Please run snort from the commandline with the config and arguments you usually supply, and add the "-T" flag, and dump the results to a file called /tmp/snort-test.log. Example: "/path/to/snort -c /etc/snort.conf -i eth0 -flags -flags -etc -etc -T 2>&1|tee /tmp/snort-test.log". If snort failed the test and you can't make it work, post the contents of /tmp/snort-test.log and post your snort.conf.
If you post your snort.conf, put in fake IP's where necessary, and tell us which services you provide/run. I'm sure we can help you make it work.
|