Hi List, (Release 5.800)
If i after a certain time the IPS - Settings regards, a red LED is indicated to me. Although Snort was before successfully started and was green the LED. I start Snort again although i am not safe the Snort am really dead.
One does not see the Snort was really terminated (time 21:48:50 ).
Around 22:08:59 i started Snort again.
I saw that already several times.
Possibly an idea. Did someone see the same?
thx
Stefan
I see that in snort the log file:
2005:05:20-21:48:50 (none) snort[4516]: [1:1882:0] A ATTACK-RESPONSES id check returned userid [Classification: Potentially Bad Traffic] [Priority: 2]: {PROTO006} 192.168.100.19:6051 -> 192.168.1.51:3223
2005:05:20-21:48:50 (none) snort[4516]: [1:1882:0] A ATTACK-RESPONSES id check returned userid [Classification: Potentially Bad Traffic] [Priority: 2]: {PROTO006} 192.168.100.19:6051 -> 192.168.1.51:3223
2005:05:20-21:48:50 (none) snort[4516]: [1:1882:0] A ATTACK-RESPONSES id check returned userid [Classification: Potentially Bad Traffic] [Priority: 2]: {PROTO006} 192.168.100.19:6051 -> 192.168.1.51:3223
2005:05:20-22:04:54 (none) snort[4516]: [119:4:1] (http_inspect) BARE BYTE UNICODE ENCODING {PROTO006} 192.168.5.3:1091 -> 207.188.24.150:80
2005:05:20-22:08:59 (none) snort[4516]: Final Flow Statistics
2005:05:20-22:08:59 (none) snort[4516]: Spade got shutdown signal, cleaning up
2005:05:20-22:08:59 (none) snort[4516]: Snort exiting
2005:05:20-22:09:10 (none) snort_inline: Reading from iptables
2005:05:20-22:09:10 (none) snort_inline: Initializing daemon mode
2005:05:20-22:09:10 (none) snort_inline: PID path stat checked out ok, PID path set to /var/run/
2005:05:20-22:09:10 (none) snort_inline: Writing PID "7898" to file "/var/run//snort_inline.pid"
2005:05:20-22:09:10 (none) snort_inline: Parsing Rules file /etc/snort/snort.conf
2005:05:20-22:09:10 (none) snort_inline: HttpInspect Config:
2005:05:20-22:09:10 (none) snort_inline: GLOBAL CONFIG
2005:05:20-22:09:10 (none) snort_inline: Max Pipeline Requests: 0
2005:05:20-22:09:10 (none) snort_inline: Inspection Type: STATELESS
2005:05:20-22:09:10 (none) snort_inline: Detect Proxy Usage: NO
2005:05:20-22:09:10 (none) snort_inline: IIS Unicode Map Filename: /etc/snort/unicode.map
2005:05:20-22:09:10 (none) snort_inline: IIS Unicode Map Codepage: 1252
2005:05:20-22:09:10 (none) snort_inline: DEFAULT SERVER CONFIG:
2005:05:20-22:09:10 (none) snort_inline: Ports: 80
2005:05:20-22:09:10 (none) snort_inline: Flow Depth: 300
2005:05:20-22:09:10 (none) snort_inline: Max Chunk Length: 500000
2005:05:20-22:09:10 (none) snort_inline: Inspect Pipeline Requests: YES
2005:05:20-22:09:10 (none) snort_inline: URI Discovery Strict Mode: NO
2005:05:20-22:09:10 (none) snort_inline: Allow Proxy Usage: NO
2005:05:20-22:09:10 (none) snort_inline: Disable Alerting: NO
2005:05:20-22:09:10 (none) snort_inline: Oversize Dir Length: 500
2005:05:20-22:09:10 (none) snort_inline: Only inspect URI: NO
2005:05:20-22:09:10 (none) snort_inline: Ascii: YES alert: NO
2005:05:20-22:09:10 (none) snort_inline: Double Decoding: YES alert: YES
2005:05:20-22:09:10 (none) snort_inline: %U Encoding: YES alert: YES
2005:05:20-22:09:10 (none) snort_inline: Bare Byte: YES alert: YES
2005:05:20-22:09:10 (none) snort_inline: Base36: OFF
2005:05:20-22:09:10 (none) snort_inline: UTF 8: OFF
2005:05:20-22:09:10 (none) snort_inline: IIS Unicode: YES alert: YES
2005:05:20-22:09:10 (none) snort_inline: Multiple Slash: YES alert: NO
2005:05:20-22:09:10 (none) snort_inline: IIS Backslash: YES alert: NO
2005:05:20-22:09:10 (none) snort_inline: Directory Traversal: YES alert: NO
2005:05:20-22:09:10 (none) snort_inline: Web Root Traversal: YES alert: YES
2005:05:20-22:09:10 (none) snort_inline: Apache WhiteSpace: YES alert: NO
2005:05:20-22:09:10 (none) snort_inline: IIS Delimiter: YES alert: NO
2005:05:20-22:09:10 (none) snort_inline: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
2005:05:20-22:09:10 (none) snort_inline: Non-RFC Compliant Characters: NONE
2005:05:20-22:09:10 (none) snort_inline: rpc_decode arguments:
2005:05:20-22:09:10 (none) snort_inline: Ports to decode RPC on: 111 32771
2005:05:20-22:09:10 (none) snort_inline: alert_fragments: INACTIVE
2005:05:20-22:09:10 (none) snort_inline: alert_large_fragments: ACTIVE
2005:05:20-22:09:10 (none) snort_inline: alert_incomplete: ACTIVE
2005:05:20-22:09:10 (none) snort_inline: alert_multiple_requests: ACTIVE
2005:05:20-22:09:10 (none) snort_inline: telnet_decode arguments:
2005:05:20-22:09:10 (none) snort_inline: Ports to decode telnet on: 21 23 25 119
2005:05:20-22:09:10 (none) snort_inline: ,-----------[Flow Config]----------------------
2005:05:20-22:09:10 (none) snort_inline: | Stats Interval: 0
2005:05:20-22:09:10 (none) snort_inline: | Hash Method: 2
2005:05:20-22:09:10 (none) snort_inline: | Memcap: 10485760
2005:05:20-22:09:10 (none) snort_inline: | Rows : 4099
2005:05:20-22:09:10 (none) snort_inline: | Overhead Bytes: 16400(%0.16)
2005:05:20-22:09:10 (none) snort_inline: `----------------------------------------------
2005:05:20-22:09:10 (none) snort_inline: Spade is enabled
2005:05:20-22:09:10 (none) snort_inline: Spade state initialized to what is in ./spade.rcv
2005:05:20-22:09:10 (none) snort_inline: Spade will record its state to ./spade.rcv after every 50000 updates
2005:05:20-22:09:10 (none) snort_inline: Spade's log is ./spade.log
2005:05:20-22:09:10 (none) snort_inline: Spade reports will go to the alert facility
2005:05:20-22:09:10 (none) snort_inline: Spade homenet set to: any
2005:05:20-22:09:10 (none) snort_inline: detector 1 enabled with: type=closed-dport tcpflags=synonly wait=3
2005:05:20-22:09:10 (none) snort_inline: detector 2 enabled with: type=closed-dport tcpflags=weird thresh=0.5
2005:05:20-22:09:10 (none) snort_inline: detector 3 enabled with: type=closed-dport tcpflags=teardown
2005:05:20-22:09:10 (none) snort_inline: detector 4 enabled with: type=closed-dport to=nothome tcpflags=synonly wait=5
2005:05:20-22:09:10 (none) snort_inline: detector 5 enabled with: type=closed-dport to=nothome tcpflags=synack
2005:05:20-22:09:10 (none) snort_inline: detector 6 enabled with: type=closed-dport to=nothome tcpflags=teardown
2005:05:20-22:09:10 (none) snort_inline: detector 7 enabled with: type=dead-dest tcpflags=weird wait=2
2005:05:20-22:09:10 (none) snort_inline: detector 8 enabled with: type=dead-dest tcpflags=synack wait=2
2005:05:20-22:09:10 (none) snort_inline: detector 9 enabled with: type=dead-dest tcpflags=established wait=5
2005:05:20-22:09:10 (none) snort_inline: detector 10 enabled with: type=dead-dest tcpflags=teardown wait=2
2005:05:20-22:09:10 (none) snort_inline: detector 11 enabled with: type=dead-dest proto=udp wait=2
2005:05:20-22:09:10 (none) snort_inline: detector 12 enabled with: type=dead-dest proto=icmp icmptype=noterr wait=2
2005:05:20-22:09:10 (none) snort_inline: detector 13 enabled with: type=odd-dport proto=tcp wait=2
2005:05:20-22:09:10 (none) snort_inline: detector 14 enabled with: type=odd-typecode
2005:05:20-22:09:10 (none) snort_inline: detector 15 enabled with: type=odd-typecode to=nothome
2005:05:20-22:09:10 (none) snort[7898]:
2005:05:20-22:09:10 (none) snort[7898]: +-----------------------[thresholding-config]----------------------------------
2005:05:20-22:09:10 (none) snort[7898]: | memory-cap : 1048576 bytes
2005:05:20-22:09:10 (none) snort[7898]: +-----------------------[thresholding-global]----------------------------------
2005:05:20-22:09:10 (none) snort[7898]: | none
2005:05:20-22:09:10 (none) snort[7898]: +-----------------------[thresholding-local]-----------------------------------
2005:05:20-22:09:10 (none) snort[7898]: | gen-id=1 sig-id=2496 type=Both tracking=dst count=20 seconds=60
2005:05:20-22:09:10 (none) snort[7898]: | gen-id=1 sig-id=3152 type=Threshold tracking=src count=5 seconds=2
2005:05:20-22:09:10 (none) snort[7898]: | gen-id=1 sig-id=3273 type=Threshold tracking=src count=5 seconds=2
2005:05:20-22:09:10 (none) snort[7898]: | gen-id=1 sig-id=2494 type=Both tracking=dst count=20 seconds=60
2005:05:20-22:09:10 (none) snort[7898]: | gen-id=1 sig-id=2923 type=Threshold tracking=dst count=10 seconds=60
2005:05:20-22:09:10 (none) snort[7898]: | gen-id=1 sig-id=2275 type=Threshold tracking=dst count=5 seconds=60
2005:05:20-22:09:10 (none) snort[7898]: | gen-id=1 sig-id=2495 type=Both tracking=dst count=20 seconds=60
2005:05:20-22:09:10 (none) snort[7898]: | gen-id=1 sig-id=2523 type=Both tracking=dst count=10 seconds=10
2005:05:20-22:09:10 (none) snort[7898]: | gen-id=1 sig-id=2924 type=Threshold tracking=dst count=10 seconds=60
2005:05:20-22:09:10 (none) snort[7898]: +-----------------------[suppression]------------------------------------------
2005:05:20-22:09:10 (none) snort[7898]: | none
2005:05:20-22:09:10 (none) snort[7898]: +------------------------------------------------------------------------------
2005:05:20-22:09:10 (none) snort[7898]: Rule application order: ->activation->dynamic->drop->sdrop->reject->alert->pass->log
2005:05:20-22:09:10 (none) snort[7898]: Log directory = /var/log/snort
2005:05:20-22:09:11 (none) snort[7898]: Snort initialization completed successfully (pid=7898)
