RE: [Snort-users] snort not reporting

permalink · #1 (**permalink**) 12-13-2004

This is a multi-part message in MIME format.

------=_NextPart_000_01A8_01C4E0D6.774CEDD0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

first, be patient. reposting 10 hours later will not get you an answer
faster. Sunday evening ya know.

second. what are you plugged into? also what I see first I is the
following.

Snort received 8244 packets
Analyzed: 8244(100.000%)
Dropped: 0(0.000%)
================================================== ==========================
===
Breakdown by protocol:
TCP: 0 (0.000%)
UDP: 0 (0.000%)
ICMP: 0 (0.000%)
ARP: 0 (0.000%)
EAPOL: 0 (0.000%)
IPv6: 0 (0.000%)
IPX: 0 (0.000%)
OTHER: 0 (0.000%)
DISCARD: 0 (0.000%)

also, what is happening on this interface?

Initializing Network Interface ppp0

--== Initializing Snort ==--

Initializing Output Plugins!

Decoding PPP on interface ppp0

Patrick S. Harper | CISSP RHCT MCSE
www.internetsecurityguru.com

www.ntsug.org - Snort Users Group

"If there is no light at the end of the tunnel, get down there and light the
damn thing yourself!"

_____

From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Allan Jensen
Sent: Monday, December 13, 2004 3:49 AM
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] snort not reporting

I installed snort 2.2.0 on Mac OS X 10.3.6 together with ACID 0.9.6b23.
Everything went fine. When I start snort:

sudo snort -dvi -c /etc/snort/snort.conf

I get the following:

Running in IDS mode
Log directory = /var/log/snort

Initializing Network Interface ppp0

--== Initializing Snort ==--
Initializing Output Plugins!
Decoding PPP on interface ppp0
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file /etc/snort/snort.conf

++++++++++++++++++++++++++++++++++++++++++++++++++ +
Initializing rule chains...
,-----------[Flow Config]----------------------
| Stats Interval: 0
| Hash Method: 2
| Memcap: 10485760
| Rows : 4099
| Overhead Bytes: 16400(%0.16)
`----------------------------------------------
No arguments to frag2 directive, setting defaults to:
Fragment timeout: 60 seconds
Fragment memory cap: 4194304 bytes
Fragment min_ttl: 0
Fragment ttl_limit: 5
Fragment Problems: 0
Self preservation threshold: 500
Self preservation period: 90
Suspend threshold: 1000
Suspend period: 30
Stream4 config:
Stateful inspection: ACTIVE
Session statistics: INACTIVE
Session timeout: 30 seconds
Session memory cap: 8388608 bytes
State alerts: INACTIVE
Evasion alerts: INACTIVE
Scan alerts: INACTIVE
Log Flushed Streams: INACTIVE
MinTTL: 1
TTL Limit: 5
Async Link: 0
State Protection: 0
Self preservation threshold: 50
Self preservation period: 90
Suspend threshold: 200
Suspend period: 30
Stream4_reassemble config:
Server reassembly: INACTIVE
Client reassembly: ACTIVE
Reassembler alerts: ACTIVE
Zero out flushed packets: INACTIVE
flush_data_diff_size: 500
Ports: 21 23 25 53 80 110 111 143 513 1433
Emergency Ports: 21 23 25 53 80 110 111 143 513 1433
HttpInspect Config:
GLOBAL CONFIG
Max Pipeline Requests: 0
Inspection Type: STATELESS
Detect Proxy Usage: NO
IIS Unicode Map Filename: /etc/snort/unicode.map
IIS Unicode Map Codepage: 1252
DEFAULT SERVER CONFIG:
Ports: 80 8080 8180
Flow Depth: 300
Max Chunk Length: 500000
Inspect Pipeline Requests: YES
URI Discovery Strict Mode: NO
Allow Proxy Usage: NO
Disable Alerting: NO
Oversize Dir Length: 500
Only inspect URI: NO
Ascii: YES alert: NO
Double Decoding: YES alert: YES
%U Encoding: YES alert: YES
Bare Byte: YES alert: YES
Base36: OFF
UTF 8: OFF
IIS Unicode: YES alert: YES
Multiple Slash: YES alert: NO
IIS Backslash: YES alert: NO
Directory Traversal: YES alert: NO
Web Root Traversal: YES alert: YES
Apache WhiteSpace: YES alert: YES
IIS Delimiter: YES alert: YES
IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
Non-RFC Compliant Characters: NONE
rpc_decode arguments:
Ports to decode RPC on: 111 32771
alert_fragments: INACTIVE
alert_large_fragments: ACTIVE
alert_incomplete: ACTIVE
alert_multiple_requests: ACTIVE
telnet_decode arguments:
Ports to decode telnet on: 21 23 25 119
database: compiled support for ( mysql )
database: configured to use mysql
database: user = root
database: password is set
database: database name = snort
database: host = localhost
Node unique name is: 80.134.161.187
database: sensor name = 80.134.161.187
database: sensor id = 6
database: schema version = 106
database: using the "alert" facility
2180 Snort rules read...
2180 Option Chains linked into 176 Chain Headers
0 Dynamic rules
++++++++++++++++++++++++++++++++++++++++++++++++++ +

