Re: [Snort-inline-users] configuring reporting/logfile questions

[Michael W C. <co...@ca...>]

On Thu, 12 Jan 2006 18:30:19 -0600, you wrote:

>Hmmmmm are you running bridge or nat mode?  If you start with -v do
>you see traffic passing?  If you are in NAT mode are you allowing
>stream4 to see both sides of the conversation i.e. queueing in both
>INPUT and OUTPUT?
>
>Regards,
>
>Will

This is going to sound stupid, but there's a reason for it.  I'm in
NAT mode, but I'm not entirely sure how to check for bidirectional
queuing.  See, I'm not using native iptables, I'm using shorewall
3.04.  As for the -v startup, I do get some stuff on the screen that
looks like packet details (src & dest IP address, UDP, &etc., but to
be brutally honest, I can't make heads or tails of it.  There doesn't
seem to be an indication what rule it hit (if any) or if I'm just
seeing traffic.

Mike-
--
If you're not confused, you're not trying hard enough.
--
Please note - Due to the intense volume of spam, we have installed 
site-wide spam filters at catherders.com.  If email from you bounces,
try non-HTML, non-encoded, non-attachments,