Re: [Snort-users] Acid shows sensors as 0

permalink · #1 (**permalink**) 11-23-2004

This is a multi-part message in MIME format.

------_=_NextPart_001_01C4D1A2.474309CB
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Use nmap or something to do a scan against the box or a short range of =
IPs on your network and see if snort detects anything.=20

-----Original Message-----
From: snort-users-admin@lists.sourceforge.net =
<snort-users-admin@lists.sourceforge.net>
To: Kevin Johnson <kjohnson@secureideas.net>
CC: Snort Users <snort-users@lists.sourceforge.net>
Sent: Tue Nov 23 14:31:11 2004
Subject: Re: [Snort-users] Acid shows sensors as 0

Maybe that might be it. How can I test that is really doing something ?=20

On Tue, 23 Nov 2004 15:28:03 -0500, Kevin Johnson
<kjohnson@secureideas.net> wrote:
> On Tue, 2004-11-23 at 15:21, Gentian Hila wrote:
>=20
>=20
> > The line that configures snort to connect in snort.conf is =
uncommented
> > and is like this:
> >
> > output database: log, mysql, user=3Dsnort password=3D******
> > dbname=3Dsnort host=3Dlocalhost
> >
> > (****** is the password) and snort connects as snort user in Mysql
> > and db name in mysql is snort.
> >
> > I have an empty event table.
> >
> > mysql> select * from event;
> > Empty set (0.00 sec)
> >
> > My question is: when you setup snort and acid, is it supposed to =
work
> > normally or do you have to configure other stuff and rules. My guess
> > is that it should work, even though it might need to be tuned. But
> > that's another story.
>=20
> It should work normally. How long has Snort been running? I would =
have
> to guess that it hasn't seen anything that it considered something to
> alert on. Until it sees something, for example someone accessing a =
web
> server and trying to get cmd.exe, that your rules would fire on, it
> doesn't report anything for ACID/BASE to display.
>=20
>=20
>=20
> Kevin
> -------------------
> BASE Project Lead
> http://sourceforge.net/projects/secureideas
> http://base.secureideas.net
> The next step in IDS analysis!
>=20
>=20
>

-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.=20
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...=3Dsnort-users

------_=_NextPart_001_01C4D1A2.474309CB
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<TITLE>Re: [Snort-users] Acid shows sensors as 0</TITLE>
</HEAD>
<BODY>


Use nmap or something to do a scan against the box or =
a short range of IPs on your network and see if snort detects =
anything. 
 
 
 
 
-----Original Message----- 
From: snort-users-admin@lists.sourceforge.net =
<snort-users-admin@lists.sourceforge.net> 
To: Kevin Johnson <kjohnson@secureideas.net> 
CC: Snort Users <snort-users@lists.sourceforge.net> 
Sent: Tue Nov 23 14:31:11 2004 
Subject: Re: [Snort-users] Acid shows sensors as 0 
 
Maybe that might be it. How can I test that is really doing something =
? 
 
 
On Tue, 23 Nov 2004 15:28:03 -0500, Kevin Johnson 
<kjohnson@secureideas.net> wrote: 
> On Tue, 2004-11-23 at 15:21, Gentian Hila wrote: 
> 
> 
> > The line that configures snort to connect in snort.conf is =
uncommented 
> > and is like this: 
> > 
> > output database: log, mysql, user=3Dsnort =
password=3D****** 
> >  dbname=3Dsnort host=3Dlocalhost 
> > 
> > (******  is the password) and snort connects as snort =
user in Mysql 
> > and db name in mysql is snort. 
> > 
> > I have an empty event table. 
> > 
> > mysql> select * from event; 
> > Empty set (0.00 sec) 
> > 
> > My question is: when you setup snort and acid, is it supposed =
to work 
> > normally or do you have to configure other stuff and rules. My =
guess 
> > is that it should work, even though it might need to be tuned. =
But 
> > that's another story. 
> 
> It should work normally.  How long has Snort been =
running?  I would have 
> to guess that it hasn't seen anything that it considered something =
to 
> alert on.  Until it sees something, for example someone =
accessing a web 
> server and trying to get cmd.exe,  that your rules would fire =
on, it 
> doesn't report anything for ACID/BASE to display. 
> 
> 
> 
> Kevin 
> ------------------- 
> BASE Project Lead 
> <A =
HREF=3D"http://sourceforge.net/projects/secureideas">http://sourceforge.n=
et/projects/secureideas</A> 
> <A =
HREF=3D"http://base.secureideas.net">http://base.secureideas.net</A> 
> The next step in IDS analysis! 
> 
> 
> 
 
 
------------------------------------------------------- 
SF email is sponsored by - The IT Product Guide 
Read honest & candid reviews on hundreds of IT Products from real =
users. 
Discover which products truly live up to the hype. Start reading =
now. 
<A =
HREF=3D"http://productguide.itmanagersjournal.com/">http://productguide.i=
tmanagersjournal.com/</A> 
_______________________________________________ 
Snort-users mailing list 
Snort-users@lists.sourceforge.net 
Go to this URL to change user options or unsubscribe: 
<A =
HREF=3D"https://lists.sourceforge.net/lists/listinfo/snort-users">https:/=
/lists.sourceforge.net/lists/listinfo/snort-users</A> 
Snort-users list archive: 
<A =
HREF=3D"http://www.geocrawler.com/redir-sf.php3?list=3Dsnort-users">http:=
//www.geocrawler.com/redir-sf.php3?list=3Dsnort-users</A> 



</BODY>
</HTML>
------_=_NextPart_001_01C4D1A2.474309CB--

-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode