LinuxQuestions.org - SNORT-2.9.4 Installed properly but NOT Logging ALERTS

- Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)

- - SNORT-2.9.4 Installed properly but NOT Logging ALERTS (https://www.linuxquestions.org/questions/linux-security-4/snort-2-9-4-installed-properly-but-not-logging-alerts-4175451048/)

SNORT-2.9.4 Installed properly but NOT Logging ALERTS

USING snort 2.9.4, daq 2.0.0, snortrules-snapshot-2940

I have installed snort and after installation when i run following:

Code:

sudo snort -c /usr/local/snort/etc/snort.conf –dump-dynamic-rules=/usr/local/snort/so_rules

I Get:

Code:

Finished dumping dynamic rules.

Snort exiting

When i run this for testing installation:

Code:

sudo snort -c /usr/local/snort/etc/snort.conf -T -l /var/log/snort

I Get:

Code:

Snort successfully validated the configuration!

Snort exiting

When i Run following to find if it is capturing packets:

Code:

/usr/local/snort/bin/snort -i eth0

I can see traffic but when i use ' curl http://testmyids.com ' for testing SNORT installation it does not gives any alert in unified2 file which is being logged in /var/log/snort

snort config file has this line for logging into unified file :

Code:

output unified2: filename unified.snort.alert, limit 128

And for starting snort i am using following command line command:

Code:

sudo snort -c /usr/local/snort/etc/snort.conf -l /var/log/snort -i eth0

Every thing seems to be right but why is it not logging alerts as unified2 file is always 0 bytes?

Well done, concise but nearly complete post. Only one thing is missing: which rule exactly should your action trip? After all http://testmyids.com is just a plain (URI) string and nothing else. Most of the times you'll be looking for specific packet payloads and often in the direction of the Snort sensor. Please post the rule and if you created the rule yourself please explain what you derived its filter from if necessary.

No extra rule i have made. infact in fact while googling i found that in order to test your installed SNORT use curl http://testmyids.com it will generate bad traffic for your PC or IP and SNORT will generate alert. it use to work fine when i last installed SNORT-2.9.3 with snort-rules-snapshot-2931, but now when i have installed SNORT-2.9.4 with snort-rules-snapshot-2940 it is not generating any alerts for traffic from http://testmyids.com.

Quote:

Originally Posted by arunpushkar (Post 4896618)

it use to work fine when i last installed SNORT-2.9.3 with snort-rules-snapshot-2931, but now when i have installed SNORT-2.9.4 with snort-rules-snapshot-2940 it is not generating any alerts for traffic from http://testmyids.com.

Well then the first thing would be to diff the two rule sets, see what changed between snapshots?

How to find what all changes have been made at what all places since there are many rule files under ../rules. and where can i find that specific rule in which i am intrested in.

'diff -urN /one/dir /other/dir'?