Snort mailing list archives

Snort capturing traffic from the entire network instead of just the IP Assigned


From: NTWIGA MURITHI via Snort-sigs <snort-sigs () lists snort org>
Date: Thu, 10 Oct 2024 11:23:20 +0300

 Goodmorning,

I downloaded the registered rules. And configured snort.lua IP using the
following
HOME_NET = '10.2.60.134'

EXTERNAL_NET = '!$HOME_NET'

The problem is snort is capturing all the traffic from other IPs when i run
this command
sudo snort -c /usr/local/etc/snort/snort.lua  -i eth0 -A alert_fast
--plugin-path "/usr/local/etc/so_rules/"

10/02-03:52:40.597213 [**] [116:414:1] "(ipv4) IPv4 packet to broadcast
dest address" [**] [Priority: 3] {UDP} 192.168.1.1:67 -> 255.255.255.255:68
10/02-03:52:40.597214 [**] [116:414:1] "(ipv4) IPv4 packet to broadcast
dest address" [**] [Priority: 3] {UDP} 192.168.1.1:67 -> 255.255.255.255:68
10/02-03:52:40.613196 [**] [116:414:1] "(ipv4) IPv4 packet to broadcast
dest address" [**] [Priority: 3] {UDP} 10.96.166.7:53600 ->
255.255.255.255:10001
10/02-03:52:40.621456 [**] [116:444:1] "(ipv4) IPv4 option set" [**]
[Priority: 3] {IP} 10.96.108.130 -> 224.0.0.22
10/02-03:52:40.652316 [**] [116:414:1] "(ipv4) IPv4 packet to broadcast
dest address" [**] [Priority: 3] {UDP} 0.0.0.0:68 -> 255.255.255.255:67
10/02-03:52:40.652316 [**] [116:408:1] "(ipv4) IPv4 packet from 'current
net' source address" [**] [Priority: 3] {UDP} 0.0.0.0:68 ->
255.255.255.255:67
10/02-03:52:40.654672 [**] [116:414:1] "(ipv4) IPv4 packet to broadcast
dest address" [**] [Priority: 3] {UDP} 10.5.32.1:67 -> 255.255.255.255:68
^C** caught int signal
== stopping
10/02-03:52:40.841313 [**] [116:414:1] "(ipv4) IPv4 packet to broadcast
dest address" [**] [Priority: 3] {UDP} 10.5.40.206:40570 ->
255.255.255.255:10001
-- [0] eth0

-- 

Disclaimer:
 This e-mail and attachments  are confidential and may be 
privileged and
 protected from discovery or disclosure. If you are not the 
intended 
recipient, be aware that any disclosure, copying, dissemination 
or use 
of this e-mail or any attachments  is prohibited. If you have 
received 
this e-mail in error, please notify the sender immediately and 
erase all
 copies of the message and its attachments. Any views expressed 
are 
those of the individual sender(s) and may not necessarily reflect the 
views of the Kenyatta University. 
 <http://www.ku.ac.ke>  
<https://www.facebook.com/kenyattauni/>  
<https://plus.google.com/u/0/101726393221697663110>  
<https://www.linkedin.com/edu/kenyatta-university-14427>  
<https://www.linkedin.com/edu/kenyatta-university-14427> 
<https://twitter.com/KenyattaUni>

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists snort org
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a 
href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!

Current thread: