Hi,
ich habe snort 1.6 und starte mit
Snort -v -i eth0 -c /etc/snort.conf -l /var/log/snort
allerdings klappt das loggen nicht!
ich habe schon "preprozessor ignorehosts HOME_NET" auskommentiert, aber snort
legt nur eine leere Datei portscan.log an.
Loggen nach syslog klappt auch nicht.(-s)
Von der Uni weiss ich allerdings, dass
snort in /var/log/snort ein file
Alert anlegen kann indem die Attacken aufgezeichnet werden.
Was läuft hier falsch?
---------
# $Id: snort-lib,v 1.18 2000/03/17 06:28:01 roesch Exp $
# syslog alert plugin
# format=> plugin_name: syslog_facilities (multiple entries ok)
output alert_syslog: LOG_AUTH LOG_ALERT
# tcpdump format binary logging plugin
# format => plugin_name: output_file_name
#output log_tcpdump: snort.log
# http_decode takes the port numbers that it's going to analyze as arguments
# traffic on these ports will be sent through the http_decode routine for
# normalization
preprocessor http_decode: 80 8080
# minfrag takes the minimum fragment size (in bytes) threshold as its argument
# fragmented packets at of below this size will cause an alert to be generated
preprocessor minfrag: 128
# set the HOME_NET variable for your own network
#var HOME_NET 192.168.80.0/255.255.255.0
var HOME_NET 192.168.10.0/24
# portscan plugin by Patrick Mullen <p_mullen@linuxrc.net>
# This detects UDP packets or TCP SYN packets
# going to seven different ports in less than two seconds.
# "Stealth" TCP packets are always detected, regardless
# of these settings.
preprocessor portscan: $HOME_NET 1 1 /var/log/snort/portscan.log
# ignorehosts is set to ignore TCP SYN and UDP "scans" from
# your home net by default to reduce false alerts. However,
# for maximum benefit it should be tweaked to only include /etc/snort/a
# whitespace-delimited list of only your noisiest servers/hosts.
#preprocessor portscan-ignorehosts: $HOME_NET
include /etc/snort/web-lib
include /etc/snort/overflow-lib
include /etc/snort/misc-lib
include /etc/snort/scan-lib
include /etc/snort/backdoor-lib
##################################
# alert on interesting packets
##################################
# new rules for detection source port traffic
alert tcp any any <-> $HOME_NET any (flags: A; ack: 0; msg:"NMAP TCP Ping!" ;)
alert icmp !$HOME_NET any -> $HOME_NET any (ipopts: lsrr; msg: "Source routed packet" ;)
alert icmp !$HOME_NET any -> $HOME_NET any (ipopts: ssrr; msg: "Source routed packet" ;)
alert tcp !$HOME_NET any -> $HOME_NET any (ipopts: lsrr; msg: "Source routed packet" ;)
alert tcp !$HOME_NET any -> $HOME_NET any (ipopts: ssrr; msg: "Source routed packet" ;)
alert udp !$HOME_NET any -> $HOME_NET any (ipopts: lsrr; msg: "Source routed packet" ;)
alert udp !$HOME_NET any -> $HOME_NET any (ipopts: ssrr; msg: "Source routed packet" ;)
alert tcp any any -> $HOME_NET 6667 (flags: PA; content: "USER "; nocase; offset:0; depth:5; content: " "; offset:11; depth:1; content: " "; offset: 18; depth:1; content: " :"; offset: 26; depth: 2; msg: "PrettyPark activity!" ;)