I have setup Snort with the registered user rules installed. I tested first by making the following rule in local.rules:

alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:001;)

That rule works fine, and I tested a TCP rule as well which also worked.

The problem I'm having is that I'm expecting snort to produce an output when snort -A console -q -i eno16780032 -u snort -g snort -k none -c /etc/snort/snort.conf is run

Again, I can see the output from my ICMP rule in local.rules, I just can't see anything when I run ./IDSwakeup xxx.xxx.xxx.xxx 1 1 from another PC. (All rules under part 7 are uncommented, part 8 and 9 are left commented)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.