[Snort-users] Snort mysql with no ip interface

permalink · #1 (**permalink**) 12-30-2003

This is a multi-part message in MIME format.

------=_NextPart_000_0001_01C3C8D3.C8941B30
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

I have Version 2.0.1-ODBC-MySQL-WIN32 (Build 88) under windows with
acid. Everything is working fine on interface 10.0.0.1. Logging to the
db works fine, etc. I put in a second NIC and set it up under XP with no
IP address. Ethereal can sniff packets on the interface just fine. I
have snort configured for the second interface, but it cannot log to the
mysql database. I added an output plugin for file and was able to see
alerts from it. What am I doing wrong?

Cable modem-----------dumb hub---------linksys fw---------10.0.0.1
interface 1
|_______________________0.0.0.0
interface 2

Snort output:

D:\EagleX\snort\bin>D:\EagleX\Snort\bin\snort.exe -c
"D:\EagleX\Snort\etc\snort.conf" -l "D:\EagleX\Snort\logs" -i 2 -h 192.1
0/24 -X -z
Running in IDS mode
Log directory = D:\EagleX\Snort\logs

Initializing Network Interface
\Device\NPF_{B7264AA4-8C2E-489E-951C-A32498F2FD36}

--== Initializing Snort ==--
Initializing Output Plugins!
Decoding Ethernet on interface
\Device\NPF_{B7264AA4-8C2E-489E-951C-A32498F2FD36}
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file D:\EagleX\Snort\etc\snort.conf

++++++++++++++++++++++++++++++++++++++++++++++++++ +
Initializing rule chains...
No arguments to frag2 directive, setting defaults to:
Fragment timeout: 60 seconds
Fragment memory cap: 4194304 bytes
Fragment min_ttl: 0
Fragment ttl_limit: 5
Fragment Problems: 0
Self preservation threshold: 500
Self preservation period: 90
Suspend threshold: 1000
Suspend period: 30
Stream4 config:
Stateful inspection: ACTIVE
Session statistics: INACTIVE
Session timeout: 30 seconds
Session memory cap: 8388608 bytes
State alerts: INACTIVE
Evasion alerts: INACTIVE
Scan alerts: ACTIVE
Log Flushed Streams: INACTIVE
MinTTL: 1
TTL Limit: 5
Async Link: 0
State Protection: 0
Self preservation threshold: 50
Self preservation period: 90
Suspend threshold: 200
Suspend period: 30
Stream4_reassemble config:
Server reassembly: ACTIVE
Client reassembly: ACTIVE
Reassembler alerts: ACTIVE
Ports: 21 23 25 53 80 110 111 143 513 1433
Emergency Ports: 21 23 25 53 80 110 111 143 513 1433
http_decode arguments:
Unicode decoding
IIS alternate Unicode decoding
IIS double encoding vuln
Flip backslash to slash
Include additional whitespace separators
Ports to decode http on: 80 8877 8888
rpc_decode arguments:
Ports to decode RPC on: 111 32771
alert_fragments: INACTIVE
alert_large_fragments: ACTIVE
alert_incomplete: ACTIVE
alert_multiple_requests: ACTIVE
telnet_decode arguments:
Ports to decode telnet on: 21 23 25 119
Using LOCAL time
Conversation Config:
KeepStats: 0
Conv Count: 65535
Timeout : 60
Alert Odd?: 1
Allowed IP Protocols: All

database: compiled support for ( mysql odbc )
database: configured to use Mysql
database: host = localhost
database: port = 7788
database: database name = snort
database: user = snort
database: password is set
database: sensor name = inet
database: detail level = full
database: sensor id = 3
database: schema version = 106
database: using the "alert" facility
1581 Snort rules read...
1581 Option Chains linked into 197 Chain Headers
0 Dynamic rules
++++++++++++++++++++++++++++++++++++++++++++++++++ +

Rule application order: ->activation->dynamic->alert->pass->log

--== Initialization Complete ==--

-*> Snort! <*-
Version 2.0.1-ODBC-MySQL-WIN32 (Build 88)
By Martin Roesch (roesch@sourcefire.com, www.snort.org)
1.7-WIN32 Port By Michael Davis (mike@datanerds.net,
www.datanerds.net/~mike)
1.8 - 2.0 WIN32 Port By Chris Reid (chris.reid@codecraftconsultants.com)

------=_NextPart_000_0001_01C3C8D3.C8941B30
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">

<meta name=3DProgId content=3DWord.Document>
<meta name=3DGenerator content=3D"Microsoft Word 10">
<meta name=3DOriginator content=3D"Microsoft Word 10">
<link rel=3DFile-List href=3D"cid:filelist.xml@01C3C8D3.C7DED4F0">

<style>

</style>

</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple =
style=3D'tab-interval:.5in'>

<div class=3DSection1>

I have Version 2.0.1-ODBC-MySQL-WIN32 (Build 88) =
under
windows with acid. Everything is working fine on interface 10.0.0.1. =
Logging to
the db works fine, etc. I put in a second NIC and set it up under XP =
with no IP
address. Ethereal can sniff packets on the interface just fine. I have =
snort configured for the second interface, but it =
cannot log
to the mysql database. I added an output =
plugin for file and was able to see alerts from =
it. What am
I doing wrong?<o:p></o:p>

<o:p> </o:p>

<o:p> </o:p>

Cable modem-----------dumb hub---------linksys
fw---------10.0.0.1 interface =
1<o:p></o:p>

        &nbs=
p;            &nbsp=
;        & nbsp;   =
    
|_______________________0.0.0.0  interface =
2<o:p></o:p>

<o:p> </o:p>

<o:p> </o:p>

Snort output:<o:p></o:p>

<o:p> </o:p>

D:\EagleX\snort\bin>D:\EagleX\Sno rt\bin\snort.exe =
-c
"D:\EagleX\Snort\etc\snort.conf" -l =
"D:\EagleX\Snort\logs"
-i 2 -h 192.1<o:p></o:p>

0/24 -X -z<o:p></o:p>

Running in IDS mode<o:p></o:p>

Log directory =3D =
D:\EagleX\Snort\logs<o:p></o:p>

<o:p> </o:p>

Initializing Network Interface
\Device\NPF_{B7264AA4-8C2E-489E-951C-A32498F2FD36}<o:p></o:p></fon=
t>

<o:p> </o:p>

         =
--=3D=3D
Initializing Snort =3D=3D--<o:p></o:p>

Initializing Output Plugins!<o:p></o:p>

Decoding Ethernet on interface
\Device\NPF_{B7264AA4-8C2E-489E-951C-A32498F2FD36}<o:p></o:p></fon=
t>

