--0-85801673-1129816787=:73563
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Content-Id:
Content-Disposition: inline

Hi

Thanks for your hint.  The output had a error as I
forgot to specify -l in comand line.  The attached is
the right output after I specified -l switch in
command line.

Here is the last part of output:

+-----------------------[thresholding-config]---------------------------
-------
| memory-cap : 1048576 bytes
+-----------------------[thresholding-global]---------------------------
-------
| none
+-----------------------[thresholding-local]----------------------------
-------
| gen-id=1      sig-id=3273       type=Threshold
tracking=src count=5   seconds=
2
| gen-id=1      sig-id=3543       type=Threshold
tracking=src count=5   seconds=
2
| gen-id=1      sig-id=3152       type=Threshold
tracking=src count=5   seconds=
2
| gen-id=1      sig-id=2523       type=Both
tracking=dst count=10  seconds=
10
| gen-id=1      sig-id=2275       type=Threshold
tracking=dst count=5   seconds=
60
| gen-id=1      sig-id=3542       type=Threshold
tracking=src count=5   seconds=
2
| gen-id=1      sig-id=3527       type=Limit
tracking=dst count=5   seconds=
60
+-----------------------[suppression]-----------------------------------
-------
| gen-id=119    sig-id=4
tracking=dstip=0.0.0.0           mask=0.0.0.0

| gen-id=122    sig-id=27
tracking=dstip=0.0.0.0           mask=0.0.0.0

| gen-id=122    sig-id=19
tracking=dstip=0.0.0.0           mask=0.0.0.0

*****************

It looked like it reads the threshold.conf but can not
suppress the alerts?  Why?

Any help will be appreciated.  I am just too upset
with that.


Thanks,

Peter



--- Joćo Mota <joao@3gnt.net> wrote:

> Peter Rodger wrote:
> 
> whole 
> and 
> not 
> directory "log". 
> incorrectly 
> Well... try to follow the instructions given. What's
> the output
> configuration line? Have you tried replacing the ''
> with '/' or
> vice-versa in the logs path?
> 
> If Snort isn't starting how can you be getting
> alerts? When you figure
> out what's wrong with the output dir send the
> Snort's output concerning
> the thresholding.
>
> Good hunting 
>
>





__________________________________
Yahoo! Mail - PC Magazine Editors' Choice 2005
http://mail.yahoo.com
--0-85801673-1129816787=:73563
Content-Type: text/plain; name="output.txt"
Content-Description: 2058990509-output.txt
Content-Disposition: inline; filename="output.txt"

D:\win-ids\Snort\bin>snort -c d:\win-ids\snort\etc\snort.conf -l d:\win-ids\
snor
t\log
Running in IDS mode

Initializing Network Interface \Device\NPF_{068F010E-6C94-4163-9C52-155
51BFD66A9
}

--== Initializing Snort ==--
Initializing Output Plugins!
Decoding Ethernet on interface \Device\NPF_{068F010E-6C94-4163-9C52-155
51BFD66A9
}
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file d:\win-ids\snort\etc\snort.conf

 ++++++++++++++++++++++++++++++++++++++++
+++++++++++
Initializing rule chains...
,-----------[Flow Config]----------------------
| Stats Interval:  0
| Hash Method:     2
| Memcap:          10485760
| Rows  :          4099
| Overhead Bytes:  16400(%0.16)
`----------------------------------------------
No arguments to frag2 directive, setting defaults to:
Fragment timeout: 60 seconds
Fragment memory cap: 4194304 bytes
Fragment min_ttl:   0
Fragment ttl_limit: 5
Fragment Problems: 0
Self preservation threshold: 500
Self preservation period: 90
Suspend threshold: 1000
Suspend period: 30
Stream4 config:
Stateful inspection: ACTIVE
Session statistics: INACTIVE
Session timeout: 30 seconds
Session memory cap: 8388608 bytes
State alerts: INACTIVE
Evasion alerts: INACTIVE
Scan alerts: INACTIVE
Log Flushed Streams: INACTIVE
MinTTL: 1
TTL Limit: 5
Async Link: 0
State Protection: 0
Self preservation threshold: 50
Self preservation period: 90
Suspend threshold: 200
Suspend period: 30
Enforce TCP State: INACTIVE
Midstream Drop Alerts: INACTIVE

Stream4_reassemble config:
Server reassembly: INACTIVE
Client reassembly: ACTIVE
Reassembler alerts: ACTIVE
Zero out flushed packets: INACTIVE
flush_data_diff_size: 500
Ports: 21 23 25 53 80 110 111 143 513 1433
Emergency Ports: 21 23 25 53 80 110 111 143 513 1433
HttpInspect Config:
GLOBAL CONFIG
Max Pipeline Requests:    0
Inspection Type:          STATELESS
Detect Proxy Usage:       NO
IIS Unicode Map Filename: d:\win-ids\snort\etc\unicode.map
IIS Unicode Map Codepage: 1252
DEFAULT SERVER CONFIG:
Ports: 80 8080 8180
Flow Depth: 300
Max Chunk Length: 500000
Inspect Pipeline Requests: YES
URI Discovery Strict Mode: NO
Allow Proxy Usage: NO
Disable Alerting: NO
Oversize Dir Length: 500
Only inspect URI: NO
Ascii: YES alert: NO
Double Decoding: YES alert: YES
%U Encoding: YES alert: YES
Bare Byte: YES alert: YES
Base36: OFF
UTF 8: OFF
IIS Unicode: YES alert: YES
Multiple Slash: YES alert: NO
IIS Backslash: YES alert: NO
Directory Traversal: YES alert: NO
Web Root Traversal: YES alert: YES
Apache WhiteSpace: YES alert: NO
IIS Delimiter: YES alert: NO
IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
Non-RFC Compliant Characters: NONE
rpc_decode arguments:
Ports to decode RPC on: 111 32771
alert_fragments: INACTIVE
alert_large_fragments: ACTIVE
alert_incomplete: ACTIVE
alert_multiple_requests: ACTIVE
telnet_decode arguments:
Ports to decode telnet on: 21 23 25 119
Portscan Detection Config:
Detect Protocols:  TCP UDP ICMP IP
Detect Scan Type:  portscan portsweep decoy_portscan distributed_portscan
Sensitivity Level: Low
Memcap (in bytes): 10000000
Number of Nodes:   36900

Using LOCAL time
alert_syslog output processor is defaulting to syslog server on 127.0.0.1 po
rt 5
14!
database: compiled support for ( mysql odbc mssql )
database: configured to use mssql
database: database name = snort
database:          user = snort
database: password is set
database:          host = localhost
database:          port = 1433
database:   sensor name = TESTIDS:\Device\NPF_{068F010E-6C94-4163-9C52-
15551BFD6
6A9}
database: SQL Server message 5701, state 2, severity 0:
Changed database context to 'snort'.
Server 'TESTIDS',
database: SQL Server message 5701, state 1, severity 0:
Changed database context to 'snort'.
Server 'TESTIDS', Line 1
database:     sensor id = 1
database: inconsistent cid information for sid=1
Recovering by rolling forward the cid=38534
database: schema version = 106
database: using the "log" facility
database: compiled support for ( mysql odbc mssql )
database: configured to use mssql
database: database name = snort
database:          user = snort
database: password is set
database:          host = localhost
database:          port = 1433
database:   sensor name = TESTIDS:\Device\NPF_{068F010E-6C94-4163-9C52-
15551BFD6
6A9}
database: SQL Server message 5701, state 2, severity 0:
Changed database context to 'snort'.
Server 'TESTIDS',
database: SQL Server message 5701, state 1, severity 0:
Changed database context to 'snort'.
Server 'TESTIDS', Line 1
database:     sensor id = 1
database: schema version = 106
database: using the "alert" facility
2111 Snort rules read...
2111 Option Chains linked into 191 Chain Headers
0 Dynamic rules
 ++++++++++++++++++++++++++++++++++++++++
+++++++++++

Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set.
Warning: flowbits key 'realplayer.playlist' is checked but not ever set.
Warning: flowbits key 'http.jpeg' is checked but not ever set.

+-----------------------[thresholding-config]---------------------------
-------
| memory-cap : 1048576 bytes
+-----------------------[thresholding-global]---------------------------
-------
| none
+-----------------------[thresholding-local]----------------------------
-------
| gen-id=1      sig-id=3273       type=Threshold tracking=src count=5   seco
nds=
2
| gen-id=1      sig-id=3543       type=Threshold tracking=src count=5   seco
nds=
2
| gen-id=1      sig-id=3152       type=Threshold tracking=src count=5   seco
nds=
2
| gen-id=1      sig-id=2523       type=Both      tracking=dst count=10  seco
nds=
10
| gen-id=1      sig-id=2275       type=Threshold tracking=dst count=5   seco
nds=
60
| gen-id=1      sig-id=3542       type=Threshold tracking=src count=5   seco
nds=
2
| gen-id=1      sig-id=3527       type=Limit     tracking=dst count=5   seco
nds=
60
+-----------------------[suppression]-----------------------------------
-------
| gen-id=119    sig-id=4          tracking=dstip=0.0.0.0           mask=0.0.
0.0

| gen-id=122    sig-id=27         tracking=dstip=0.0.0.0           mask=0.0.
0.0

| gen-id=122    sig-id=19         tracking=dstip=0.0.0.0           mask=0.0.
0.0

+---------------------------------------------------------------------------
---
Rule application order: ->activation->dynamic->alert->pass->log
Log directory = d:\win-ids\snort\log

--== Initialization Complete ==--

,,_     -*> Snort! <*-
o"  )~   Version 2.3.0-ODBC-MySQL-MSSQL-FlexRESP-WIN32 (Build 10)
''''    By Martin Roesch & The Snort Team: http://www.snort.org/team.html
(C) Copyright 1998-2004 Sourcefire Inc., et al.

--0-85801673-1129816787=:73563--


-------------------------------------------------------
This SF.Net email is sponsored by:
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
 ________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users

[ Post a follow-up to this message ]