Home / server / Questions

Questions[snort](server)

Martin Hope
CyberLabyrinthX
Asked: 2024-02-18 19:12:16 +0800 CST
  • 5

I have checked the /etc/snort/ and /usr/local/etc/snort/ directories but could not find the snort.conf file. I also attempted to use the

sudo find / -name snort.conf
sudo find / -type f -name snort.conf

and

locate snort.conf

commands to search for the file throughout the filesystem but did not find it.

Should I create a new snort.conf file, or should I continue searching for an existing configuration file?

snort
Martin Hope
hdr
Asked: 2014-05-14 04:29:34 +0800 CST
  • 5

So I was following this guide on how to install Snort, Barnyard 2 and the like.

I've set up Snort so it would run automatically, by editing the rc.local file:

ifconfig eth1 up

/usr/local/snort/bin/snort -D -u snort -g snort \
-c /usr/local/snort/etc/snort.conf -i eth1
/usr/local/bin/barnyard2 -c /usr/local/snort/etc/barnyard2.conf \
-d /var/log/snort \
-f snort.u2 \
-w /var/log/snort/barnyard2.waldo \
-D

And I then restarted the computer. Snort was able to run and detect the attack, but the log files (including barnyard2.waldo) remained blank, even if a new log entry was created for each attack.

I'm not sure what went wrong here, since it's supposed to log any attacks and store it in the log directory, right?

Then, I tried changing the parameter to:

    /usr/local/snort/bin/snort -D -b -u snort -g snort \
-c /usr/local/snort/etc/snort.conf -i eth1

And when I checked the log file, there are two log files, one in u2 and another in tcpdump format, but they're both blank and is approximately 0 bytes.

So I thought I'd run it from the console to see if it would work from there, using this command:

/usr/local/snort/bin/snort -A full -u snort -g snort \

-c /usr/local/snort/etc/snort.conf -i eth1

and I then checked the log file to see if it would log the attack, and it still doesn't.

snort
Martin Hope
Scott Pack
Asked: 2011-02-26 06:31:16 +0800 CST
  • 11

Using snort version 2.8.6, I am attempting to collect application performance stats such as

  • Number of packets not processed due to application overload
  • Percentage of time in processing layers (preprocessor, reassembly, pattern matching, etc)
  • Number of packets processed
  • etc

I am currently using perfmonitor preprocessor to dump performance stats, and graphing some of these values through SNMP calls. The documentation on this preprocessor is fairly limited and doesn't do a good job of explaining what the fields actually mean, or what time frame the figures are calculated over.

To get those kinds of performance metrics, what fields should I be looking at and how are those fields measured?

monitoring snort
Martin Hope
Ben Voigt
Asked: 2011-01-23 12:07:39 +0800 CST
  • 7

I'm trying to identify trouble users on our network. ntop identifies high traffic and high connection users, but malware doesn't always need high bandwidth to really mess things up. So I am trying to do offline analysis with snort (don't want to burden the router with inline analysis of 20 Mbps traffic). Apparently snort provides a -r option for this purpose, but I can't get the analysis to run.

The analysis system is gentoo, amd64, in case that makes any difference. I've already used oinkmaster to download the latest IDS signatures. But when I try to run snort, I keep getting the following error:

% snort -V

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.9.0.3 IPv6 GRE (Build 98) x86_64-linux
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
           Copyright (C) 1998-2010 Sourcefire, Inc., et al.
           Using libpcap version 1.1.1
           Using PCRE version: 8.11 2010-12-10
           Using ZLIB version: 1.2.5

%> snort -v -r jan21-for-snort.cap -c /etc/snort/snort.conf -l ~/snortlog/

(snip)

273 out of 1024 flowbits in use.

[ Port Based Pattern Matching Memory ]
+- [ Aho-Corasick Summary ] -------------------------------------
| Storage Format    : Full-Q
| Finite Automaton  : DFA
| Alphabet Size     : 256 Chars
| Sizeof State      : Variable (1,2,4 bytes)
| Instances         : 314
|     1 byte states : 304
|     2 byte states : 10
|     4 byte states : 0
| Characters        : 69371
| States            : 58631
| Transitions       : 3471623
| State Density     : 23.1%
| Patterns          : 3020
| Match States      : 2934
| Memory (MB)       : 29.66
|   Patterns        : 0.36
|   Match Lists     : 0.77
|   DFA
|     1 byte states : 1.37
|     2 byte states : 26.59
|     4 byte states : 0.00
+----------------------------------------------------------------
[ Number of patterns truncated to 20 bytes: 563 ]
ERROR: Can't find pcap DAQ!
Fatal Error, Quitting..

net-libs/daq is installed, but I don't even want to capture traffic, I just want to process the capture file.

What configuration options should I be setting/unsetting in order to do offline analysis instead of real-time capture?

pcap snort
Martin Hope
NoodleX
Asked: 2010-09-07 02:56:40 +0800 CST
  • 6

Can someone provide me rules to detect following attack : 

hping3 -S -p 80 --flood --rand-source [target]

I'm having problem with rules since packet comes from random source.

My current rules is : 

alert tcp !$HOME_NET any -> $HOME_NET 80 (flags: S; msg:"Possible TCP DoS"; flow: stateless; threshold: type both, track by_src, count 70, seconds 10; sid:10001;rev:1;)

this rules only can detect from one source ip only.

ddos snort