Re: [Snort-inline-users] Help

[Joel E. <es...@gm...>]

Looks like you are using an old version of Snort with a new version of
rules.

Please update your Snort version.

J

On Fri, Jan 15, 2010 at 3:44 AM, charles mugisha <mug...@gm...> wrote:

> Hi;
>
>
>
> This is my first time to run snort-inline, it look like I syccesfully
> install snort-inline but when I start it I’m getting the following message.
> Is saying that no process found.
>
> What I’m I missing?
>
>
>
> charles@ips:~$ sudo /etc/init.d/snort_inlined restart
>
> snort_inline: no process found
>
> Removing iptables rules:
>
> Starting ip_queue module:
>
> Starting iptables rules:
>
> Starting snort_inline:
>
> Reading from iptables
>
> Initializing Inline mode
>
>
>
>
>
> Also when I run this command “snort_inline -Q -v -c
> /etc/snort_inline/snort_inline.conf -l /var/log/snort_inline
>
> Reading from iptables” I’m getting the following output with two errors.
> What is wrong with my snort-inline?Is any one can help?
>
>
>
> charles@ips:~$ sudo snort_inline -Q -v -c
> /etc/snort_inline/snort_inline.conf -l /var/log/snort_inline
>
> Reading from iptables
>
> Running in IDS mode
>
> Initializing Inline mode
>
>
>
>         --== Initializing Snort ==--
>
> Initializing Output Plugins!
>
> Setting the Packet Processor to decode packets from iptables
>
> Initializing Preprocessors!
>
> Initializing Plug-ins!
>
> Parsing Rules file /etc/snort_inline/snort_inline.conf
>
>
>
> +++++++++++++++++++++++++++++++++++++++++++++++++++
>
> Initializing rule chains...
>
> ,-----------[Flow Config]----------------------
>
> | Stats Interval:  0
>
> | Hash Method:     2
>
> | Memcap:          10485760
>
> | Rows  :          4099
>
> | Overhead Bytes:  16400(%0.16)
>
> `----------------------------------------------
>
> Stream4 config:
>
>     Stateful inspection: ACTIVE
>
>     Session statistics: INACTIVE
>
>     Session timeout: 30 seconds
>
>     Session memory cap: 8388608 bytes
>
>     Session count max: 8192 sessions
>
>     Session cleanup count: 5
>
>     State alerts: INACTIVE
>
>     Evasion alerts: INACTIVE
>
>     Scan alerts: INACTIVE
>
>     Log Flushed Streams: INACTIVE
>
>     MinTTL: 1
>
>     TTL Limit: 5
>
>     Async Link: 0
>
>     State Protection: 0
>
>     Self preservation threshold: 50
>
>     Self preservation period: 90
>
>     Suspend threshold: 200
>
>     Suspend period: 30
>
>     Enforce TCP State: INACTIVE
>
>     Midstream Drop Alerts: INACTIVE
>
>     Server Data Inspection Limit: -1
>
> Inline-mode options:
>
>     Inline-mode enabled? (stream4inline): No
>
>     Sliding Windowsize (window_size): 7000 (max full conn: 1198)
>
>     Memcap reached method (truncate): Prune
>
>     Truncate percentage (truncate_percentage): 33
>
>     DROP out-of-window packets (drop_out_of_window): No
>
>     DROP data on unestablised session state (drop_data_on_unest): No
>
>     DROP no tcp-flags on establised packets (drop_no_tcp_on_est): No
>
>     DROP packet not within session limits (drop_not_in_limits): No
>
>     DROP ttl evasion (drop_ttl_evasion): No
>
>     Store/Load state from/to disk: No
>
> WARNING /etc/snort_inline/snort_inline.conf(299) => flush_behavior set in
> config file, using old static flushpoints (0)
>
> Stream4_reassemble config:
>
>     Server reassembly: ACTIVE
>
>     Client reassembly: ACTIVE
>
>     Reassembler alerts: ACTIVE
>
>     Zero out flushed packets: INACTIVE
>
>     Flush stream on alert: INACTIVE
>
>     flush_data_diff_size: 500
>
>     Reassembler Packet Preferance : Favor Old
>
>     Packet Sequence Overlap Limit: -1
>
>     Flush behavior: Small (<255 bytes)
>
>     Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521
> 3306
>
>     Emergency Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513
> 1433 1521 3306
>
> HttpInspect Config:
>
>     GLOBAL CONFIG
>
>       Max Pipeline Requests:    0
>
>       Inspection Type:          STATELESS
>
>       Detect Proxy Usage:       NO
>
>       IIS Unicode Map Filename: /etc/snort_inline/unicode.map
>
>       IIS Unicode Map Codepage: 1252
>
>     DEFAULT SERVER CONFIG:
>
>       Ports: 80 8080 8180
>
>       Flow Depth: 300
>
>       Max Chunk Length: 500000
>
>       Inspect Pipeline Requests: YES
>
>       URI Discovery Strict Mode: NO
>
>       Allow Proxy Usage: NO
>
>       Disable Alerting: NO
>
>       Oversize Dir Length: 500
>
>       Only inspect URI: NO
>
>       Ascii: YES alert: NO
>
>       Double Decoding: YES alert: YES
>
>       %U Encoding: YES alert: YES
>
>       Bare Byte: YES alert: YES
>
>       Base36: OFF
>
>       UTF 8: OFF
>
>       IIS Unicode: YES alert: YES
>
>       Multiple Slash: YES alert: NO
>
>       IIS Backslash: YES alert: NO
>
>       Directory Traversal: YES alert: NO
>
>       Web Root Traversal: YES alert: YES
>
>       Apache WhiteSpace: YES alert: NO
>
>       IIS Delimiter: YES alert: NO
>
>       IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
>
>       Non-RFC Compliant Characters: NONE
>
> rpc_decode arguments:
>
>     Ports to decode RPC on: 111 32771
>
>     alert_fragments: INACTIVE
>
>     alert_large_fragments: ACTIVE
>
>     alert_incomplete: ACTIVE
>
>     alert_multiple_requests: ACTIVE
>
> telnet_decode arguments:
>
>     Ports to decode telnet on: 21 23 25 119
>
> Portscan Detection Config:
>
>     Detect Protocols:  TCP UDP ICMP IP
>
>     Detect Scan Type:  portscan portsweep decoy_portscan
> distributed_portscan
>
>     Sensitivity Level: Low
>
>     Memcap (in bytes): 10000000
>
>     Number of Nodes:   36900
>
>
>
> database: compiled support for ( mysql )
>
> database: configured to use mysql
>
> database:          user = snortuser
>
> database: password is set
>
> database: database name = snort
>
> database:          host = localhost
>
> Interface is NULL. Name may not be unique for the host
>
> Node unique name is: unknown:(null)
>
>
>
> database:   sensor name = unknown:(null)
>
> database:     sensor id = 1
>
> database: schema version = 106
>
> database: using the "log" facility
>
> ERROR: Warning: /etc/snort_inline/rules/exploit.rules(24) => Unknown
> keyword ' metadata' in rule!
>
> Fatal Error, Quitting..
>
>
> ------------------------------------------------------------------------------
> Throughout its 18-year history, RSA Conference consistently attracts the
> world's best and brightest in the field, creating opportunities for
> Conference
> attendees to learn about information security's most important issues
> through
> interactions with peers, luminaries and emerging and established companies.
> http://p.sf.net/sfu/rsaconf-dev2dev
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>
>


-- 
Joel Esler