alert_fast does not print to console until after Snort3 is terminated
Noah Dietrich <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <[email protected]> |
Hello,
I'm working on updating the Snort 3 Ubuntu install guide, and I am seeing a strange thing.
Snort 3.1.47.0 on Ubuntu 22.04.
When I try to output alerts to the console using -A alert_fast, they do not display until after I terminate the snort process, where in previous releases the alerts would print to the console as snort was running.
I'm using the default snort.lua file, my local.rules file has one rule:
alert icmp any any -> any any ( msg:"ICMP Traffic Detected"; sid:10000001; metadata:policy security-ips alert; )
and I'm running snort as follows from the console:
sudo snort -c /usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules -i ens3 -A alert_fast -s 65535 -k none
here is the output i'm seeing (Truncated):
...
pcap DAQ configured to passive.
Commencing packet processing
++ [0] ens3
^C** caught int signal
== stopping
12/11-10:36:54.380804 [**] [1:10000001:0] "ICMP Traffic Detected" [**] [Priority: 0] {ICMP} 10.10.10.1 -> 10.10.10.33
12/11-10:36:54.380878 [**] [1:10000001:0] "ICMP Traffic Detected" [**] [Priority: 0] {ICMP} 10.10.10.33 -> 10.10.10.1
-- [0] ens3
--------------------------------------------------
Packet Statistics
--------------------------------------------------
...
As you can see, the alerts are not printed to the console while snort is running, they print as soon as i terminate snort with ctrl-c. Previously, these alerts would print directly to the console as snort generated them, rather than when snort closed.
Noah
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users
To unsubscribe, send an email to:
[email protected]
Please visit http://blog.snort.org to stay current on all the latest Snort news!
Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette