RE: [Snort-users] No Alerts Being Generated

This is a multi-part message in MIME format.

------=_NextPart_000_006A_01C4AB99.8C72B450
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

I was looking through your snort.conf file try this

output database: alert, mysql, user=snort password=snort dbname=snort
host=localhost sensor_name=rosnort

not sure why you had a port # in there and set for log..


-----Original Message-----
From: Kaplan, Andrew H. [mailto:AHKAPLAN@PARTNERS.ORG]
Sent: Wednesday, October 06, 2004 11:25 AM
To: Lance Boon; Snort User Group (E-mail)
Subject: RE: [Snort-users] No Alerts Being Generated

I am scanning the snort box itself. This is done using a remote host to
scan the
snort box.

-----Original Message-----
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net]On Behalf Of Lance Boon
Sent: Wednesday, October 06, 2004 9:44 AM
To: snort-users@lists.sourceforge.net
Subject: RE: [Snort-users] No Alerts Being Generated


Are you scanning a machine on the network or the snort box itself? If
you are scanning a machine on the network and snort isn't generating any
alerts try scanning the snort box itself and see if alerts are
generated. If alerts generate when you scan the snort box but not when
you scan other machines. Then it's a switch issue I would dare to bet
and you need to set up a mirror port on your switch.


-----Original Message-----
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Kaplan,
Andrew H.
Sent: Tuesday, October 05, 2004 3:41 PM
To: 'Nigel Houghton'; Snort User Group (E-mail)
Subject: RE: [Snort-users] No Alerts Being Generated

Hi there --

I made the change within the snort.conf file you had suggested. I also
ran the
snort -T command
and it ran through the configuration without reporting back any errors.
Finally,
I installed NeWT,
the Windows version of Nessus, on another machine and ran several
different
tests on the snort box.
The tests I ran were portscans and the "SANS Top 20" list. After the
scans were
finished, I checked
the alert file as well as the ACID GUI. Neither one mentioned any alert
conditions taking place.

As a further test, I changed the !HOME_NET setting back to any to see if
that
made any difference.
It did not. What should I look for next?


-----Original Message-----
From: Nigel Houghton [mailto:nigel@sourcefire.com]
Sent: Wednesday, September 29, 2004 4:57 PM
To: snort-users@lists.sourceforge.net
Cc: Kaplan, Andrew H.
Subject: Re: [Snort-users] No Alerts Being Generated


Well the first thing I see in your file is the EXTERNAL_NET variable is
set
to any. You might want to set that to !$HOME_NET for a start.

Second, you can run snort -T -c /etc/snort/snort.conf to test your snort
configuration.

Next thing is to make sure your snort box is listening on a span port of
a
switch or a tap or a hub (probably not using one in your case I think)
and
that the span port/tap is configured correctly.

Then, if possible, you could try generating some traffic that Snort
should
alert on, like maybe a web request for ftp.pl which should set off sid
1107. You could run some nessus tests or just do it manually with a
straightforward http://www.yourwebhost.org/ftp.pl or pick some other
simple
rule to test.

On 0, snort-users-request@lists.sourceforge.net allegedly wrote:
> 3. No Alerts Being Generated (Kaplan, Andrew H.)
>
> --__--__--
>
> Message: 3
> From: "Kaplan, Andrew H." <AHKAPLAN@PARTNERS.ORG>
> To: "Snort User Group (E-mail)" <snort-users@lists.sourceforge.net>
> Date: Wed, 29 Sep 2004 15:35:26 -0400
> Subject: [Snort-users] No Alerts Being Generated
>
> This message is in MIME format. Since your mail reader does not
understand
> this format, some or all of this message may not be legible.
>
> ------_=_NextPart_000_01C4A65B.7895D89C
> Content-Type: text/plain;
> charset="iso-8859-1"
>
> I completed installing snort 2.2.0 (build 30) and have begun running
it. The
> ACID GUI and /var/log/snort/alert files have not shown any alerts
> even though the program has been running for over an hour. To verify
there
were
> no syntax errors in the snort.conf file, I ran the following:
>
> snort -c /etc/snort/snort.conf
>
> There were no errors and warnings, and the program appears to be
running
> properly. Where in snort.conf and elsewhere, should I check for
> configuration mistakes? I have included the snort.conf file here.
Thanks.
>
> <<snort.conf.29sept04.txt>>
>
> --__--__--
>

+-----------------------------------------------------------------+
Nigel Houghton Research Engineer Sourcefire Inc.
Vulnerability Research Team

Cat: "Forget red - let's go all the way up to brown alert!"
Kryten: "There's no such thing as a brown alert sir."
Cat: "You won't be saying that in a minute!"


-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give
us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out
more
http://productguide.itmanagersjourna...uidepromo.tmpl
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

------=_NextPart_000_006A_01C4AB99.8C72B450
Content-Type: application/x-pkcs7-signature;
name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="smime.p7s"

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCS qGSIb3DQEHAQAAoIIKHzCCAj0w
ggGmAhEAzbp/VvDf5LxU/iKss3KqVTANBgkqhkiG9w0BAQIFADBfMQswCQYDVQQGEwJVUzE XMBUG
A1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzID EgUHVibGljIFByaW1hcnkgQ2Vy
dGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNOTYwMTI5MDAwMDAwWh cNMjgwODAxMjM1OTU5WjBfMQsw
CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNz A1BgNVBAsTLkNsYXNzIDEgUHVi
bGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwgZ 8wDQYJKoZIhvcNAQEBBQADgY0A
MIGJAoGBAOUZv22jVmEtmUhx9mfeuY3rt56GgAqRDvo4Ja9GiI Llc6igmyRdDR/MZW4MsNBWhBiH
mgabEKFz37RYOWtuwfYV1aioP6oSBo0xrH+wNNePNGeICc0UEe JORVZpH3gCgNrcR5EpuzbJY1zF
4Ncth3uhtzKwezC6Ki8xqu6jZ9rbAgMBAAEwDQYJKoZIhvcNAQ ECBQADgYEATD+4i8Zo3+5DMw5d
6abLB4RNejP/khv0Nq3YlSI2aBFsfELM85wuxAc/FLAPT/+Qknb54rxK6Y/NoIAK98Up8YIiXbix
3YEjo3slFUYweRb46gVLlH8dwhzI47f0EEA8E8NfH1PoSOSGtH uhNbB7Jbq4046rPzidADQAmPPR
cZQwggNiMIICy6ADAgECAhAL2gsXwT+JjqsJdHq0zi4zMA0GCS qGSIb3DQEBAgUAMF8xCzAJBgNV
BAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE3MDUGA1 UECxMuQ2xhc3MgMSBQdWJsaWMg
UHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw05OD A1MTIwMDAwMDBaFw0wODA1MTIy
MzU5NTlaMIHMMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB 0GA1UECxMWVmVyaVNpZ24gVHJ1
c3QgTmV0d29yazFGMEQGA1UECxM9d3d3LnZlcmlzaWduLmNvbS 9yZXBvc2l0b3J5L1JQQSBJbmNv
cnAuIEJ5IFJlZi4sTElBQi5MVEQoYyk5ODFIMEYGA1UEAxM/VmVyaVNpZ24gQ2xhc3MgMSBDQSBJ
bmRpdmlkdWFsIFN1YnNjcmliZXItUGVyc29uYSBOb3QgVmFsaW RhdGVkMIGfMA0GCSqGSIb3DQEB
AQUAA4GNADCBiQKBgQC7WkSKBBa7Vf0DeootlE8VeDa4DUqyb5 xUv7zodyqdufBou5XZMUFweoFL
uUgTVi3HCOGEQqvAopKrRFyqQvCCDgLpL/vCO7u+yScKXbawNkIztW5UiE+HSr8Z2vkV6A+Hthzj
zMaajn9qJJLj/OBluqexfu/J2zdqyErICQbkmQIDAQABo4GwMIGtMA8GA1UdEwQIMAYBAf8CA QAw
RwYDVR0gBEAwPjA8BgtghkgBhvhFAQcBATAtMCsGCCsGAQUFBw IBFh93d3cudmVyaXNpZ24uY29t
L3JlcG9zaXRvcnkvUlBBMDEGA1UdHwQqMCgwJqAkoCKGIGh0dH A6Ly9jcmwudmVyaXNpZ24uY29t
L3BjYTEuY3JsMAsGA1UdDwQEAwIBBjARBglghkgBhvhCAQEEBA MCAQYwDQYJKoZIhvcNAQECBQAD
gYEAAn2eb0VLOKC43ulTZCG85Ewrjx7+kkCs2Ao5aqEyISwHm6 tZ/tJiGn1VOLA3c9z0B2ZjYr3h
U3BSh+eo2FLpWy2q4d7PrDFU1IsZyNgjqO8EKzJ9LBgcyHyJqC 538kTRZQpNdLXu0xuSc3QuiTs1
E3LnQDGa07LEq+dWvovj+xUwggR0MIID3aADAgECAhBljIdb8o DhKyqqOaJMV2VUMA0GCSqGSIb3
DQEBBAUAMIHMMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB 0GA1UECxMWVmVyaVNpZ24gVHJ1
c3QgTmV0d29yazFGMEQGA1UECxM9d3d3LnZlcmlzaWduLmNvbS 9yZXBvc2l0b3J5L1JQQSBJbmNv
cnAuIEJ5IFJlZi4sTElBQi5MVEQoYyk5ODFIMEYGA1UEAxM/VmVyaVNpZ24gQ2xhc3MgMSBDQSBJ
bmRpdmlkdWFsIFN1YnNjcmliZXItUGVyc29uYSBOb3QgVmFsaW RhdGVkMB4XDTA0MDgxMTAwMDAw
MFoXDTA1MDgxMTIzNTk1OVowggEYMRcwFQYDVQQKEw5WZXJpU2 lnbiwgSW5jLjEfMB0GA1UECxMW
VmVyaVNpZ24gVHJ1c3QgTmV0d29yazFGMEQGA1UECxM9d3d3Ln ZlcmlzaWduLmNvbS9yZXBvc2l0
b3J5L1JQQSBJbmNvcnAuIGJ5IFJlZi4sTElBQi5MVEQoYyk5OD EeMBwGA1UECxMVUGVyc29uYSBO
b3QgVmFsaWRhdGVkMTQwMgYDVQQLEytEaWdpdGFsIElEIENsYX NzIDEgLSBNaWNyb3NvZnQgRnVs
bCBTZXJ2aWNlMRMwEQYDVQQDFApMYW5jZSBCb29uMSkwJwYJKo ZIhvcNAQkBFhpsYm9vbkBmaXJz
dHN0YXRlYmFua3N3LmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQ AwgYkCgYEAzL0ZrtPgx8D4nHq3
wxyEGnqVEVc3XJDuRoohNnOFS+lGW3srTDjlT85BB9GiFE3F3D jdCmYNx72TQjVWx7B0ACGftJJN
F7qsvYSVV18fjoVDxpbAhwSr1AVfOwDeStKVvRYZmC0jGO0Kye oRuao3ZqolRUd/h5wVmyxh/y+H
ppMCAwEAAaOCAQYwggECMAkGA1UdEwQCMAAwgawGA1UdIASBpD CBoTCBngYLYIZIAYb4RQEHAQEw
gY4wKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LnZlcmlzaWduLm NvbS9DUFMwYgYIKwYBBQUHAgIw
VjAVFg5WZXJpU2lnbiwgSW5jLjADAgEBGj1WZXJpU2lnbidzIE NQUyBpbmNvcnAuIGJ5IHJlZmVy
ZW5jZSBsaWFiLiBsdGQuIChjKTk3IFZlcmlTaWduMBEGCWCGSA GG+EIBAQQEAwIHgDAzBgNVHR8E
LDAqMCigJqAkhiJodHRwOi8vY3JsLnZlcmlzaWduLmNvbS9jbG FzczEuY3JsMA0GCSqGSIb3DQEB
BAUAA4GBAGteJGBNoAcAjbYZFYlbUczcj0ZGOc+Pgn6h//3CV6vvwqyXjk6VXOrlGi5QvRp6tase
s5813O06xPUmHb1Sp4W1+1LUsJ7XKVFS1ud6hgcBC0QKw0x0Bb bwbBa74Hna+sEqwxU7qew4Geaz
HtZZwDjTfFMaIQwdz5cBlE6gbSRoMYIEPjCCBDoCAQEwgeEwgc wxFzAVBgNVBAoTDlZlcmlTaWdu
LCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3 JrMUYwRAYDVQQLEz13d3cudmVy
aXNpZ24uY29tL3JlcG9zaXRvcnkvUlBBIEluY29ycC4gQnkgUm VmLixMSUFCLkxURChjKTk4MUgw
RgYDVQQDEz9WZXJpU2lnbiBDbGFzcyAxIENBIEluZGl2aWR1YW wgU3Vic2NyaWJlci1QZXJzb25h
IE5vdCBWYWxpZGF0ZWQCEGWMh1vygOErKqo5okxXZVQwCQYFKw 4DAhoFAKCCArIwGAYJKoZIhvcN
AQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDQxMD A2MTY0MjI0WjAjBgkqhkiG9w0B
CQQxFgQUFMUf4vrvGH0VqrinAZQev3Hf4xQwZwYJKoZIhvcNAQ kPMVowWDAKBggqhkiG9w0DBzAO
BggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAg cwDQYIKoZIhvcNAwICASgwBwYF
Kw4DAhowCgYIKoZIhvcNAgUwgfIGCSsGAQQBgjcQBDGB5DCB4T CBzDEXMBUGA1UEChMOVmVyaVNp
Z24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldH dvcmsxRjBEBgNVBAsTPXd3dy52
ZXJpc2lnbi5jb20vcmVwb3NpdG9yeS9SUEEgSW5jb3JwLiBCeS BSZWYuLExJQUIuTFREKGMpOTgx
SDBGBgNVBAMTP1ZlcmlTaWduIENsYXNzIDEgQ0EgSW5kaXZpZH VhbCBTdWJzY3JpYmVyLVBlcnNv
bmEgTm90IFZhbGlkYXRlZAIQZYyHW/KA4SsqqjmiTFdlVDCB9AYLKoZIhvcNAQkQAgsxgeSggeEw
gcwxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLEx ZWZXJpU2lnbiBUcnVzdCBOZXR3
b3JrMUYwRAYDVQQLEz13d3cudmVyaXNpZ24uY29tL3JlcG9zaX RvcnkvUlBBIEluY29ycC4gQnkg
UmVmLixMSUFCLkxURChjKTk4MUgwRgYDVQQDEz9WZXJpU2lnbi BDbGFzcyAxIENBIEluZGl2aWR1
YWwgU3Vic2NyaWJlci1QZXJzb25hIE5vdCBWYWxpZGF0ZWQCEG WMh1vygOErKqo5okxXZVQwDQYJ
KoZIhvcNAQEBBQAEgYCZ6vxVU3m6J9gzo2JfGdzxizUGV0WXi0 qAkyYVRCZpO6U0Fv44B0z/j05q
G+iKMOgoZxdBTFvdY71Ngp17rqSjCm2aUFo+HCxVYb9nXBut6X Us+7Afr29LhNnSNTEaTB/z7xCZ
/0nqT2uT18c/8CHErmoaRcoVKytist0kKW0AngAAAAAAAA==

------=_NextPart_000_006A_01C4AB99.8C72B450--


-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjourna...uidepromo.tmpl
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users