Warning: flowbits key 'realplayer.playlist' is checked but not ever set.

+-----------------------[thresholding-config]-------------------------------
---
| memory-cap : 1048576 bytes
+-----------------------[thresholding-global]-------------------------------
---
| none
+-----------------------[thresholding-local]--------------------------------
---
| gen-id=1 sig-id=2275 type=Threshold tracking=dst count=5 seconds=60
| gen-id=1 sig-id=2924 type=Threshold tracking=src count=10 seconds=60
| gen-id=1 sig-id=2923 type=Threshold tracking=src count=10 seconds=60
| gen-id=1 sig-id=2523 type=Both tracking=dst count=10 seconds=10
| gen-id=1 sig-id=2496 type=Both tracking=dst count=20 seconds=60
| gen-id=1 sig-id=2494 type=Both tracking=dst count=20 seconds=60
| gen-id=1 sig-id=2495 type=Both tracking=dst count=20 seconds=60
+-----------------------[suppression]---------------------------------------
---
----------------------------------------------------------------------------
---
Rule application order: ->activation->dynamic->alert->pass->log

--== Initialization Complete ==--

-*> Snort! <*-
Version 2.2.0 (Build 30)
By Martin Roesch (roesch@sourcefire.com, www.snort.org)

However after a while when I control-c :

^C

================================================== ==========================
===

Snort received 8244 packets
Analyzed: 8244(100.000%)
Dropped: 0(0.000%)
================================================== ==========================
===
Breakdown by protocol:
TCP: 0 (0.000%)
UDP: 0 (0.000%)
ICMP: 0 (0.000%)
ARP: 0 (0.000%)
EAPOL: 0 (0.000%)
IPv6: 0 (0.000%)
IPX: 0 (0.000%)
OTHER: 0 (0.000%)
DISCARD: 0 (0.000%)
================================================== ==========================
===
Action Stats:
ALERTS: 0
LOGGED: 0
PASSED: 0
================================================== ==========================
===
Final Flow Statistics
,----[ FLOWCACHE STATS ]----------
Memcap: 10485760 Overhead Bytes 16400 used(%0.156403)/blocks (16400/1)
Overhead blocks: 1 Could Hold: (0)
IPV4 count: 0 frees: 0 low_time: 0, high_time: 0, diff: 0h:00:00s
finds: 0 reversed: 0(%0.000000)
find_sucess: 0 find_fail: 0 percent_success: (%0.000000) new_flows: 0
database: Closing connection to database "p"
Snort exiting

Nothing gets reported. I have configured snort.conf like this:

var HOME_NET any
and
var EXTERNAL_NET any
and
output database: alert, mysql, user=root password=<mypassword> dbname=snort
host=localhost

Can anyone help?

Thanks,
Allan

------=_NextPart_000_01A8_01C4E0D6.774CEDD0
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2900.2523" name=3DGENERATOR></HEAD>
<BODY>
<DIV dir=3Dltr align=3Dleft>first, be patient.  reposting 10 hours =
later will not=20
get you an answer faster.  Sunday evening ya =
know.</DIV>
<DIV dir=3Dltr align=3Dleft> </DIV>
<DIV dir=3Dltr align=3Dleft>second.  what are you plugged into?  =
also what I=20
see first I is the following. </DIV>
<DIV> </DIV>
<DIV>Snort received 8244 packets Analyzed: =
8244(100.000%) Dropped:=20
0(0.000%) =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= 3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D Breakdown=20
by protocol: TCP: 0 (0.000%) UDP: 0 (0.000%) ICMP: 0 =
(0.000%) ARP: 0=20
(0.000%) EAPOL: 0 (0.000%) IPv6: 0 (0.000%) IPX: 0 =
(0.000%) OTHER: 0=20
(0.000%) DISCARD: 0 (0.000%) </DIV>
<DIV>also,=20
what is happening on this interface?</DIV>
<DIV> </DIV>
<DIV>
Initializing Network Interface ppp0
--=3D=3D Initializing Snort =3D=3D--
Initializing Output Plugins!
Decoding PPP on interface ppp0</DIV> 
Patrick S. Harper | CISSP RHCT=20
MCSE www.internetsecurityguru.com www.ntsug.org - Snort Users=20
Group "If there is no light at the end of the tunnel, get down =
there and=20
light the damn thing yourself!" 
<DIV> </DIV> 
<DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr align=3Dleft>
<HR tabIndex=3D-1>
From: =
snort-users-admin@lists.sourceforge.net=20
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of =
Allan=20
Jensen Sent: Monday, December 13, 2004 3:49 AM To:=20
snort-users@lists.sourceforge.net Subject: [Snort-users] snort =
not=20
reporting </DIV>
<DIV></DIV>I installed snort 2.2.0 on Mac OS X 10.3.6 together with ACID =

0.9.6b23. Everything went fine. When I start snort: sudo snort =
-dvi -c=20
/etc/snort/snort.conf I get the following: Running in =
IDS=20
mode Log directory =3D /var/log/snort Initializing Network =
Interface=20
ppp0 --=3D=3D Initializing Snort =3D=3D-- Initializing Output=20
Plugins! Decoding PPP on interface ppp0 Initializing=20
Preprocessors! Initializing Plug-ins! Parsing Rules file=20
/etc/snort/snort.conf ++++++++++++++++++++++++++++++++ ++++++++++++=
+++++++ Initializing=20
rule chains... ,-----------[Flow Config]---------------------- | =
Stats=20
Interval: 0 | Hash Method: 2 | Memcap: 10485760 | Rows : =
4099 |=20
Overhead Bytes:=20
16400(%0.16) `---------------------------------------------- No =
arguments=20
to frag2 directive, setting defaults to: Fragment timeout: 60=20
seconds Fragment memory cap: 4194304 bytes Fragment min_ttl: =
0 Fragment=20
ttl_limit: 5 Fragment Problems: 0 Self preservation threshold: =
500 Self=20
preservation period: 90 Suspend threshold: 1000 Suspend period:=20
30 Stream4 config: Stateful inspection: ACTIVE Session =
statistics:=20
INACTIVE Session timeout: 30 seconds Session memory cap: 8388608=20
bytes State alerts: INACTIVE Evasion alerts: INACTIVE Scan =
alerts:=20
INACTIVE Log Flushed Streams: INACTIVE MinTTL: 1 TTL Limit: =
5 Async=20
Link: 0 State Protection: 0 Self preservation threshold: =
50 Self=20
preservation period: 90 Suspend threshold: 200 Suspend period:=20
30 Stream4_reassemble config: Server reassembly: =
INACTIVE Client=20
reassembly: ACTIVE Reassembler alerts: ACTIVE Zero out flushed =
packets:=20
INACTIVE flush_data_diff_size: 500 Ports: 21 23 25 53 80 110 111 =
143 513=20
1433 Emergency Ports: 21 23 25 53 80 110 111 143 513 =
1433 HttpInspect=20
Config: GLOBAL CONFIG Max Pipeline Requests: 0 Inspection Type: =

STATELESS Detect Proxy Usage: NO IIS Unicode Map Filename:=20
/etc/snort/unicode.map IIS Unicode Map Codepage: 1252 DEFAULT =
SERVER=20
CONFIG: Ports: 80 8080 8180 Flow Depth: 300 Max Chunk Length:=20
500000 Inspect Pipeline Requests: YES URI Discovery Strict Mode:=20
NO Allow Proxy Usage: NO Disable Alerting: NO Oversize Dir =
Length:=20
500 Only inspect URI: NO Ascii: YES alert: NO Double Decoding: =
YES=20
alert: YES %U Encoding: YES alert: YES Bare Byte: YES alert:=20
YES Base36: OFF UTF 8: OFF IIS Unicode: YES alert: =
YES Multiple=20
Slash: YES alert: NO IIS Backslash: YES alert: NO Directory =
Traversal: YES=20
alert: NO Web Root Traversal: YES alert: YES Apache WhiteSpace: =
YES alert:=20
YES IIS Delimiter: YES alert: YES IIS Unicode Map: GLOBAL IIS =
UNICODE MAP=20
CONFIG Non-RFC Compliant Characters: NONE rpc_decode =
arguments: Ports=20
to decode RPC on: 111 32771 alert_fragments:=20
INACTIVE alert_large_fragments: ACTIVE alert_incomplete:=20
ACTIVE alert_multiple_requests: ACTIVE telnet_decode =
arguments: Ports=20
to decode telnet on: 21 23 25 119 database: compiled support for ( =
mysql=20
) database: configured to use mysql database: user =3D =
root database:=20
password is set database: database name =3D snort database: host =
=3D=20
localhost Node unique name is: 80.134.161.187 database: sensor =
name =3D=20
80.134.161.187 database: sensor id =3D 6 database: schema version =
=3D=20
106 database: using the "alert" facility 2180 Snort rules =
read... 2180=20
Option Chains linked into 176 Chain Headers 0 Dynamic=20
rules +++++++++++++++++++++++++++++++++++++++++ ++++++++++ Warni=
ng:=20
flowbits key 'realplayer.playlist' is checked but not ever=20
set. +-----------------------[thresholding-config]----------------=
------------------ |=20
memory-cap : 1048576=20
bytes +-----------------------[thresholding-global]-------------------=
--------------- |=20
none +-----------------------[thresholding-local]---------------------=
-------------- |=20
gen-id=3D1 sig-id=3D2275 type=3DThreshold tracking=3Ddst count=3D5 =
seconds=3D60 |=20
gen-id=3D1 sig-id=3D2924 type=3DThreshold tracking=3Dsrc count=3D10 =
seconds=3D60 |=20
gen-id=3D1 sig-id=3D2923 type=3DThreshold tracking=3Dsrc count=3D10 =
seconds=3D60 |=20
gen-id=3D1 sig-id=3D2523 type=3DBoth tracking=3Ddst count=3D10 =
seconds=3D10 | gen-id=3D1=20
sig-id=3D2496 type=3DBoth tracking=3Ddst count=3D20 seconds=3D60 | =
gen-id=3D1 sig-id=3D2494=20
type=3DBoth tracking=3Ddst count=3D20 seconds=3D60 | gen-id=3D1 =
sig-id=3D2495 type=3DBoth=20
tracking=3Ddst count=3D20=20
seconds=3D60 +-----------------------[suppression]--------------------=
---------------------- -----------------------------------------------=
-------------------------------- Rule=20
application order:=20
->activation->dynamic->alert->pass->log --=3D=3D=20
Initialization Complete =3D=3D-- -*> Snort! <*- Version =
2.2.0 (Build=20
30) By Martin Roesch (roesch@sourcefire.com,=20
www.snort.org) However after a while when I control-c=20
: ^C =3D=3D=3D=3D=3D=3D=3D=3D=3D= 3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Snort= 20
received 8244 packets Analyzed: 8244(100.000%) Dropped:=20
0(0.000%) =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= 3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D Breakdown=20
by protocol: TCP: 0 (0.000%) UDP: 0 (0.000%) ICMP: 0 =
(0.000%) ARP: 0=20
(0.000%) EAPOL: 0 (0.000%) IPv6: 0 (0.000%) IPX: 0 =
(0.000%) OTHER: 0=20
(0.000%) DISCARD: 0=20
(0.000%) =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D Action=20
Stats: ALERTS: 0 LOGGED: 0 PASSED:=20
0 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D Final=20
Flow Statistics ,----[ FLOWCACHE STATS ]---------- Memcap: =
10485760=20
Overhead Bytes 16400 used(%0.156403)/blocks (16400/1) Overhead blocks: 1 =
Could=20
Hold: (0) IPV4 count: 0 frees: 0 low_time: 0, high_time: 0, diff:=20
0h:00:00s finds: 0 reversed: 0(%0.000000) find_sucess: 0 =
find_fail: 0=20
percent_success: (%0.000000) new_flows: 0 database: Closing =
connection to=20
database "p" Snort exiting Nothing gets reported. I have=20
configured snort.conf like this: var HOME_NET =
any and var=20
EXTERNAL_NET any and output database: alert, mysql, user=3Droot=20
password=3D<mypassword> dbname=3Dsnort =
host=3Dlocalhost Can anyone=20
help? Thanks, Allan</BODY></HTML>

------=_NextPart_000_01A8_01C4E0D6.774CEDD0--

-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode