Re: [Snort-users] Quick questions about recieved packets

------=_Part_3634_2887283.1130333881517
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Hi Joesph,
Perhaps consider using a different libpcap if you are using Linux? -->
http://public.lanl.gov/cpw/

Cheers,

_Raju

On 10/26/05, Joseph Nicholson <wjnicholson@gmail.com> wrote:
>
> I was afraid of that.
> I have snort plugged into a Cisco 3560G Switch on a mirrored port. I am
> mirroring 10 other ports on the switch currently. This is my core switch =
and
> brings about 5 different network segments together. I am using the Offici=
al
> Snort Rules and the Bleeding Snort Rules. Snort is setup to kick out the
> Alerts via Syslog. The local Syslog function in Linux is setup to send th=
e
> Alerts to a Syslog appliance that parses all of my logs for me.
> For testing I setup Snort to output Alerts via unified logging and that
> didn't help any. I currently have both Tx and Rx being mirrored to my
> monitoring port. I tried just Tx and just Rx and got the same result. The
> monitor port is a Gigabit port and the monitoring ethernet port is runnin=
g
> at a Gigabit also. On the linux appliance that port is running in
> promiscuous mode and has no IP. I have a management interface on the box
> also that I use to send the syslog files across and that I log into to
> manage the box.
> Any thoughts or suggestions would be appreciated. This is the first
> production Sensor I have setup. All my testing sensors apparently didn't
> have enough traffic being pushed at them.
>
> On 10/26/05, Richard Bejtlich <taosecurity@gmail.com> wrote:
> >
> > Joseph Nicholson wrote:
> >
> > >I see that snort dropped 179457 packets because it couldn't process
> > them.
> > > Snort received 186246 packets
> > > Analyzed: 6789(3.645%)
> > > Dropped: 179457(96.355%)
> > > My gut instinct is telling me that it dropped 179457 packets because
> > it
> > > felt there was no threat from them and that the 6789 it analyzed
> > looked
> > > suspicious.
> >
> > Hi Joseph,
> >
> > You have a serious problem with your Snort deployment. The packets
> > Snort dropped were never inspected, period.
> >
> > Can you describe your configuration? Are you sending Snort alerts
> > directly to a database, without Barnyard? Are you running any odd
> > rules?
> >
> > Sincerely,
> >
> > Richard
> > http://www.taosecurity.com
> >
>
>
>
> --
> Joseph Nicholson




--
May the packets be with you.

------=_Part_3634_2887283.1130333881517
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Hi Joesph,<br>
&nbsp; Perhaps consider using a different libpcap if you are using Linux? -=
-&gt;<a href=3D"http://public.lanl.gov/cpw/">http://public.lanl.gov/cpw/</a=
><br>
<br>Cheers,<br>
<br>
_Raju<br>
<br><div><span class=3D"gmail_quote">On 10/26/05, <b class=3D"gmail_sendern=
ame">Joseph Nicholson</b> &lt;<a href=3D"mailto:wjnicholson@gmail.com">wjni=
cholson@gmail.com</a>&gt; wrote:</span><blockquote class=3D"gmail_quote" st=
yle=3D"border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex=
; padding-left: 1ex;">
<div>I was afraid of that.</div>
<div>&nbsp;</div>
<div>I have snort plugged into a Cisco 3560G Switch on a mirrored
port.&nbsp; I am mirroring 10 other ports on the switch
currently.&nbsp; This is my core switch and brings about 5 different
network segments together.&nbsp; I am using the Official Snort Rules
and the Bleeding Snort Rules.&nbsp; Snort is setup to kick out the
Alerts via Syslog.&nbsp; The local Syslog function in Linux is setup to
send the Alerts to a Syslog appliance that parses all of my logs for
me.
</div>
<div>&nbsp;</div>
<div>For testing I setup Snort to output Alerts via unified logging and
that didn't help any.&nbsp; I currently have both Tx and Rx being
mirrored to my monitoring port.&nbsp; I tried just Tx and just Rx and
got the same result.&nbsp; The monitor port is a Gigabit port and the
monitoring ethernet port is running at a Gigabit also.&nbsp; On the
linux appliance that port is running in promiscuous mode and has no
IP.&nbsp; I have a management interface on the box also that I use to
send the syslog files across and that I log into to manage the box.
</div>
<div>&nbsp;</div>
<div>Any thoughts or suggestions would be appreciated.&nbsp; This is
the first production Sensor I have setup.&nbsp; All my testing sensors
apparently didn't have enough traffic being pushed at them.<br><br>&nbsp;</=
div><div><span class=3D"e" id=3D"q_1072d1df2b8ae75a_1">
<div><span class=3D"gmail_quote">On 10/26/05, <b class=3D"gmail_sendername"=
>Richard Bejtlich</b> &lt;<a href=3D"mailto:taosecurity@gmail.com" target=
=3D"_blank" onclick=3D"return top.js.OpenExtLink(window,event,this)">taosec=
urity@gmail.com
</a>&gt; wrote:</span>
<blockquote class=3D"gmail_quote" style=3D"border-left: 1px solid rgb(204, =
204, 204); margin: 0px 0px 0px 0.8ex; padding-left: 1ex;">Joseph Nicholson =
wrote:<br><br>&gt;I see that snort dropped 179457 packets because it couldn=
't process them.
<br>&gt; Snort received 186246 packets<br>&gt; Analyzed: 6789(3.645%)<br>&g=
t; Dropped: 179457(96.355%)<br>&gt; My gut instinct is telling me that it d=
ropped 179457 packets because it<br>&gt; felt there was no threat from them=
and that the 6789 it analyzed looked
<br>&gt; suspicious.<br><br>Hi Joseph,<br><br>You have a serious problem wi=
th your Snort deployment.&nbsp;&nbsp;The packets<br>Snort dropped were neve=
r inspected, period.<br><br>Can you describe your configuration?&nbsp;&nbsp=
;Are you sending Snort alerts
<br>directly to a database, without Barnyard?&nbsp;&nbsp;Are you running an=
y odd<br>rules?<br><br>Sincerely,<br><br>Richard<br> <a href=3D"http://www.t=
aosecurity.com" target=3D"_blank" onclick=3D"return top.js.OpenExtLink(wind=
ow,event,this)">
http://www.taosecurity.com</a><br></blockquote></div><br><br clear=3D"all">
<br>-- <br></span></div><span class=3D"sg">Joseph Nicholson=20

</span></blockquote></div><br><br clear=3D"all"><br>-- <br>May the packets =
be with you.

------=_Part_3634_2887283.1130333881517--


-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.
Get Certified Today * Register for a JBoss Training Course
Free Certification Exam for All Training Attendees Through End of 2005
Visit http://www.jboss.com/services/certification for more information
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users