samedi 31 janvier 2015

Snort PCAP file analysing doesn't write to alert file


I'm using snort in my ubuntu 14.04 virtual machine. This is how I installed snort.



sudo apt-get update
sudo apt-get install snort


I haven't change /etc/snort/snort.conf or rules file. They remain as the default and I did PCAP reading using following command.



sudo /usr/sbin/snort -d -l /var/log/snort -c /etc/snort/snort.conf -r /home/navarathna/Downloads/cap2.pcap


The PCAP file is successfully read and a snort.log file is created, but the size of that file is 0 bytes. When I installed snort, there was no alert file in /var/log/snort directory. So I created one and gave owner permission for snort as following.



sudo chown snort.snort alert


After the PCAP reading, both snort.log and alert files have no content (Although the snort.log modified date changes to the last read date and time). Their sizes are 0 bytes. What am I doing wrong here?? Do I need to do some additional changes for rules/snort.conf files?



Aucun commentaire:

Enregistrer un commentaire