i could use more help as no data were captured although i see the data from
> tcpdump with the same machine. I also try removing all the default rules
> running snort with only 1 to avoid any contaminations. perhaps i missed
> something?
>
> ~ Tim
>
>
> alert tcp any any -> $HOME_NET 13001 (msg: "GPRMC found in packet"; \
> flow:to_server,established; content:"|24|GPRMC"; nocase; sid:9999000;)
>
> TCPDUMP results
> 16:26:09.941940 IP 209.31.36.15.ptr.us.xo.net.13001 >
> 66.xxx.xxx.xxx.static.xxx.com.26334: S 664514795:664514795(0) ack 6516 win
> 5840 <mss 1460>
>         0x0000:  4500 002c 0000 4000 4006 7202 d11f 240f  E..,..@.@.r...$.
>         0x0010:  42d8 90c3 32c9 66de 279b b0eb 0000 1974  B...2.f.'......t
>         0x0020:  6012 16d0 2cda 0000 0204 05b4            `...,.......
> 16:26:11.264892 IP 66.216.144.195.static.dejazzd.com.26334 >
> 209.xxx.xxx.xxx.ptr.xxx.net.13001: P 1:137(136) ack 1 win 8096
>         0x0000:  4500 00b0 0004 4000 eb06 c679 42d8 90c3  E..... ()     yB...
>         0x0010:  d11f 240f 66de 32c9 0000 1974 279b b0ec  ..$.f.2....t'...
>         0x0020:  5018 1fa0 8f42 0000 0604 8319 8800 0000  P....B..........
>         0x0030:  6100 0000 2533 3536 3933 3930 3130 3030  a...%35693901000
>         0x0040:  3036 3736 2c24 4750 524d 432c 3030 3137  0676,$GPRMC,0017
>         0x0050:  3432 2e30 3030 2c41 2c33 3335 372e 3631  42.000,A,3357.61
>         0x0060:  3638 2c4e 2c31 3137 3536 2e38 3639 362c  68,N, 11756.8696,
>         0x0070:  572c 302e 3030 2c2c 3237 3132 3037 2c2c  W,0.00,,271207,,
>         0x0080:  2c41 2c2b 3132 3133 3833 3936 3635 332c  ,A,+12138396653,
>         0x0090:  4e30 3338 6400 0000 0000 0000 0000 0000  N038d...........
>         0x00a0:  0000 0000 0000 0000 0000 0000 ffff ffff  ................
> 16:26:11.264922 IP 209.31.36.15.ptr.us.xo.net.13001 >
> 66.xxx.xxx.xxx.static.xxx.com.26334: . ack 137 win 6432
>         0x0000:  4500 0028 9c41 4000 4006 d5c4 d11f 240f  E..(.A@.@.....$.
>         0x0010:  42d8 90c3 32c9 66de 279b b0ec 0000 19fc  B...2.f.'.......
>         0x0020:  5010 1920 41bf 0000                      P...A...
>
> Snort started with this command.
>  46480 29072 ?        S    Dec24   2:05 /home/user1/snort/snort-
> 2.8.0.1/src/snort -Qc /home/user1/snort/snort-2.8.0.1/etc/snort.conf -l
> /var/log/snort/
>
>
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2005.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users