Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I install snort 2.9.2.3 from the Ubuntu repositories along with Oinkmaster. I'm not running LAMP just snort for logging pcap and to the alert log file.

Out of the box installation snort worked. Running nmap scan against the server was logged in /var/log/snort/alert. I dont know how old the rules are that came with it so I updated with Oinkmaster.

After I updated to the latest VRT rules snort would no longer start. So I did a sdiff on the snort.conf that came with the latest rules against my existing file finding a few differences and ended up making a few tweaks to directory locations in the new snort.conf and using that.

Now snort will start but running nmap scans against the server are no longer picked up. I looked in syslog and found these errors which looked relevant.

Sep 18 18:07:43 svr08 snort[3492]: Rule application order: 

activation->dynamic->pass->drop->sdrop->reject->alert->log

Sep 18 18:07:43 svr08 snort[3492]: Verifying Preprocessor Configurations!

Sep 18 18:07:43 svr08 snort[3492]: WARNING: 'ignore_any_rules' option for Stream5 UDP disabled because of UDP rule with flow or flowbits option.

Sep 18 18:07:43 svr08 snort[3492]: ICMP tracking disabled, no ICMP sessions allocated

Sep 18 18:07:43 svr08 snort[3492]: IP tracking disabled, no IP sessions allocated

Sep 18 18:07:43 svr08 snort[3492]: WARNING: flowbits key 'file.msproducer' is set but not ever checked.

Sep 18 18:07:43 svr08 snort[3492]: WARNING: flowbits key 'file.mov' is set but not ever checked.

Sep 18 18:07:43 svr08 snort[3492]: WARNING: flowbits key 'file.mp4' is set but not ever checked.

Sep 18 18:07:43 svr08 snort[3492]: WARNING: flowbits key 'file.cyb' is set but not ever checked.

Sep 18 18:07:43 svr08 snort[3492]: WARNING: flowbits key 'file.aom' is set but not ever checked.

Sep 18 18:07:43 svr08 snort[3492]: WARNING: flowbits key 'file.rat' is set but not ever checked.

Sep 18 18:07:43 svr08 snort[3492]: WARNING: flowbits key 'file.machobe' is set but not ever checked.

.....LOTS more flowbits warnings and then

215 out of 1024 flowbits in use.

I haven't used snort before and have struggled to find any beginner's documentation or even a forum to post to if anyone knows of any I'd appreciate it.

Also if anyone knows whats going wrong with snort now it would be much appreciated.

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.