Re: alert_fast does not print to console until after Snort3 is terminated

Hello,



you are correct, It looks like there is a delay of 30 to 45 seconds from when the packet reaches the Snort sensor and when it's prited to the console.

This must be a new issue, because with previous releases of snort, it was much more immediate.



thanks

NOah





Noah 








---- On Mon, 12 Dec 2022 19:43:06 +0200 Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) <[email protected]> wrote ---



Hi Noah,

 

I tried it on my machine (pretty old Fedora) and alert_fast(as well as other loggers) works fine (there is some delay, up to 20 seconds).

Can you please tell me how long you waited for the event to appear? There may be some latency associated with the buffer flush, so it may depend on the number of alerts, system load,
 and some other factors.

 

If it happens that you wait quite a long time and the events still don't appear, could you share your configure_cmake.sh command line as well as the traffic record?
 
 
Thanks,
 Vitalii!
 

From: Snort-users <mailto:[email protected]> on behalf of Noah Dietrich <mailto:[email protected]>
 Date: Sunday, 11 December 2022, 11:35
 To: snort-users <mailto:[email protected]>
 Subject: [Snort-users] alert_fast does not print to console until after Snort3 is terminated

Hello,


 


I'm working on updating the Snort 3 Ubuntu install guide, and I am seeing a strange thing.


Snort 3.1.47.0 on Ubuntu 22.04.


 


When I try to output alerts to the console using -A alert_fast, they do not display until after I terminate the snort process, where in previous releases the alerts would print to the console as snort was running.


I'm using the default snort.lua file, my local.rules file has one rule:


 


alert icmp any any -> any any ( msg:"ICMP Traffic Detected"; sid:10000001; metadata:policy security-ips alert; )


 


and I'm running snort as follows from the console:


 


sudo snort -c /usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules -i ens3 -A alert_fast -s 65535 -k none


 


here is the output i'm seeing (Truncated):


 


...


pcap DAQ configured to passive.


Commencing packet processing


++ [0] ens3


^C** caught int signal


== stopping


12/11-10:36:54.380804 [**] [1:10000001:0] "ICMP Traffic Detected" [**] [Priority: 0] {ICMP} 10.10.10.1 -> 10.10.10.33


12/11-10:36:54.380878 [**] [1:10000001:0] "ICMP Traffic Detected" [**] [Priority: 0] {ICMP} 10.10.10.33 -> 10.10.10.1


-- [0] ens3


--------------------------------------------------


Packet Statistics


--------------------------------------------------


...


 


As you can see, the alerts are not printed to the console while snort is running, they print as soon as i terminate snort with ctrl-c.  Previously, these alerts would print directly to the
 console as snort generated them, rather than when snort closed.


 


Noah 




 



 

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette