07-22-2019
Snort 2.9.14 hangs once started
I've been trying to get Snort running on my lab network, but haven't been having much luck.
I installed Snort 2.9.14 on both Windows 10 & Ubuntu 18.04 (Running in VirtualBox 5.2.22). I seems to have the snort.conf file set up correctly in both environments, because when I test snort in either one... it exits with a "Snort successfully validated the configuration!" message.
Unfortunately, when I try to start snort out of test mode.... It seems to start and displays the "Commencing packet processing" message... But hangs afterwards... Snort on Ubuntu doesn't show anything after that... But Snort installed on Windows 10 displays "Decoding LoopBack". And doesn't display anything after that.
I've edited the local.rules to display messages if the machine's been pinged or if I view a page with a browser. I have the NIC in promiscuous mode and I'm running the cmd window as an administrator.
Can someone please suggest what might be going on, or a solution? Thanks!
Last edited by bodisha; 07-22-2019 at 04:28 PM..
6 More Discussions You Might Find Interesting
1. UNIX for Advanced & Expert Users
i'm following the, "How to setup and secure Snort, MySQL and Acid on FreeBSD 4.6 Release" off of the snort.org website.
in the documentation it says snort should be installed through the following:
-----
make -DWITH_MYSQL -DWITH_FLEXRESP ; make install
-----
later it says to do the... (13 Replies)
Discussion started by: xyyz
13 Replies
2. BSD
Im trying to gather some info to set up snort on openbsd 3.2, has anyone out there managed to get it up and running ? My initial attempts seem to be quite below par (4 Replies)
Discussion started by: malcontent
4 Replies
3. Linux
Hi,
can anybody know snort port no in linux, (1 Reply)
Discussion started by: manoj.solaris
1 Replies
4. Cybersecurity
I have been asked to place 2 (1 NTOP & 1 SNORT) boxes within our network as part of our tool kit for network monitoring and Intrusion detection. Out network is very simplistic and it layed out like this:
internet
|
|
Cisco 1811 Router (8x Layer 2 switch ports)
... (0 Replies)
Discussion started by: metallica1973
0 Replies
5. Cybersecurity
Is it possible to rule out in alert all HTTPS traffic or rule out all the HTTPS trafic from the alerts on snort ? (3 Replies)
Discussion started by: drd0spt
3 Replies
6. Homework & Coursework Questions
Use and complete the template provided. The entire template must be completed. If you don't, your post may be deleted!
1. The problem statement, all variables and given/known data:
My system is Redhat 5.6. I want to install snort in my system which requires following dependencies.
1. Libpcap... (8 Replies)
Discussion started by: Ankur Goyal
8 Replies
LEARN ABOUT FREEBSD
pcap_activate
PCAP_ACTIVATE(3) Library Functions Manual PCAP_ACTIVATE(3)
NAME
pcap_activate - activate a capture handle
SYNOPSIS
#include <pcap/pcap.h>
int pcap_activate(pcap_t *p);
DESCRIPTION
pcap_activate() is used to activate a packet capture handle to look at packets on the network, with the options that were set on the handle
being in effect.
RETURN VALUE
pcap_activate() returns 0 on success without warnings, PCAP_WARNING_PROMISC_NOTSUP on success on a device that doesn't support promiscuous
mode if promiscuous mode was requested, PCAP_WARNING_TSTAMP_TYPE_NOTSUP on success if the time stamp type specified in a previous
pcap_set_tstamp_type() call isn't supported by the capture source (the time stamp type is left as the default), PCAP_WARNING on success
with any other warning, PCAP_ERROR_ACTIVATED if the handle has already been activated, PCAP_ERROR_NO_SUCH_DEVICE if the capture source
specified when the handle was created doesn't exist, PCAP_ERROR_PERM_DENIED if the process doesn't have permission to open the capture
source, PCAP_ERROR_PROMISC_PERM_DENIED if the process has permission to open the capture source but doesn't have permission to put it into
promiscuous mode, PCAP_ERROR_RFMON_NOTSUP if monitor mode was specified but the capture source doesn't support monitor mode,
PCAP_ERROR_IFACE_NOT_UP if the capture source is not up, and PCAP_ERROR if another error occurred. If PCAP_WARNING or PCAP_ERROR is
returned, pcap_geterr() or pcap_perror() may be called with p as an argument to fetch or display a message describing the warning or error.
If PCAP_WARNING_PROMISC_NOTSUP, PCAP_ERROR_NO_SUCH_DEVICE, or PCAP_ERROR_PERM_DENIED is returned, pcap_geterr() or pcap_perror() may be
called with p as an argument to fetch or display an message giving additional details about the problem that might be useful for debugging
the problem if it's unexpected.
SEE ALSO
pcap(3)
21 September 2010 PCAP_ACTIVATE(3)