Initializing =
Preprocessors!<o:p></o:p>

Initializing Plug-ins!<o:p></o:p>

Parsing Rules file =
D:\EagleX\Snort\etc\snort.conf<o:p></o:p>

<o:p> </o:p>

++++++++++++++++++++++++++++++++++++ +++++++++++++++<o:=
p></o:p>

Initializing rule =
chains...<o:p></o:p>

No arguments to frag2 directive, setting defaults =
to:<o:p></o:p>

   
Fragment timeout: 60 seconds<o:p></o:p>

   
Fragment memory cap: 4194304 bytes<o:p></o:p>

   
Fragment min_ttl:   =
0<o:p></o:p>

   
Fragment ttl_limit: =
5<o:p></o:p>

   
Fragment Problems: 0<o:p></o:p>

   
Self preservation threshold: 500<o:p></o:p>

   
Self preservation period: 90<o:p></o:p>

   
Suspend threshold: 1000<o:p></o:p>

   
Suspend period: 30<o:p></o:p>

Stream4 config:<o:p></o:p>

    =
Stateful inspection: =
ACTIVE<o:p></o:p>

   
Session statistics: INACTIVE<o:p></o:p>

   =
 Session timeout: 30 =
seconds<o:p></o:p>

   
Session memory cap: 8388608 bytes<o:p></o:p>

   
State alerts: INACTIVE<o:p></o:p>

   
Evasion alerts: INACTIVE<o:p></o:p>

   
Scan alerts: ACTIVE<o:p></o:p>

    =
Log
Flushed Streams: INACTIVE<o:p></o:p>

    =
MinTTL: 1<o:p></o:p>

    =
TTL
Limit: 5<o:p></o:p>

    =
Async Link: 0<o:p></o:p>

   
State Protection: 0<o:p></o:p>

    Self preservation =
threshold: 50<o:p></o:p>

   
Self preservation period: 90<o:p></o:p>

   
Suspend threshold: 200<o:p></o:p>

   
Suspend period: 30<o:p></o:p>

Stream4_reassemble config:<o:p></o:p>

   
Server reassembly: ACTIVE<o:p></o:p>

   
Client reassembly: ACTIVE<o:p></o:p>

    =
Reassembler alerts: =
ACTIVE<o:p></o:p>

   
Ports: 21 23 25 53 80 110 111 143 513 =
1433<o:p></o:p>

   
Emergency Ports: 21 23 25 53 80 110 111 143 513 =
1433<o:p></o:p>

http_decode</s=
pan> =
arguments:<o:p></o:p>

   
Unicode decoding<o:p></o:p>

    =
IIS
alternate Unicode decoding<o:p></o:p>

    =
IIS
double encoding vuln<o:p></o:p>

   
Flip backslash to slash<o:p></o:p>

   
Include additional whitespace =
separators<o:p></o:p>

   
Ports to decode http on: 80 8877 =
8888<o:p></o:p>

rpc_decode</sp=
an> =
arguments:<o:p></o:p>

   
Ports to decode RPC on: 111 32771<o:p></o:p>

    =
alert_fragments: =
INACTIVE<o:p></o:p>

    =
alert_large_fragments: =
ACTIVE<o:p></o:p>

    =
alert_incomplete: =
ACTIVE<o:p></o:p>

    =
alert_multiple_requests: =
ACTIVE<o:p></o:p>

telnet_decode<=
/span> =
arguments:<o:p></o:p>

   
Ports to decode telnet on: 21 23 25 =
119<o:p></o:p>

Using LOCAL time<o:p></o:p>

Conversation Config:<o:p></o:p>

   =
KeepStats: 0<o:p></o:p>

   =
Conv Count: 65535<o:p></o:p>

  
Timeout   : =
60<o:p></o:p>

   =
Alert Odd?: 1<o:p></o:p>

   =
Allowed
IP Protocols:  =
All<o:p></o:p>

<o:p> </o:p>

database</span=
>: compiled
support for ( mysql odbc )<o:p></o:p>

database</span=
>: configured
to use Mysql<o:p></o:p>

database</span=
>:        &nbs=
p; 
host =3D localhost<o:p></o:p>

database</span=
>:        &nbs=
p; 
port =3D 7788<o:p></o:p>

database</span=
>: database
name =3D snort<o:p></o:p>

database</span=
>:        &nbs=
p; 
user =3D snort<o:p></o:p>

database</span=
>: password
is set<o:p></o:p>

database</span=
>:   sensor name =3D inet<o:p></o:p>

database</span=
>: detail
level  =3D =
full<o:p></o:p>

database</span=
>:     sensor id =3D =
3<o:p></o:p>

database</span=
>: schema
version =3D 106<o:p></o:p>

database</span=
>: using the
"alert" facility<o:p></o:p>

1581 Snort rules read...<o:p></o:p>

1581 Option Chains linked into 197 Chain =
Headers<o:p></o:p>

0 Dynamic rules<o:p></o:p>

++++++++++++++++++++++++++++++++++++ +++++++++++++++<o:=
p></o:p>

<o:p> </o:p>

Rule application order:
->activation->dynamic->alert->pass->log<o:p></o:p><=
/font>

<o:p> </o:p>

         =
--=3D=3D
Initialization Complete =3D=3D--<o:p></o:p>

<o:p> </o:p>

-*> Snort! <*-<o:p></o:p>

Version 2.0.1-ODBC-MySQL-WIN32 (Build =
88)<o:p></o:p>

By Martin Roesch
(roesch@sourcefire.com, www.snort.org)<o:p></o:p>

1.7-WIN32 Port By Michael =
Davis
(mike@datanerds.net, =
www.datanerds.net/~mike)<o:p></o:p>

1.8 - 2.0 WIN32 Port By =
Chris Reid
(chris.reid@codecraftconsultants.com)<o:p></o:p>

</div>

</body>

</html>

------=_NextPart_000_0001_01C3C8D3.C8941B30--

-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode