Thread: [Snort-inline-users] Help

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 422-6466

Hi;

This is my first time to run snort-inline, it look like I syccesfully
install snort-inline but when I start it I’m getting the following message.
Is saying that no process found.

What I’m I missing?

charles@ips:~$ sudo /etc/init.d/snort_inlined restart

snort_inline: no process found

Removing iptables rules:

Starting ip_queue module:

Starting iptables rules:

Starting snort_inline:

Reading from iptables

Initializing Inline mode

Also when I run this command “snort_inline -Q -v -c
/etc/snort_inline/snort_inline.conf -l /var/log/snort_inline

Reading from iptables” I’m getting the following output with two errors.
What is wrong with my snort-inline?Is any one can help?

charles@ips:~$ sudo snort_inline -Q -v -c
/etc/snort_inline/snort_inline.conf -l /var/log/snort_inline

Reading from iptables

Running in IDS mode

Initializing Inline mode

        --== Initializing Snort ==--

Initializing Output Plugins!

Setting the Packet Processor to decode packets from iptables

Initializing Preprocessors!

Initializing Plug-ins!

Parsing Rules file /etc/snort_inline/snort_inline.conf

+++++++++++++++++++++++++++++++++++++++++++++++++++

Initializing rule chains...

,-----------[Flow Config]----------------------

| Stats Interval:  0

| Hash Method:     2

| Memcap:          10485760

| Rows  :          4099

| Overhead Bytes:  16400(%0.16)

`----------------------------------------------

Stream4 config:

    Stateful inspection: ACTIVE

    Session statistics: INACTIVE

    Session timeout: 30 seconds

    Session memory cap: 8388608 bytes

    Session count max: 8192 sessions

    Session cleanup count: 5

    State alerts: INACTIVE

    Evasion alerts: INACTIVE

    Scan alerts: INACTIVE

    Log Flushed Streams: INACTIVE

    MinTTL: 1

    TTL Limit: 5

    Async Link: 0

    State Protection: 0

    Self preservation threshold: 50

    Self preservation period: 90

    Suspend threshold: 200

    Suspend period: 30

    Enforce TCP State: INACTIVE

    Midstream Drop Alerts: INACTIVE

    Server Data Inspection Limit: -1

Inline-mode options:

    Inline-mode enabled? (stream4inline): No

    Sliding Windowsize (window_size): 7000 (max full conn: 1198)

    Memcap reached method (truncate): Prune

    Truncate percentage (truncate_percentage): 33

    DROP out-of-window packets (drop_out_of_window): No

    DROP data on unestablised session state (drop_data_on_unest): No

    DROP no tcp-flags on establised packets (drop_no_tcp_on_est): No

    DROP packet not within session limits (drop_not_in_limits): No

    DROP ttl evasion (drop_ttl_evasion): No

    Store/Load state from/to disk: No

WARNING /etc/snort_inline/snort_inline.conf(299) => flush_behavior set in
config file, using old static flushpoints (0)

Stream4_reassemble config:

    Server reassembly: ACTIVE

    Client reassembly: ACTIVE

    Reassembler alerts: ACTIVE

    Zero out flushed packets: INACTIVE

    Flush stream on alert: INACTIVE

    flush_data_diff_size: 500

    Reassembler Packet Preferance : Favor Old

    Packet Sequence Overlap Limit: -1

    Flush behavior: Small (<255 bytes)

    Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521
3306

    Emergency Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513
1433 1521 3306

HttpInspect Config:

    GLOBAL CONFIG

      Max Pipeline Requests:    0

      Inspection Type:          STATELESS

      Detect Proxy Usage:       NO

      IIS Unicode Map Filename: /etc/snort_inline/unicode.map

      IIS Unicode Map Codepage: 1252

    DEFAULT SERVER CONFIG:

      Ports: 80 8080 8180

      Flow Depth: 300

      Max Chunk Length: 500000

      Inspect Pipeline Requests: YES

      URI Discovery Strict Mode: NO

      Allow Proxy Usage: NO

      Disable Alerting: NO

      Oversize Dir Length: 500

      Only inspect URI: NO

      Ascii: YES alert: NO

      Double Decoding: YES alert: YES

      %U Encoding: YES alert: YES

      Bare Byte: YES alert: YES

      Base36: OFF

      UTF 8: OFF

      IIS Unicode: YES alert: YES

      Multiple Slash: YES alert: NO

      IIS Backslash: YES alert: NO

      Directory Traversal: YES alert: NO

      Web Root Traversal: YES alert: YES

      Apache WhiteSpace: YES alert: NO

      IIS Delimiter: YES alert: NO

      IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG

      Non-RFC Compliant Characters: NONE

rpc_decode arguments:

    Ports to decode RPC on: 111 32771

    alert_fragments: INACTIVE

    alert_large_fragments: ACTIVE

    alert_incomplete: ACTIVE

    alert_multiple_requests: ACTIVE

telnet_decode arguments:

    Ports to decode telnet on: 21 23 25 119

Portscan Detection Config:

    Detect Protocols:  TCP UDP ICMP IP

    Detect Scan Type:  portscan portsweep decoy_portscan
distributed_portscan

    Sensitivity Level: Low

    Memcap (in bytes): 10000000

    Number of Nodes:   36900

database: compiled support for ( mysql )

database: configured to use mysql

database:          user = snortuser

database: password is set

database: database name = snort

database:          host = localhost

Interface is NULL. Name may not be unique for the host

Node unique name is: unknown:(null)

database:   sensor name = unknown:(null)

database:     sensor id = 1

database: schema version = 106

database: using the "log" facility

ERROR: Warning: /etc/snort_inline/rules/exploit.rules(24) => Unknown keyword
' metadata' in rule!

Fatal Error, Quitting..

Thread: [Snort-inline-users] Help

snort-inline-users