I'm currently trying to setup snort on my remote ubuntu server (xenial). Therefore I installed snort via

apt install snort

and configured it according to my network. My machine has a static ip 176.9.103.111 and a netmask of /27.

Thus I configured my HOME_NET to be 176.9.103.97/27, as .97 is the beginning of my subnet, while .127 is the broadcast address. The service starts up just fine and no errors are given, however when trying to test my snort service by portscanning with nmap the IDS does not give me an alert.

My snort.conf is default except for the aforementioned HOME_NET variable, which I set manually.

When checking the status of the service ubuntu tells me that it is active and running and also listening to the correct interface and setting the correct HOME_NET

/usr/sbin/snort -m 027 -D -d -l /var/log/snort -u snort -g snort -c /etc/snort/snort.conf -S HOME_NET=[176.9.103.111/32] -i eth0

The log-file /var/log/snort/snort.log is binary so I tried opening it with snort -r which lead to the following:

root@guybrush /var/log/snort # snort -r snort.log 
Running in packet dump mode

    --== Initializing Snort ==--
Initializing Output Plugins!
pcap DAQ configured to read-file.
ERROR: Can't initialize DAQ pcap (-1) - unknown file format

Fatal Error, Quitting..

Does someone know, why my IDS is up and running but not alerting me, when I fire up nmap? What am I missing here?

I tested this in a KALI Linux environment before to learn about the snort configuration and that worked beautifully. There I set up a VM running Kali and snort and when running nmap against the VMs IP address from my host machine the IDS told me there was a potential attack going on, so I was confident enough to try setting it up on a live system.

Any help is appreciated.

share|improve this question
    
176.9.103.96/27 is the beginning of your network for HOME_INET – cutrightjm Jun 12 '17 at 17:19
    
I could be wrong, but it also looks like it's configured incorectly in your ps line.. it says it's only listening on a specific IP. Is all traffic being forwarded to that IP? If not snort will not be able to see it. Make sure you also have your rules files in place. – cutrightjm Jun 12 '17 at 17:28
    
How would I get the beginning ot HOME_NET then? ifconfig shows me this ip and the loopback ip – mkli90 Jun 12 '17 at 17:28
    
ifconfig is showing you your gateway, which is the first usable IP in your rangle. The 176.9.103.96/27 is your network identifier/address, which tells snort what all possible IPs are in your subnet, from beginning address (network) to the end (broadcast) – cutrightjm Jun 12 '17 at 17:30
    
To your question on the forwarding: Well basically it is a server I got from another company, which assigned me this ip address. I do not have access to the other machines in my subnet, just my own and therefore I also only want to monitor the traffic coming into my machine. Not everything coming to the subnet is of course coming to my machine, but well I want the stuff which comes to my station. – mkli90 Jun 12 '17 at 17:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.