Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have just installed Security Onion distro based on ubuntu. This distro does a great job of combining multiple tools like snort/suricata,sguil,snorby,elsa,bro ids,squert. In my Security Onion installation interface has been port mirrored. But all the alerts I have seen are from source IP of our local network, both private and public. I could see outside ip's in elsa or squert pads data, but not in the snorby alerts. seems little strange to me, as there has been a known dos attempt wid an outside ip. My bpf also not stopping any outside ip as well. Wondering possible reasons for such behaviour .

cat /etc/nsm/rules/bpf.conf !(dst portrange 11000-65000) && !(src net && !(src net !(src net

share|improve this question
I can probably answer this for you if you provide a small diagram and your IP scheme. Do you NAT both ways? Where is the sensor located in your architecture? – dc5553 May 12 '13 at 8:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.