RE: [Snort-users] No alert detection on alert console

permalink · #1 (**permalink**) 05-12-2004

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_001_01C437FF.61FE57AD
Content-Type: text/plain;
charset=iso-8859-1
Content-Transfer-Encoding: 7bit

Hi,

First thing I would recommend is to make sure there is traffic reaching your
sniffing port. Run TCPDUMP on this interface to make sure there is traffic
for Snort to work on. Next run Snort and have it display the alerts to the
screen so you can see if it is actually alerting. (Check the manual for the
settings required to do this.) If Snort is generating alerts check to see
if you have all your database info setup properly with passwords and
privileges. If your database is setup properly, run TCPDUMP on the database
listener interface to see if your Snort Sensor is trying to connect to it.
Check these things first and correct any problems. If this is all working
and you are still having issues post up your config files for a look see.

Whenever there is a problem you should always start at the beginning where a
packet arrives and work your way logically through the system at each stage
to see if the information is getting passed on.

Shawn Truax
Security Specialist
Corporate Security
155 University Ave.
Toronto, Ontario
M5H 3B7
(416)327-1107

-----Original Message-----
From: Naveen C Joshi [mailto:naveen_joshi@intersolutions.stpn.soft.net]
Sent: May 12, 2004 3:32 AM
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] No alert detection on alert console

Hi All :

I have installed Snort-2.1 and ACID-0.9.6 on my REDHAT 9.0 by using the
document "snort_enterprise.pdf" written by Steven J. Scott.

I have gone through as per steps mentioned on the document and everything is
working fine, but at my "alert console" there is no traffic/alert detection.
Even the TCP, UDP & ICMP traffic is also 0%.

I have explored on the database there is no event on the event tables and 1
sensor created on the sensor table.
I have installed one another snortcenter agent on other machine and
configured the sensor for it in management console. This sensor is also not
in my sensor table.

My sensor & snort daemon are running properly. The snort database user have
enough permission on the db.

Please suggest me how can I resolve this problem.

Best Regards

Naveen

-------------------------------------------------------
This SF.Net email is sponsored by Sleepycat Software
Learn developer strategies Cisco, Motorola, Ericsson & Lucent use to
deliver higher performing products faster, at low TCO.
http://www.sleepycat.com/telcomwpreg...rom=osdnemail3
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

------_=_NextPart_001_01C437FF.61FE57AD
Content-Type: text/html;
charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Diso-8859-1">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
5.5.2656.60">
<TITLE>RE: [Snort-users] No alert detection on alert console</TITLE>
</HEAD>
<BODY>

Hi,


First thing I would recommend is to make sure there =
is traffic reaching your sniffing port.  Run TCPDUMP on this =
interface to make sure there is traffic for Snort to work on.  =
Next run Snort and have it display the alerts to the screen so you can =
see if it is actually alerting.  (Check the manual for the =
settings required to do this.)  If Snort is generating alerts =
check to see if you have all your database info setup properly with =
passwords and privileges.  If your database is setup properly, run =
TCPDUMP on the database listener interface to see if your Snort Sensor =
is trying to connect to it. Check these things first and correct any =
problems.  If this is all working and you are still having issues =
post up your config files for a look see.

Whenever there is a problem you should always start =
at the beginning where a packet arrives and work your way logically =
through the system at each stage to see if the information is getting =
passed on.

Shawn Truax
 Security Specialist
 Corporate Security
 155 University Ave.
 Toronto, Ontario
 M5H 3B7
 (416)327-1107

 

-----Original Message-----
 From: Naveen C Joshi [<A =
HREF=3D"mailto:naveen_joshi@intersolutions.stpn.so ft.net">mailto:naveen_=
joshi@intersolutions.stpn.soft.net</A>]
 Sent: May 12, 2004 3:32 AM
 To: snort-users@lists.sourceforge.net
 Subject: [Snort-users] No alert detection on alert =
console

 

Hi All :


I have installed Snort-2.1 and ACID-0.9.6 on my =
REDHAT 9.0 by using the
 document "snort_enterprise.pdf" written by =
Steven J. Scott.


I have gone through as per steps mentioned on the =
document and everything is
 working fine, but at my "alert console" =
there is no traffic/alert detection.
 Even the TCP, UDP & ICMP traffic is also =
0%.


I have explored on the database there is no event on =
the event tables and 1
 sensor created on the sensor table.
 I have installed one another snortcenter agent on =
other machine and
 configured the sensor for it in management console. =
This sensor is also not
 in my sensor table.

 

My sensor & snort daemon are running properly. =
The snort database user have
 enough permission on the db.


Please suggest me how can I resolve this =
problem.


Best Regards


Naveen

 
 

-------------------------------------------------------
 This SF.Net email is sponsored by Sleepycat =
Software
 Learn developer strategies Cisco, Motorola, Ericsson =
& Lucent use to 
 deliver higher performing products faster, at low =
TCO.
 <A =
HREF=3D"http://www.sleepycat.com/telcomwpreg.php?From=3Dosdnemail3" =
TARGET=3D"_blank">http://www.sleepycat.com/telcomwpreg.php?From=3Dosdnem=
ail3</A>
 _________________________________________ ______
 Snort-users mailing list
 Snort-users@lists.sourceforge.net
 Go to this URL to change user options or =
unsubscribe:
 <A =
HREF=3D"https://lists.sourceforge.net/lists/listinfo/snort-users" =
TARGET=3D"_blank">https://lists.sourceforge.net/lists/listinfo/snort-use=
rs</A>
 Snort-users list archive:
 <A =
HREF=3D"http://www.geocrawler.com/redir-sf.php3?list=3Dsnort-users" =
TARGET=3D"_blank">http://www.geocrawler.com/redir-sf.php3?list=3Dsnort-u=
sers</A>


</BODY>
</HTML>
------_=_NextPart_001_01C437FF.61FE57AD--

-------------------------------------------------------
This SF.Net email is sponsored by Sleepycat Software
Learn developer strategies Cisco, Motorola, Ericsson & Lucent use to
deliver higher performing products faster, at low TCO.
http://www.sleepycat.com/telcomwpreg...rom=osdnemail3
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode