You are not logged in.
Pages: 1
I didn't use snort for some time (since 2.7 on Gentoo). I tried to make it (up-to-date version) run on Arch. I'm wondering why I failed?
1. I installed it with pacman.
2. I downloaded the most recent (for registered user) rules and uploaded them to the /etc/snort/ directory
3. I made some changes in /etc/snort/snort.conf:
a) I changed the *RULE_PATH variables: they should begin with `.' rather than `..'
b) I uncommented the `sfportscan' preprocessor
c) I commended out the `dynamicdetection' line (section 4.) -- it certainly doesn't work...
d) I commented out the `reputation' preprocessor
e) I uncommented `output alert_syslog: LOG_AUTH LOG_ALERT' line.
4. I'm trying to run it as:
# snort -i eth0 -c /etc/snort/snort.conf -N
(optionally with `-A fast' and/or `-l somedir' and/or `-h 127.0.0.0/8' and or `--process-all-events' and/or ...)
For all cases I tried to teardrop the host (http://www.securityfocus.com/bid/124/exploit) scan ports with nmap etc and I can see no alerts anywhere...
As I remember the last time I was using it (2.7 on Gentoo) it worked perfectly... What am I doing wrong? Any help welcome...
Best regards
m.
Offline
I didn't use snort for some time (since 2.7 on Gentoo). I tried to make it (up-to-date version) run on Arch. I'm wondering why I failed?
1. I installed it with pacman.
2. I downloaded the most recent (for registered user) rules and uploaded them to the /etc/snort/ directory
3. I made some changes in /etc/snort/snort.conf:
a) I changed the *RULE_PATH variables: they should begin with `.' rather than `..'
b) I uncommented the `sfportscan' preprocessor
c) I commended out the `dynamicdetection' line (section 4.) -- it certainly doesn't work...
d) I commented out the `reputation' preprocessor
e) I uncommented `output alert_syslog: LOG_AUTH LOG_ALERT' line.4. I'm trying to run it as:
# snort -i eth0 -c /etc/snort/snort.conf -N
(optionally with `-A fast' and/or `-l somedir' and/or `-h 127.0.0.0/8' and or `--process-all-events' and/or ...)For all cases I tried to teardrop the host (http://www.securityfocus.com/bid/124/exploit) scan ports with nmap etc and I can see no alerts anywhere...
As I remember the last time I was using it (2.7 on Gentoo) it worked perfectly... What am I doing wrong? Any help welcome...Best regards
m.
Try out 'snort -whateverswitchesyouwant dst host 123.456.789.123'
I think that you need to specify your own IP address for the localhost, if you use the loopback it will only get alerts from itself.
When I win the lottery, the first thing I will do, before I buy a new car or a house, would be to buy a goddamn Cisco XR 12000 router and enough T3 lines to wire a country.
Offline
Pages: 1