Re: RE : Snort won't generate alerts with single snort.rules file

[Anacleto Junior <suporte.anacleto () gmail com>]

2014-02-28 14:46 GMT-03:00 rmkml <rmkml () yahoo fr>:

> Hi Anacleto,
>
> Could you try with disabling cksum verification please? ( -k none )

I tried with this command:

 /usr/local/bin/snort -A console -k none -u snort -g snort -c
/etc/snort/eth1/snort_eth1.conf -i eth1

And I still don't get any alerts logged...

> Regards
> @Rmkml
>
>
>
>
> -------- Message d'origine --------
> De : Anacleto Junior <suporte.anacleto () gmail com>
> Date :
> A : snort-users () lists sourceforge net
> Objet : [Snort-users] Snort won't generate alerts with single snort.rules
> file
>
>
> Hi everyone,
>
> Sorry for the poor english but I will try my best. I will describe my
> problems after upgrading Snort rules.
>
> Debian Linux 6.0.8 (kernel 2.6.32-5 x86_64)
> Snort version: Version 2.9.6.0 GRE (Build 47)
> Snort rules version: 2.9.6.0
> pulledpork 0.7.0
> barnyard2 2.1.13 build 327
>
> I was using Snort v.2.9.5.6 with snortrules-snapshot-2956 for a good time.
> I have upgraded to the latest version available and some issues occurred.
> If this is not the right place for asking, sorry for this. I will
> appreciate if someone can point me the right place to ask.
>
> When I run snort with this command:
>
> /usr/local/bin/snort -A console -u snort -g snort -c
> /etc/snort/eth1/snort_eth1.conf -i eth1
>
> I can't get alerts and none events are registered. This is the output
> after I finish him (ctrl+c):
>
> I got some errors like:
> WARNING: /etc/snort/rules/snort.rules(15678) GID 1 SID 24017 in rule
> duplicates previous rule. Ignoring old rule.
>
> But it moves on...
>
> 4539 Snort rules read (so I assume it is reading the
>     4208 detection rules
>     0 decoder rules
>     4 preprocessor rules
> 4212 Option Chains linked into 185 Chain Headers
> 0 Dynamic rules
>
>
> Snort ran for 0 days 0 hours 3 minutes 10 seconds
>    Pkts/min:        39481
>    Pkts/sec:          623
>
> Packet I/O Totals:
>    Received:       118443
>    Analyzed:       118443 (100.000%)
>     Dropped:            0 (  0.000%)
>    Filtered:            0 (  0.000%)
> Outstanding:            0 (  0.000%)
>    Injected:            0
>
> Breakdown by protocol (includes rebuilt packets):
>         Eth:       118567 (100.000%)
>        VLAN:            0 (  0.000%)
>         IP4:       118567 (100.000%)
>        Frag:            0 (  0.000%)
>        ICMP:          411 (  0.347%)
>         UDP:         4682 (  3.949%)
>         TCP:       111664 ( 94.178%)
>
> Here's the problem, this is the info that got me concerned:
>
> ===============================================================================
>
>
>
> *Action Stats:     Alerts:            0 (  0.000%)     Logged:
> 0 (  0.000%)     Passed:            0 (  0.000%)*
> Limits:
>       Match:            0
>       Queue:            0
>         Log:            0
>       Event:            0
>       Alert:            0
> Verdicts:
>       Allow:        82225 ( 69.422%)
>       Block:            0 (  0.000%)
>     Replace:            0 (  0.000%)
>   Whitelist:        36218 ( 30.578%)
>   Blacklist:            0 (  0.000%)
>      Ignore:            0 (  0.000%)
>
>
> All of this traffic was not even registered. I think that I was supposed
> to get some alerts because of having a single file with all rules
> (pulledpork rule management). Isn't suppose to activate all rules by
> default?
>
> This is my snort.conf file:
> http://pastebin.com/YWABcKsF
>
>
> Thanks in advance.
>
>
> --
> Anacleto Júnior
> Analista de TI e Redes
> Linux User: #447388


-- 
Anacleto Júnior
Analista de TI e Redes
Linux User: #447388

------------------------------------------------------------------------------
Subversion Kills Productivity. Get off Subversion & Make the Move to Perforce.
With Perforce, you get hassle-free workflows. Merge that actually works. 
Faster operations. Version large binaries.  Built-in WAN optimization and the
freedom to use Git, Perforce or both. Make the move to Perforce.
http://pubads.g.doubleclick.net/gampad/clk?id=122218951&iu=/4140/ostg.clktrk

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!