Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need you help after searching a whole lot and asking AWS my problem is not getting resolved, so I have come here for your help.

I have a AWS VPC setup with all ubuntu servers

I have a NAT server created which has Snort and Barnyard installed, I followed the following guide http://wiki.aanval.com/wiki/Community:Snort_2.9.2.3_Installation_Guide_for_Ubuntu_12.04,_with_Barnyard2,_Pulledpork,_and_Aanval#Preparation

The versions used for Snort and Barnyard are the latest and not from the guide.

using the following command shows that the data is getting sniffed over the network

tcpflow -i eth0 -C -e port 80

The problem is there are no events being created in the DB and I am unable to test if Snort is functioning properly

The commands used for Snort is

/usr/sbin/snort -A fast -b -d -D -i eth0 -u snort -g snort -c /usr/local/snort/etc/snort.conf -l /var/log/snort/eth0

The command used for Barnyard is

barnyard2 -D -c /etc/snort/barnyard.conf -d /var/log/snort/eth0 -w /var/log/snort/eth0/barnyard2.waldo -l /var/log/snort/eth0 -a /var/log/snort/eth0/archive -f snort.log -X /var/lock/barnyard2-eth0.pid

Please guys help me with this. I thank you guys in advance.

P.S. I am really new to SNORT and Barnyard2 please guide me step by step.

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.