Cheers

I’m looking through the snort.conf now and things seem to be a bit different. Once again thanks for your time and patience..

Reason for moderation is that akismet spam filter is down sometimes and then I got loads of spam idiots with replicas of watches, viagra, you name it which I block manually, but all comments from real people are approved directly, good and bad ones.

Glad that you find blog helpful.

Regards
Amar

Regarding your comments about moderation it’s not moderation that’s issue, it’s spam.

output alert_syslog: host=10.1.1.254:514, LOG_AUTH LOG_ALERT
output alert_fast : alerts.ids

I am using AlertMail and interneting thing is Test Messge works but it doesnt send realtime so something needs to be activated.
Below is the service paramerters I am running:

Snort is currently configured to run as a Windows service using the following
command-line parameters:

-c C:\Snort\etc\snort.conf -l C:\Snort\log -s -k all -i3

Please advice if I am missing anything.
Many thanks

Try to start command prompt as administrator, then you will have more privileges.

You can try to start snort from command prompt just to see if it is capturing anything with command snort -v. In case of error with winpcap you will see directly which error you have. Also you can try running snort -W if you have more than one network interface and then if that is the case run snort with snort -v -i number_of_interface_that_you_got_with_command_before.

There are also command switches to start snort from command prompt and to display everything on console so you can check if it is working in real time.

For example you will have different kind of entries but with priority 1, 2 or 3, where that mean high, moderate or informational priority.

When you detect something with high priority then you can with that software do actions based on alert, I’m using Manage Engine Log Analyzer (which is free up to 5 servers) to manage actions based on log entries.

P.S. After installation you will need to download the latest ruleset for Snort and to apply them as well.

-k Checksum mode (all,noip,notcp,noudp,noicmp,none)
-K Logging mode (pcap[default],ascii,none)

I’m glad that I could help.

I have wrote about that in blog post.

Regarding the second problem, .conf file is a text file, you can edit it notepad, wordpad or any other text editor, I prefer notepad++ which is free and works really good.

Regardin logs, if you are using -l path then check if snort can write to log directory.

Instruction says that config detection: search-method ac-bnfa max_queue_events 5 should be written on one line, not on two, and if you are writing them on 2 then you need “\” on the end of the first line.

The instructions say to use this:
config detection: search-method ac-bnfa
max_queue_events 5

But this is missing a “\” after “ac-bnfa” to ensure this is interpreted as one long command without an end-of-line. Alternatively, you can simply write it as
config detection: search-method ac-bnfa max_queue_events 5

As for problems incurred by an extra trailing “\”, make sure there is nothing on the line that follows, so that the command interpreter will pick up the end-of-line. “\” is just for readability. If your code is all mashed up so that one command follows another without a blank line, and you are using trailing “\”, then the interpreter won’t know where parameters end and the next command begins. For example, the code segment:

preprocessor ftp_telnet_protocol: \
preprocessor ftp_telnet_protocol: \

will try to be read as
preprocessor ftp_telnet_protocol: preprocessor ftp_telnet_protocol:

which is nonsense.

Make sure you have newlines where newlines are needed, and “\” where the command is NOT supposed to end.

BUT still I have trouble with snort. I try apacheDoS and guess what, Snort doesn’t write any log into alert.ids. But when I using nmap, Snort writes log. What wrong with that? Can you suggest me some more tools to test Snort?

Thank you so much.

Regarding stream5 preprocessor, I don’t know why is it complaining because stream5 should be in dynamic engine, there is no separate preprocessor .dll file for it.

Test with my config file and see what happens.

I don’t use IDSCenter, but I will give it a go to see what kind of problems are you having.

Exactly, I have problems with the preprocessor bo.

preprocessor bo

preprocessor frag3_global: max_frags 65536
preprocessor frag3_engine: policy windows timeout 180
preprocessor stream5_global: max_tcp 8192, track_tcp yes, track_udp yes
preprocessor stream5_tcp: policy windows, use_static_footprint_sizes,
preprocessor stream5_udp: ignore_any_rules
preprocessor http_inspect: global iis_unicode_map unicode.map 1252
preprocessor http_inspect_server: default_server
preprocessor ftp_telnet: \
preprocessor ftp_telnet_protocol: \
preprocessor ftp_telnet_protocol: \
preprocessor ftp_telnet_protocol: \
preprocessor SMTP: \
preprocessor ssh: server_ports { 22 } \
preprocessor ssl: ports { 443 465 563 636 989 992 993 994 995 7801 7702 7900 7901
7902 7903 7904 7905 7906 6907 7908 7909 7910 7911 7912 7913 7914 7915 7916 7917
7918 7919 7920 }, trustservers, noinspect_encrypted
preprocessor dcerpc2: memcap 102400, events [co ]
preprocessor dcerpc2_server: default, policy WinXP, \
preprocessor dns: ports { 53 } enable_rdata_overflow

This mess, from stream5 to the end of this. I always have trouble like “unknown preprocessor stream5″ or “must configure http inspect global configuration first” and so far, ftp_telnet, bla bla bla….

Thanks!!!!

ERROR: c:\snort\etc\snort.conf(273) Unknown rule type: max_queue_events.

I wonder what this problem is.

Tnx for the tip anyway.