Configuring Snort

[Damien Hull <dhull () section9 us>]

I've snort installed but the rules don't seem to be working. Here's
what I have.

snort: 2.9.3.1
snort rules: 2.9.2.3
OS: Ubuntu 10.04 LTS
Other: Barnyard2

I know snort and barnyard2 are working. I added the following to
local.rules and it works.
          alert icmp any any -> any any (msg: "ICMP Packet found"; sid:1001;)

I commented out the dynamic detection stuff because that wasn't
loading. I was told my version of snort rules won't work with snort
2.9.3.1
          # path to dynamic rules libraries
          # dynamicdetection directory /usr/local/snort/lib/snort_dynamicrules

I have the scanning section configured. I thought that would allow me
to scan the system and snort would trigger an alert. No such luck.
         # Portscan detection.  For more information, see README.sfportscan
         preprocessor sfportscan: proto  { all } scan_type { all }
memcap { 10000000 } s$

Why does the simple rule in local.rules work but a port scan doesn't
get detected?

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!