Re: Snort Configuration

[waldo kitty <wkitty42 () windstream net>]

On 3/19/2014 7:49 AM, Nanda Vardhan wrote:
> 1. My snort version is 2.9.2

that's pretty old and unsupported... you need to update to the latest if you 
can... this link will tell you the EOL (End Of Life) policy and list the 
supported snort versions... http://www.snort.org/vrt/rules/eol_policy

> 2. public user

that may be one reason... snort needs to be run as root so it can switch the NIC 
into promiscuous mode and detect traffic for other devices...

> 3. I dont know what NIC is, as I mentioned am a newbie

NIC : Network Interface Card

> 4.  connected wirelessly through wifi router.
>
> - trying to sniff packets through wlan0 interface
>
>   My problem is that am unable to sniff the packets of other devices connected
> to my wifi router. when I run snort am getting packets of the device on which
> snort was running. How to configure so that it sniffs the packets of other
> devices connected to the same network which i was sniffing.

there is no real configuration that needs to be done for this... it is done as a 
matter of fact because it is the only way it will work, really... i suspect that 
your main problem is running snort as a non-root user... the user you are using 
has limited permissions and most likely cannot switch the NIC into promiscuous 
mode so that it will see all other traffic flowing by it destined for other 
devices...

-- 
NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!