Re: [sentinix-list] Pb activate snort sensor

On Saturday 13 December 2003 11:02, Thierry wrote:
> Hi,
> I did what you ask me to do, know it take the right sensor, i mean eth1
> instead of eth0 .... But i do not know how to start it ...
> What should i fill about Snort Command Line, in Sensor Consol... (snort -A
> ...)?? When i try to run it, i have this "error" message :

The Snort command line should be empty.  You must have 
/etc/rc.d/rc.snortcenter started (i.e. chmod +x at boot time), SnortCenter's 
localhost agent should look like this, this is the default, no need to change 
anything from when you installed, it _does_ work out of the box:

Enable sensor: (yes, of course)
Sensor name: localhost (or whatever you want to call it)
Sensor IP: localhost    Port: 2525
Sensor uname: admin
Sensor passwd: change
Sensor Agent Type: SnortCenter Agent v.1 (SSL enabled)
Interface name to sniff: eth0
Snort command line (should be empty)

Change eth0 to eth1 if that's what you want to sniff.

>
> "Uh, you need to tell me to do something..."
>
> Thx
>
> ps: your gui can not be read by Opera7/FreeBSD 5.1, i can not log on
> SnortCenter ...

SnortCenter is quite picky, seems to have been made specifically for 
Mozilla/Mozilla Firebird. Works good in IE too though.

	Michel