snort inline ne detecte pas
aprés avoir terminer mon installation, quand je lance la commande:
Code:
snort_inline -Q -v -c /etc/snort_inline/snort_inline.conf -l /var/log/snort_inline
il m'affiche:
Code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
| --== Initialization Complete ==--
,,_ -*> Snort_Inline! <*-
o" )~ Version 2.6.1.5 (Build 59) inline
'''' By Martin Roesch & The Snort Team: http://www.snort.org/team.html
Snort_Inline Mod by William Metcalf, Victor Julien, Nick Rogness,
Dave Remien, Rob McMillen and Jed Haile
(C) Copyright 1998-2007 Sourcefire Inc., et al.
Rules Engine: SF_SNORT_DETECTION_ENGINE Version 1.6 <Build 11>
Preprocessor Object: SF_SSH Version 1.0 <Build 1>
Preprocessor Object: SF_DCERPC Version 1.0 <Build 4>
Preprocessor Object: SF_FTPTELNET Version 1.0 <Build 10>
Preprocessor Object: SF_SMTP Version 1.0 <Build 7>
Preprocessor Object: SF_DNS Version 1.0 <Build 2>
Not Using PCAP_FRAMES |
et il ne détecte rien, par contre quand je lance la commande il détecte en affichant:
Code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
| --== Initialization Complete ==--
,,_ -*> Snort_Inline! <*-
o" )~ Version 2.6.1.5 (Build 59) inline
'''' By Martin Roesch & The Snort Team: http://www.snort.org/team.html
Snort_Inline Mod by William Metcalf, Victor Julien, Nick Rogness,
Dave Remien, Rob McMillen and Jed Haile
(C) Copyright 1998-2007 Sourcefire Inc., et al.
Not Using PCAP_FRAMES
03/29-19:28:15.445696 192.168.1.16:61401 -> 94.51.237.102:18526
UDP TTL:64 TOS:0x0 ID:14140 IpLen:20 DgmLen:61
Len: 33
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
03/29-19:28:15.980995 ARP who-has 192.168.1.16 tell 192.168.1.1
03/29-19:28:15.981022 ARP reply 192.168.1.16 is-at 0:23:5A:3:4:3F
03/29-19:28:16.164136 192.168.1.16:52130 -> 213.165.84.241:80
TCP TTL:64 TOS:0x0 ID:14141 IpLen:20 DgmLen:40 DF
***A***F Seq: 0xA5311618 Ack: 0xF92F750E Win: 0x3ED4 TcpLen: 20
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ |
avez vous une idée pour quoi la 1er commande ne marche pas??Merci!
