Re: Snort 2.8.0.1 and No TCP Alerts.
Stefano Zanero <[email protected]>
| Newsgroups | gmane.comp.security.ids |
|---|---|
| Organization | DEI - Politecnico di Milano |
| Message-ID | <[email protected]> |
[email protected] wrote: > I setup Snort 2.8.0.1 on debian 4.0. Everything seems fine except it > doesn't alerts any TCP alerts. It sees all icmp traffics and logs > all alerts but none of TCP alerts. I used Idswakeup to test these > rules and none of alerts are firing. In snort forum, there was one > thread related to this type of trouble with 2.6 version. I tested > with -k none options and it didn't help me out. IDSWakeup is stateless. Snort 2.8 probably ignores the out-of-state packets it is producing. Stefano ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------