Snort mailing list archives
Snort capturing traffic from the entire network instead of just the IP Assigned
From: NTWIGA MURITHI via Snort-sigs <snort-sigs () lists snort org>
Date: Thu, 10 Oct 2024 11:23:20 +0300
Goodmorning,
I downloaded the registered rules. And configured snort.lua IP using the
following
HOME_NET = '10.2.60.134'
EXTERNAL_NET = '!$HOME_NET'
The problem is snort is capturing all the traffic from other IPs when i run
this command
sudo snort -c /usr/local/etc/snort/snort.lua -i eth0 -A alert_fast
--plugin-path "/usr/local/etc/so_rules/"
10/02-03:52:40.597213 [**] [116:414:1] "(ipv4) IPv4 packet to broadcast
dest address" [**] [Priority: 3] {UDP} 192.168.1.1:67 -> 255.255.255.255:68
10/02-03:52:40.597214 [**] [116:414:1] "(ipv4) IPv4 packet to broadcast
dest address" [**] [Priority: 3] {UDP} 192.168.1.1:67 -> 255.255.255.255:68
10/02-03:52:40.613196 [**] [116:414:1] "(ipv4) IPv4 packet to broadcast
dest address" [**] [Priority: 3] {UDP} 10.96.166.7:53600 ->
255.255.255.255:10001
10/02-03:52:40.621456 [**] [116:444:1] "(ipv4) IPv4 option set" [**]
[Priority: 3] {IP} 10.96.108.130 -> 224.0.0.22
10/02-03:52:40.652316 [**] [116:414:1] "(ipv4) IPv4 packet to broadcast
dest address" [**] [Priority: 3] {UDP} 0.0.0.0:68 -> 255.255.255.255:67
10/02-03:52:40.652316 [**] [116:408:1] "(ipv4) IPv4 packet from 'current
net' source address" [**] [Priority: 3] {UDP} 0.0.0.0:68 ->
255.255.255.255:67
10/02-03:52:40.654672 [**] [116:414:1] "(ipv4) IPv4 packet to broadcast
dest address" [**] [Priority: 3] {UDP} 10.5.32.1:67 -> 255.255.255.255:68
^C** caught int signal
== stopping
10/02-03:52:40.841313 [**] [116:414:1] "(ipv4) IPv4 packet to broadcast
dest address" [**] [Priority: 3] {UDP} 10.5.40.206:40570 ->
255.255.255.255:10001
-- [0] eth0
--
Disclaimer:
This e-mail and attachments are confidential and may be
privileged and
protected from discovery or disclosure. If you are not the
intended
recipient, be aware that any disclosure, copying, dissemination
or use
of this e-mail or any attachments is prohibited. If you have
received
this e-mail in error, please notify the sender immediately and
erase all
copies of the message and its attachments. Any views expressed
are
those of the individual sender(s) and may not necessarily reflect the
views of the Kenyatta University.
<http://www.ku.ac.ke>
<https://www.facebook.com/kenyattauni/>
<https://plus.google.com/u/0/101726393221697663110>
<https://www.linkedin.com/edu/kenyatta-university-14427>
<https://www.linkedin.com/edu/kenyatta-university-14427>
<https://twitter.com/KenyattaUni>
_______________________________________________ Snort-sigs mailing list Snort-sigs () lists snort org https://lists.snort.org/mailman/listinfo/snort-sigs Please visit http://blog.snort.org for the latest news about Snort! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!
Current thread:
- Snort capturing traffic from the entire network instead of just the IP Assigned NTWIGA MURITHI via Snort-sigs (Oct 10)
