I'm currently trying to setup snort on my remote ubuntu server (xenial). Therefore I installed snort via
apt install snort
and configured it according to my network.
My machine has a static ip 176.9.103.111 and a netmask of /27.
Thus I configured my HOME_NET to be 176.9.103.97/27, as .97 is the beginning of my subnet, while .127 is the broadcast address. The service starts up just fine and no errors are given, however when trying to test my snort service by portscanning with nmap the IDS does not give me an alert.
My snort.conf is default except for the aforementioned HOME_NET variable, which I set manually.
When checking the status of the service ubuntu tells me that it is active and running and also listening to the correct interface and setting the correct HOME_NET
/usr/sbin/snort -m 027 -D -d -l /var/log/snort -u snort -g snort -c /etc/snort/snort.conf -S HOME_NET=[176.9.103.111/32] -i eth0
The log-file /var/log/snort/snort.log is binary so I tried opening it with snort -r which lead to the following:
root@guybrush /var/log/snort # snort -r snort.log
Running in packet dump mode
--== Initializing Snort ==--
Initializing Output Plugins!
pcap DAQ configured to read-file.
ERROR: Can't initialize DAQ pcap (-1) - unknown file format
Fatal Error, Quitting..
Does someone know, why my IDS is up and running but not alerting me, when I fire up nmap? What am I missing here?
I tested this in a KALI Linux environment before to learn about the snort configuration and that worked beautifully. There I set up a VM running Kali and snort and when running nmap against the VMs IP address from my host machine the IDS told me there was a potential attack going on, so I was confident enough to try setting it up on a live system.
Any help is appreciated.
176.9.103.96/27is the beginning of your network forHOME_INET– cutrightjm Jun 12 '17 at 17:19psline.. it says it's only listening on a specific IP. Is all traffic being forwarded to that IP? If not snort will not be able to see it. Make sure you also have your rules files in place. – cutrightjm Jun 12 '17 at 17:28HOME_NETthen? ifconfig shows me this ip and the loopback ip – mkli90 Jun 12 '17 at 17:28ifconfigis showing you your gateway, which is the first usable IP in your rangle. The176.9.103.96/27is yournetworkidentifier/address, which tells snort what all possible IPs are in your subnet, from beginning address (network) to the end (broadcast) – cutrightjm Jun 12 '17 at 17:30