[Snort-users] Cant see alert for rule

permalink · #1 (**permalink**) 06-02-2004

This is a multi-part message in MIME format.

------=_NextPart_000_0032_01C4489E.3B536410
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

1)
Snort 2.0.6 on linux

2)
Three pcs:
1 2 3
w2kPC victim linux attacker linux snort box

3)
I run:
Snort -d -e -v -c /etc/snort/snort.conf (no errors)

4)
Rule in ftp.rules is:
Alert tcp any any -> any 21 (content: "USER administrator"; msg: "FTP
administrator login attempt";)=20

5)
When I run: ftp <IPVictim> from linux attacker, I don't get any rules =
fired
on my snort box.

6)
I have a Gigabit Linksys 5-port workgroup switch between them all

Why am I not able to see the alert?

Thanks!

------=_NextPart_000_0032_01C4489E.3B536410
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
6.0.4630.0">
<TITLE>Cant see alert for rule</TITLE>
</HEAD>
<BODY>


1)

 Snort 2.0.6 on linux

 

2)

 Three pcs:

   1     =
        =
        =
2       =
        =
        3

 w2kPC =
victim       &n bsp;  linux =
attacker           &nbsp=
;        linux snort box

 

3)

 I run:

 Snort -d -e -v -c =
/etc/snort/snort.conf     (no errors)

 

4)

 Rule in <A =
HREF=3D"file://ftp.rules">ftp.rules</A> =
is:

 Alert tcp any any -> any 21 =
(content: "USER administrator"; msg: "FTP administrator =
login attempt";) 

 

5)

 When I run: ftp <IPVictim>  =
from linux attacker, I don’t get any rules fired on my snort =
box.

 

6)

 I have a Gigabit Linksys 5-port =
workgroup switch between them all

 

Why am I not able to see the =
alert?


Thanks!


</BODY>
</HTML>
------=_NextPart_000_0032_01C4489E.3B536410--

-------------------------------------------------------
This SF.Net email is sponsored by the new InstallShield X.
From Windows to Linux, servers to mobile, InstallShield X is the one
installation-authoring solution that does it all. Learn more and
evaluate today! http://www.installshield.com/Dev2Dev/0504
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode