Snort Install on Windows 7

[@SteveGantz]

I created this tutorial to help students in my Intrusion Detection and Prevention class at UMUC, where I am an adjunct professor. I am glad students in other schools are finding it helpful.

[@compujourney]

Thannks so much for this! Up and running!

[@kimnoussa864]

Thks from Tunisia :)

[@11992azer]

Steve Gantz and in other coutries even !

[@majilique]

I'd like thank you for your video. I'm a student of Information Security and Snort is a major program that we are taught to use and troubleshoot. Our final project is Snort with Kiwi Syslog Server & Viewer and the instructions we were given are several years old. You save me a huge headache. Thank You!

[@jeremycanfield8530]

This is a wonderful, well made, perfectly paced, tutorial. A sure am glad your professorism is, adjunct :)

[@xiomigeraldineegusquiza703]

Hi, I want to know about.. in teh console says: could not create the registre key. What's the problem?

[@davefroh579]

Steve, this is one of the best tutorials I've ever seen. Great job. Have you tried using Snort's pulledpork add-on for automatic rule updates?

[@TheRubanramesh]

Hi All, Below is the documentation i have done while installing Snort on windows 7 32 bit. Thought this will help some one. Thank Steve, for this wonderful tutorial it worked like charm :) # How to install snort in Windows # Assuming snort installed in d:\snort Step 1: Downloads Download snort installer Download rule files Step 2: Extract Rules Files ( zipped file ) Copy all the files in rules folder except license file to path where snort installed. Ex : D:\Snort ules and paste it here. copy all the prepoc rule files to snort installed location Ex: D:\Snort\prepoc_rules copy all the etc folder files to snort installed location Ex: D:\Snort\etc Note: Alert the rules will be written in Snort ules\local - local file. Step 3: Edit snort.conf file ( configuration file ) Major Divisons: This file contains a sample snort configuration. # You should take the following steps to create your own custom configuration: # # 1) Set the network variables. # 2) Configure the decoder # 3) Configure the base detection engine # 4) Configure dynamic loaded libraries # 5) Configure preprocessors # 6) Configure output plugins # 7) Customize your rule set # 8) Customize preprocessor and decoder rule set # 9) Customize shared object rule set 1) Set the network variables. Change the Home network Details Here. # Setup the network addresses you are protecting ipvar HOME_NET 192.168.0.0/16 # Set up the external network addresses. Leave as "any" in most situations ipvar EXTERNAL_NET !$HOME_NET # Note for Windows users: You are advised to make this an absolute path, # such as: c:\snort ules var RULE_PATH d:\snort ules #var SO_RULE_PATH ../so_rules - This is shared object rules, will be used later. var PREPROC_RULE_PATH d:\snort\preproc_rules 2) Configure the decoder This will enable logging directory # Configure default log directory for snort to log to. For more information see snort -h command line options (-l) # config logdir: d:\Snort\log 3) Configure the base detection engine - No change Required 4) configure dynamic loaded libraries # path to dynamic preprocessor libraries dynamicpreprocessor directory d:\Snort\lib\snort_dynamicpreprocessor # path to base preprocessor engine dynamicengine d:\Snort\lib\snort_dynamicengine\sf_engine.dll # path to dynamic rules libraries # dynamicdetection directory /usr/local/lib/snort_dynamicrules ( This is diabled as we don't use it ) - Not using Shared Object Rule hence disabled 5) Configure preprocessors Snort doesn't work in Inline mode for windows, hence disbaled below option # Inline packet normalization. For more information, see README.normalize # Does nothing in IDS mode # preprocessor normalize_ip4 # preprocessor normalize_tcp: block, rsv, pad, urp, req_urg, req_pay, req_urp, ips, ecn stream # preprocessor normalize_icmp4 # preprocessor normalize_ip6 # preprocessor normalize_icmp6 Port scan preprocessor is opened # Portscan detection. For more information, see README.sf portscan preprocessor sfportscan: proto { all } memcap { 10000000 } sense_level { low } change to windows path variable and this white.list and black.list files should be created in d:/snort/rules # Reputation preprocessor. For more information see README.reputation preprocessor reputation: \ memcap 500, \ priority whitelist, \ nested_ip inner, \ whitelist $WHITE_LIST_PATH\white.list, \ blacklist $BLACK_LIST_PATH\black.list 6) Configure output plugins - No Changes made 7) Customize your rule set Consist all the rule set, change to windows environment variables 8) Customize preprocessor and decoder rule set - Enable all the preprocessor and change to windows environment variables Make Sure below is enabled # Event thresholding or suppression commands. See threshold.conf include threshold.conf ##Checking for configuration: 1.Open cmd with admin previlege 2. Go to d:\snort\bin enter : snort -V ( if installed correctly it should give the version details ) D:\Snort\bin>snort -V ,,_ *-> Snort!

[@DamianXvolt]

Have to say thanks a million for the tutorial as this helps students trying to get into this and alleviates the frustration when you start. Had some issues but I managed to figure out how to fix them basically making sure the lines made sense. Now will look at forwarding snort info to a SIEM such as AV. ossim. Can you recommend one? Syslog? Thanks again!

[@SteveGantz]

The choice of SIEM or monitoring tool really depends on what you are trying to accomplish. I tend to use a syslog server with Snort on Windows, because it's very straightforward to do so, especially with a standalone Snort instance. Tools like OSSIM are great when you have multiple alert sources or data streams coming in, but the setup is a little complicated just for watching Snort.

[@DamianXvolt]

Steve Gantz yes just trying to test a siem tool nothing really big, as long as I see my siem seeing activity from snort im happy. I had it but did not see any snort activity so i guess that was because i dont have syslog.

[@haniefharun]

got this error when i running snort -i 5 -c c:\Snort\etc\snort.conf -A console -T ERROR: c:\Snort\etc\snort.conf(0) Failed to parse the IP address....... Fatal Error, Quitting.. Could not create the registry key.

[@minaatif7713]

mee too

[@SteveGantz]

The registry key error can occur if you run Snort with insufficient privileges on your computer. Make sure you open the Windows command shell as an administrator; you can go to Start -> All Programs -> Accessories -> and then right-click on Command Prompt and choose "Run as administrator".

[@alanswan8139]

Steve Gantz I'm having the same kind of issues and even when I run the command prompt as an administrator, I still get the same error "ERROR: c:\Snort\etc\snort.conf(0) Failed to parse the IP address....... Fatal Error, Quitting... There is no mention of a registry key in my error. The IP address isn't the same as what I've set in the conf file. Any help with this would be much appreciated. Should also mention that the actual test process using -T works fine and with a successfully validated configuration. It only errors when I try to run the alert process you demonstrated for ICMP, UDP and TCP.

[@sruthic3477]

Thank you sooo much Sir..We got it.Thanks alot..Keep posting videos about the working of snort

[@uuansv8582]

Greeting, Thank you very much for sharing this wonderful video. I am new to Snort and the video gave me a great start.

[@colaguspe]

Thanks for the video! It will helps me so much with my graduation project. I have a question, there's any diference on Snort Rules: Subscriber Realease and Registred User Realease? I've downloaded the Registred User Realease because i'm not a Subscriber. Sorry for my bad english.

[@matthewbennett8510]

Thank you for this vid it helped me a ton I was about to give up and found this it got snort up and running now i just need to conf it to fit my needs thank you

[@SteveGantz]

An error message about creating a registry key usually results when you attempt to run Snort with insufficient privileges. Try launching the Command Prompt with "Run as administrator" before you navigate to c:\Snort\bin and run the program.

[@ArchGroot]

+Steve Gantz i think shreya get the error because was editing "c:\lib\snort_...." instead of "c:\Snort\lib\..." :) and of course that directory didn't exist!

[@SteveGantz]

+Vasi Petcu yes, you're correct. The paths in snort.conf reflect typical values on Linux or UNIX, not Wndows. It's a good idea to use full absolute paths with Snort on Windows, but of course the values you assign to the path variables have to be the actual directory or file locations on the computer.

[@jaydutt6593]

In the video you test snort for the very 1st time at 13:12... when I try to run snort I get the error message:ERROR: Invalid device number: 5Fatal Error, Quitting.. How can I get around this?PS: I'm a newbie... a very very newbie... Please help

[@SteveGantz]

If you look back at around 5:00 you will see I ran a command "snort -W" to list out the available interfaces on the computer. In my case the network interface I want is number 5, but on most computers interface 2 or 3 is more likely to be the right one. The error you got is because you don't have a fifth interface. Try first to see what interfaces are available and then re-run the startup command with an interface number appropriate for your computer.

[@nileshmanit5178]

how to inject malicious code in the system..suggest some tools for DoS attack

[@renukakhorate5404]

Hello, can we write rules for ICMP to check, for example "Type: Destination Unreachable" and its sub types ?

[@SteveGantz]

Renuka Khorate You can match on any ICMP type value or icode value (or a range, or a value greater or less than a specific number) within a rule with the itype: option keyword. Look at the Snort online manual (sections 3.6.14 through .18 describe common ICMP options).

[@renukakhorate5404]

Thanks. I corrected the interface no. now its working. Here, can I work on the string pattern matching algorithm in Snort? How can we change the algorithm?

[@SteveGantz]

I'm not sure what you mean by changing the algorithm for string pattern matching. Snort already provides a lot of flexibility for matching content in packets, with or without normalization by one or more preprocessors. The Snort manual gives detailed explanations and examples for various pattern matching approaches to be used in Snort rules.

[@nisaaulianurhasanah3952]

Thank you sir this tutorial really helps me in making task about IDS and IPS. I've followed all the step in this video, making white.list file etc but when I ran snort I got: Unable to open address file c:\snort ules\white_list, Error: No such file or directory Fatal Error, Quitting... I wonder if you could help me to find out the problem? I really need your help sir. Thank you.

[@SteveGantz]

***** Make sure when you open the Windows command shell that you Run as administrator. Snort requires admin privileges to run, so a registry error like this typically means you are running cmd as a regular user.

[@SteveGantz]

Both this video and the more up to date one referenced in the description show the use of the Windows command shell. To run this as an administrator, simply right-click on the program name (Command Prompt) and choose "Run as administrator"

[@navjotgill1193]

i am getting the error invalid configuration line \snort_dynamicpreprocessor. please help me out

[@maheshmalav1088]

Hi Steve, Thanks for providing such an in depth video.I followed the steps mentioned in your video but I am facing a situation. When I run the snort -i 2 -c c:\Snort\etc\snort.conf -A console command, the scanning process goes on for more than 2 hours without any signs of completion. Could you let me know how to go about this problem. Your help will be greatly appreciated. Thanks in advance.

[@SteveGantz]

It's not clear what you mean by "signs of completion" - when you start Snort, the last thing you will see on-screen is the message "commencing packet processing". Snort will continue running until you act to kill the process. What you would typically expect to see when directing output to the console is the alerts generated by the rules you have loaded. If Snort starts without any errors and you don't see any alerts, you either don't have your rules loaded or you have Snort listening on the wrong interface. Have you verified that interface #2 is the correct one for you system?

[@travisatwork01]

I want to thank you for creating this video.

[@Nikkodabeast4ever]

Thanks for this nice tutorial. Do you mind if i show this in a class that i am a TA in?

[@SteveGantz]

By all means. I created this tutorial primarily to help students in a graduate course on intrusion detection and prevention at UMUC. I would be happy to hear that students in other courses or institutions find the video useful.

[@renukakhorate5404]

Thank you,Sir. I added ICMP rule in c:\Snort ules\local file and run command, snort -A console -i 2 -c c:\Snort\etc\snort.conf -l c:\Snort\log -K ascii to get ICMP log file in folder but only getting UDP file in the folder and ERROR: OpenLogFile() => mkdir(c:\Snort\log/fe80:0000:0000:0000:8deb:18af:4fd4:2d78) log directory: Invalid argument Fatal Error, Quitting.. Not getting where the problem lies?

[@SteveGantz]

Renuka Khorate The error you are seeing is produced by a combination of IPv6 implemented in Windows and the -K ascii option in Snort. Basically, Snort tried to create a logging subdirectory for each "conversation" between a source and destination IP address. Normally this shows up as conventional IP addresses (such as 192.168.x.x) but on a computer using IPv6, the IP address is expressed in hex notation. The colon : characters in the IPv6 address cannot be used as part of a file or directory name on Windows, so you get this error. Try removing the -K ascii option to see if Snort will run without it.

[@sefaozi1298]

What ip adresses should i write in white.- and black.list?

[@renukakhorate5404]

I found one research paper in that algorithm for reducing false alarms we can improve the performance of IDS is given. I'm trying to implement it. But don't know how to go ahead using snort rules, is it possible?.

[@SteveGantz]

If you are looking to fundamentally change the detection algorithm in Snort, that goes far beyond writing some rules. Snort is an open-source tool, so you would in theory be able to modify the algorithms the tool uses, but any such attempt would require some in-depth knowledge of C and some advanced programming skills. Also, the version of Snort that runs on Windows is pre-compiled, so if you want to modify the source code you would need to re-compile from source. If this type of customization is within your capabilities you should probably be working with Snort on Linux.

[@thatothergolfer]

You mentioned that inline mode does not work in Windows, is that still true? Can snort be ran in IPS mode without inline? or is it only used to monitor traffic instead of preventing? Can snort be used as an IPS on a Windows system at all? Sorry if these questions are a bit repetitive.

[@SteveGantz]

There are Snort options used for inline mode that can be run in Windows, but configuring Snort to run inline as an IPS is, if not completely infeasible technically, nonetheless very challenging. To run Snort as an inline IPS you need at least two network interface cards (three is recommended) and two NICs need to be bridged together, configured with non-routable addresses. On Linux you typically would also configure traffic routing for the interfaces using iptables, but there is no equivalent utility in Windows. There are several IPS preprocessors than can be turned on in Windows to simulate inline mode, but in a production deployment if it is likely best to go with Linux for Snort.

[@JasminderPalSingh]

Thanks for detailed tutorial sir.

[@lesliecirux]

hi Steve Gantz i did everything you did on your tutorial but at the part of mine which says "commencing packet processing " it just stops there and doesnt do anything more..why? thank you

[@SteveGantz]

Seeing the message "commencing packet processing" means that Snort is running. If you have not directed output to the screen (such as with the "-A console" startup option then you will not see any activity on screen, but Snort may very well be logging to disk all the same. If you did direct output to screen but still don't see anything, you should check to make sure you are pointing Snort to the correct network interface on your system. It is possible that Snort starts up listening to an inactive interface, in which case you won't see any output.

[@anirudhsrinath4224]

The error that is being displayed for me is can't set DAQ BPF filter to the path I had given ..I followed the instructions verbatim .Kindly suggest the solution for this

[@SteveGantz]

A BPF error such as you describe usually means you left out an option indicator in your startup command or used the wrong letter. You didn't include the actual error you received so I am speculating here, but please check to be sure you precede the path of the snort.conf file with -c (it has to be a lowercase c and there has to be a space between the c and the start of the path).

[@chandrikasunil4656]

When I run snort I am getting the following error. Please let me know where I am going wrong? pcap DAQ configured to passive. The DAQ version does not support reload. Acquiring network traffic from "0". ERROR: Can't start DAQ (-1) - h♀▓☻! Fatal Error, Quitting..

[@SteveGantz]

It's hard to say for sure what the problem is without seeing your startup command, but the error message implies that Snort cannot access an interface on which it is trying to listen. It is important on Windows to specify the network interface Snort should use, with the -i # option (where you replace the # with the number of the interface you are trying to use. If you are not sure which interface should be indicated, run snort -W from the command line to see a list of available interfaces.

[@seektherapy70]

:( I thought I was getting it. Would you happen to have a copy of a configured snort.conf file along with with alert rules and program cmd commands, to compare with what I used. Very nice and informative video :)

[@prasannatekumudi100]

I configure the snort, while doing this i got an error that " Initializing rule chains... ERROR: c:\snort ules/local.rules(21) Port value missing in rule! Fatal Error, Quitting... " where i did wrong? how to fix this problem?

[@SteveGantz]

The standard syntax for all Snort rules begins with the rule action (such as "alert") then the protocol (one of ICMP, UDP, TCP, or IP) and then an IP address value and port value for both source and destination. For example: alert ip any any -> any any It sounds like you left out the port value for either the source or destination.

[@raffiemohd6626]

Hi Steve, I got 1 problem and 1 question. I really hope you can help me. Problem: When I try the local.rules, it cannot detect anything. All TCP, UDP and ICMP activities cannot be detect by my snort. Question: How can I turn my snort into Anomaly based / behavior based snort?

[@SteveGantz]

If you have Snort running with testing rules loaded but see no alerts, you need first to make sure you are directing output to the screen (with -A console in your startup command) so you can see any alert activity. If you still see nothing, you may be listening on the wrong interface - verify what interfaces you have available with the command snort -W (it has to be a capital W) and make sure you start Snort you are designating the right interface with -i # (replacing the # with the number of the interface you want).

[@SteveGantz]

To your question about anomaly-based intrusion detection, Snort is a signature-based IDS tool, so you would need to look for a different solution if you want to do anomaly-based or behavioral analysis. Bro IDS is a popular option, although it doesn't run on Windows, only Linux/Unix.

[@raffiemohd6626]

Steve Gantz Thank you for your prompt reply. In terms of the detection, I've found research papers using anomaly based snort for their project but the authors didn't state how to turn snort into anomaly based. I was hoping that you could assist me regarding this matter.

[@renukakhorate5404]

Thanks for immediate reply but Sir I tried the same command few days ago it was creating one folder in c:\Snort\log with separate files for tcp,udp,ICMP but now its giving fatal error and only file for udp.

[@SteveGantz]

Snort creates directories as needed based on the traffic it sees as it runs, so if it throws an error before it processes other kinds of traffic you won't see logs for them. What is the fatal error you are getting?

[@renukakhorate5404]

Steve Gantz Hello Sir,when I give this commandC:\Snort\bin>snort -A console -i 2 -c c:\Snort\etc\snort.conf -l c:\Snort\log -K ascii output of Snort was a folder with files for tcp,udp,icmp but now in the folder only file for udp and this error Commencing packet processing (pid=4564) 04/21-06:53:44.728912 [**] [1:1000002:0] UDP testing rule [**] [Priority: 0] {UDP} 0.0.0.0:68 -> 255.255.255.255:67 04/21-06:53:44.759978 [**] [1:1000002:0] UDP testing rule [**] [Priority: 0] {UDP} fe80:0000:0000:0000:8deb:18af:4fd4:2d78:546 -> ff02:0000:0000:0000:0000:0000 :0001:0002:547 ERROR: OpenLogFile() => mkdir(c:\Snort\log/ff02:0000:0000:0000:0000:0000:0001:0002) log directory: Invalid argument Fatal Error, Quitting.. Could not set the event message file. C:\Snort\bin>

[@SteveGantz]

That output shows that Snort is starting up properly and begins to generate alerts from a UDO testing rule. The error occurs when Snort tries to create a log subdirectory using an IPv6 address, because that representation has colons in it and Windows will not permit a file or directory name that contains a colon. This is why I recommended that you remove "-K ascii" from your startup command.

[@Serbiansword]

Thank you very much for this tutorial, it really helped me a lot!

[@00011theman]

I keep getting ERROR: log_tcpdump: Failed to open log file "log/snort.log.1391550775": Result too large D: Couldn't find anything on Google about it either.

[@renukakhorate5404]

Very nicely explained. But not getting any alert everything 0% though I checked interface no.s using -W.

[@SteveGantz]

Seeing alerts on screen requires 1) listening on the right interface, 2) having some rules loaded for Snort to use on packets, 3) directing output to the screen or to a monitoring tool like syslog so you can see alerts as they happen, and 4) performing some activity that generates the right kind of network traffic.

[@KenPryor]

Very nice. Thanks for this excellent tutorial.

[@hiwalesushant]

Is there a way to view log (c:\Snort\log) files on command prompt. I tried to open them in word, wordpad, notepad but it just displays some characters that make no sense

[@SteveGantz]

Standard Snort log output is not easy to read with a text editor. The easiest thing to do is to add "-K ascii" to the startup command to have Snort write the log output in ASCII format. Then you should be able to read it in Wordpad or Notepad.

[@PrivateBeastly]

Excellent video. I've installed Snort on Ubuntu, but never on Windows. Process was much the same, however, Snort does not see my eth0 interface. Any hints on how I can troubleshoot?

[@SteveGantz]

When running on Windows you specify interface by number alone, starting from 1, not as eth0, eth1, etc. Depending on the setup of the computer you are using, there may be multiple available interfaces. You can check which interfaces Snort recognizes by running snort -W from the command line (it has to be a capital W). Then in your startup command use the -i # option (replacing the # with the appropriate interface number). If you see that part of the video you will notice that I am using interface 5, but that is not typical -- on most desktop Windows OSs it will be 1, 2, or 3.

[@PrivateBeastly]

Steve Gantz By eth0 I meant my default network interface. I actually have two interfaces, one wired and wireless. The wireless is seen by Snort but the wired interface is not.

[@SteveGantz]

If you want to force Snort to listen on the wired interface, then you could disable the wireless interface. If the wired is the only one available, then running Snort with -v in the command line should listen on the first (in this case only) available interface. Snort depends on WinPcap to actually read packets from the network interface, so it is important that the Netgroup Packet Filter (NPF) driver is started on your system. Typically it starts by default once you have installed WinPcap (or Wireshark or another tool that installs the driver for you), but you should verify that the NPF driver is active.

[@PrivateBeastly]

Steve Gantz I figured it out... my virtual network adapters were bridged to my host and confusing me. Removed those and the only thing left was the Ethernet adapter. Thanks again for an excellent video! Funny, it took me days to get Snort up and running on Ubuntu, but on Windows it took ~15 minutes!

[@arthurmailloux9244]

how do we send results - syslog? to a SEIM?

[@SteveGantz]

That depends on your SIEM. Many monitoring tools can read syslog data, so if you ran Snort with syslog output you could just point the SIEM to the syslog events. You could also output pcap or plain text logs and have the SIEM tool read those in. Some SIEM tools, such as AlienVault (which embeds an OSSiM agent) can read unified2 output directly from the Snort log directory, but that is not a universal feature.

[@MrDuckay]

Hi Steve, great video! However, I was hoping you could help me as I'm currently getting this error after entering the snort -i 5 command without -T: The DAQ version does not support reload. Aquiring network traffic from "0" ERROR: Can't start DAQ -1 - a\>>..! Fatal Error, Quitting.. Pleae bear in mind that I do not have any physical networks connected when I enter Snort - W. Thank you

[@SteveGantz]

There are a couple of potential problems with how you are running Snort. First of all, the "-i 5" interface option designation in the video must be tailored to your environment. If running snort -W does not return any active network interfaces, then you can't run Snort, because at least one interface has to be enabled for packet capture to function. What is more common is that you have one or more interfaces available, but not 5, so when Snort looks for the fifth interface it cannot find it. Try the startup command again replacing the 5 with a number corresponding to a valid interface on your own computer.

[@hptc4400]

Hi Professor, Please help when you can... I followed the steps as best as I can however, when I ran snort I got the following error: ERROR: c:\snort\etc\snort.conf(45) Missing argument to 10.11.0.0\23

[@SteveGantz]

The line 45 referenced in the error is typically where the HOME_NET variable is declared. This line has a very specific format: the variable declaration keyword "ipvar" followed by the variable name "HOME_NET" followed by the IP address or range. Make sure you have all three elements. Also, if you are using CIDR notation then the slash should go the other way: 10.11.0.0/23. If this is your specified range then line 45 should read: ipvar HOME_NET 10.11.0.0./23

[@hptc4400]

Steve Gantz Thanks for the advice Professor, I will implement the code when I return to the office tomorrow please God and keep you abreast...

[@hptc4400]

Steve Gantz Thanks Professor it worked...

[@jesusarellanosanchez93]

Hii, im having an error when i try to open the console. After checking the rules, shows up this message "ERROR: log_tcpdump: Failed to open log file "c\Snort\log/snort.log.1449743171": Fatal Error, Quiting..." What can i do? Thanks a lot by the support, by the way.

[@SteveGantz]

+Jesus Arellano Usually this error can be resolved by making sure you have specified a log directory location in snort.conf (at the end of Step #2) with the line that begins: "config logdir:" where the typically path on Windows is c:\Snort\log. If that doesn't resolve the error (or if you already had the logdir path set), you can try starting Snort with an explicit logging path as part of the startup command. To do this, add "-l c:\Snort\log" to the command (that's a lowercase L after the - sign).

[@kimberlywatson3964]

During test I entered the command: c:\Snort\bin>snort -i 1 -c c:\Snort\etc\snort.conf -A console. However, I receive the following error: c:\Snort\etc\snort.conf Unknown rule type: memcap. Fatal Error, Quitting...

[@SteveGantz]

Check the preprocessor configurations in Step #5 of snort.conf. There are four places in the conf file where memcap settings are used, but the most likely locations for the issue here are the DNP3 or reputation preprocessors (two of the last entries in the snort.conf preprocessor section). If you choose to disable a preprocessor, make sure you comment out every line in the configuration. Both DNP3 and the reputation preprocessor have a second line that starts with memcap - if you comment out the first line but not the others, Snort tries to read the next line and throws an error when it encounters memcap at the beginning of a line.

[@kimberlywatson3964]

Steve Gantz AWESOME! Up and running. Thank you so much :-)

[@raaj533]

Hiii, I m facing problem while running IDS in snort. When I run Snort in IDS mode, it was unable to initialize rules and show the message "0 Snort rules read, 0 detection rules, 0 decoder rules, 0 preprocessor rules, 0 Option Chains linked into 0 Chain Headers 0 Dynamic rules and alerts file in log is also of 0 KB means no alert is their in alerts.ids file. Please suggest the solution for this error. Thanks in advance:

[@SteveGantz]

It's hard to identify the cause without knowing how your snort.conf file is set up and the startup command you are using. The zero rule counts suggest you are either not pointing Snort to the rules you have installed or that you have not deployed a rules package with your installation. You point Snort to the rules within snort.conf, so it is also essential that you load the conf file in your startup command, typically with -c c:\Snort\etc\snort.conf.

[@raaj533]

Thanks for quick reply and snort.conf attached

[@SteveGantz]

raaj533 There are a lot of syntax problems in your conf file. You might want to follow the steps in the video more closely. Specifically:In Step #1 RULE_PATH declaration has the slashes reversed (i.e., should be c:\Snort ules); same applies to PREPROC_RULE_PATH. Snort may ignore the slash direction and read the directories anyway, but you need to make sure there are rules in those locations if you want Snort to load them.In Step #4, the dynamicpreprocessor directory declaration is commented out, which will effectively prevent any preprocessors and their rules from loading. Also, the dynamicengine location declaration has a trailing \, which is incorrect (the line points to a single file, not a directory).In Step #7 (and the end of Step #6) you seem to have added \ characters at the end of just about all the include statements in your conf file. That character tells Snort to treat the following line as part of the same line that preceded it, which means those include statements will not be read as separate commands. This might also explain why no rules are loading.In Step #8 all the lines are commented out. They should be enabled.

[@raaj533]

Steve Gantz I configured snort.conf file as per video and this time I got error as ERROR: c:\Snort\etc\snort.conf(509) => Too many parameters for option in Session config. Fatal Error, Quitting.. Pl. suggest

[@raaj533]

Steve Gantz Now I again tested and found that Snort successfully validated the configuration! Snort exiting At the same time it shows that +++++++++++++++++++++++++++++++++++++++++++++++++++ Initializing rule chains... 0 Snort rules read 0 detection rules 0 decoder rules 0 preprocessor rules 0 Option Chains linked into 0 Chain Headers 0 Dynamic rules +++++++++++++++++++++++++++++++++++++++++++++++++++

[@dimpleharsh4325]

when i run on cmd window then an error comes...Unable to open rules files"Snort\etc\snort.conf":Invalid argument.. can you please help me in this...i am student and trying ti install for my project work...ASAP

[@SteveGantz]

On Windows all your paths should be fully specified, including the c:\. Also, each command line option needs a - in front of it, such as -c before the path to snort.conf.

[@renukakhorate5404]

If I remove -K then it gives ERROR: Can't set DAQ BPF filter to 'ascii' (╘=P)! Fatal Error, Quitting.. Could not set the event message file.

[@SteveGantz]

The word "ascii" is an argument of the -K option, so if you remove -K from the startup strung then you have to take out the whole "-K ascii" option.

[@ailtianao8736]

think you so much it worked i have another question supposing that i want to install snort on ubuntu VM which version should i choose i tryed once to do it on ubuntu 14.04 LTS but when i runed the command # apt-get install snort-mysql i got this message: package snort-mysql is not availabe,but is referred to by another package,thi mean that the package is missing, has been obsoleted,or is only availabe from another source. thinks

[@SteveGantz]

You should be able to use any version of Ubuntu, although 12.04 is most common with VMware. You can find step by step instructions for setting up Snort on a Ubuntu VM at www.securityarchitecture.com/learning/intrusion-detection-systems-learning-with-snort/installing-snort-on-linux/

[@shoortey1338]

Mine is stuck loading on "Commencing packet processing . What can i do to fix this?

[@SteveGantz]

That's not stuck, that's Snort running. If you are directing output to the screen then you will see alerts start to appear under the Commencing packet processing message. If your output is going to syslog or just being written to logs without screen output, you will need to look in the output destination.

[@shoortey1338]

Oh yea haha. But how do i open the log file? in the log section

[@SteveGantz]

By default, Snort log files on Windows will be in c:\Snort\log. Depending on how you want to view/use them, you can direct Snort to output alert and log data in binary (by adding -b to the startup command) or ASCII formats.

[@shoortey1338]

Steve Gantz Ah thanks Steve, really good Guide also :)

[@sarrachtouka5172]

please can i use snort 2.9.7.0 on windows 8 i cant find any documentation about it. think you

[@SteveGantz]

Yes, the Windows installer on snort.org will work on Windows 8/8.1. The configuration steps and actions to run Snort from a Windows command she'll are the same as for Windows 7.

[@mhammo1093]

I got it to run but when I went to test the alerts it says: Commencing packet processing. And nothing happens...

[@SteveGantz]

If you see Commencing packet processing then Snort is running. You won't see anything on the screen until the tool alerts on something, and even then you only see it there if you direct output to the screen, such as by using -A console in the startup command.

[@mhammo1093]

My problem was that I was not using the correct network. I was using -i 4. I needed to be using - i 1. Also, my homework assignment states to create a rule that alerts me when I go to Google.com. How would I do this?

[@SteveGantz]

Mike Hammond I teach a class on using Snort where students are asked to something very similar, so I won't post a complete answer to your homework here. However, I suggest you take a look at the Payload Detection Rule options section of the the current (Snort 2.9.6) manual on snort.org.

[@ninis7thira13]

Hi! I followed all the steps and I have this message: Warning: no preprocessors configured for policy 0. The preprocessor rules are enabled in Step #8 of the config file. So, what can I do? Thank you

[@SteveGantz]

Anastasia What startup command are you using? Make sure you include the reference to the configuration file with -c c:\Snort\etc\snort.conf

[@ninis7thira13]

But this message is displayed when I use the command: snort -vde

[@SteveGantz]

Anastasia That makes more sense. Using snort -v, alone or as -vde, tells Snort to run in packet logger mode. if you want Snort to load and run your configuration you have to run in IDS mode, not packet logger mode.

[@ninis7thira13]

that makes sense! So, for the IDS mode and the sniffer mode, I have to use the commands: snort -v -i#, snort -W, snort -V and nothing else?

[@hiwalesushant]

First I would like to thank you for the tutorial it has been a great help in understanding IDS. I installed Snort v2960 but when I checked the availabe interface via Snort -W in the command line I get a blank table with no Physical address or IP address. I checked the system info, the network adapter it shows Adapter Type Not Available Product Type WAN Miniport (SSTP) Installed Yes PNP Device ID ROOT\MS_SSTPMINIPORT\0000 Last Reset 3/18/2014 12:22 PM Index 0 Service Name RasSstp IP Address Not Available IP Subnet Not Available Default IP Gateway Not Available DHCP Enabled No DHCP Server Not Available How should I proceed now?

[@hiwalesushant]

Proceed with snort -i 0 -c c:\Snort\etc\snort.config -A console -T it says Snort successfully validated the configuration exiting

[@SteveGantz]

What you are describing suggests your computer has a network interface but at the time you were working with Snort you were not connected to a network, so the interface had no IP address assigned. Snort will validate configuration with no interface (which you indicated with -i 0 in your startup command). Bear in mind that you can run the program this way too, but without an active network interface there will be no traffic captured and therefore there can be no output produced from Snort.

[@rashedulislam2671]

let me know the program - interface command for core 2 duo ( 13.00 min)

[@SteveGantz]

The interface designation is not specific to a processor or OS, but depends on how the computer is configured where you run Snort. Typing the command "snort -W" (has to be an uppercase W) will return a numbered list of all interfaces available to Snort. You designate the appropriate network interface with the -i switch in the startup. In the video it is interface #5 because the machine I was using has a lot of active interfaces; on most Windows computers interface #2 or #3 is more common.

[@rashedulislam2671]

thank you

[@ailtianao8736]

good morning i have 2 problems when i run thus command :snort -W i get an umpty table and when i run this command : Snort -i eth -c c:\Snort\etc\snort.conf -A console i get thi error message pcap Daq configured to passive The DAQ version does not support reload thinks

[@SteveGantz]

If snort -W does not return anything you need to check to make sure you have at least one interface enabled and that you have the NPF driver (that is, WinPcap) installed and running on your system so that Snort can "see" whatever interfaces you have. In your startup command, you need to put an actual number after the -i to designate the interface on Windows; designations like eth0 are used on Linux but not Windows.

[@Cboogie1199]

Hey steve, First of all, thank you for the tutorial. I followed your instruction and snort was configured successfully but when I did the local.rules bit it gave me an error c:\Snort ules/local.rules unmatch quote in rule option "msg" Fatal error quitting could not create registry key Can you please help me out?

[@SteveGantz]

Check your rule syntax. Wherever you use a msg option (to set what message is displayed for an alert) the text of the message needs to be enclosed in quotes. Sounds like you have an opening quote without a close-quote or vice-versa.

[@ruymc6145]

Hi Steve :)) When i run this command line "snort -i 5 -c c:\Snort\etc\snort.conf -A console -T" i got this error message: "Error: c:\Snort\etc\snort.conf(514) => Unable to open address file c:\Snort ules\black.list, Error: No such file or directory" How can i fix it? Thanks!!

[@SteveGantz]

If you have the reputation preprocessor enabled in Step #5 of snort.conf then the whitelist and blacklist files specified in that configuration have to exist (they can be empty files, but they have to be there). You can use Notepad or any other editor to create a new file called "black.list" and "white.list" (or anything else you want to name them - just make sure it matches what is in your preprocessor configuration). Put them in the c:\Snort ules directory. If you use Notepad, be sure to use Save As... when you save the file so you can make the filename exactly what you want it to be (without Notepad adding a .txt extension).

[@ruymc6145]

Steve Gantz Thanks Steve! it works very well :))

[@fcbomex]

MR STEVE help please i have that problemelog_tcpdump failed to open log file "log\snort.log.1462156687"

[@SteveGantz]

+kimo qib As you should see in responses to others reporting this same message, you should confirm that you have specified a correct log directory in Step #2 of snort.conf. You can also specify the directory as part of the startup command using the -l option (that's a lowercase L), such as by including "-l c:\Snort\log" in your startup command.

[@alibachir8441]

Thank you so much Professor, it has been really useful ! But my only problem is that when I run Snort, it blocks on " Commencing packet processing ", I've waited 1 h, but it doesn't seem to work.. Any suggestions ?

[@SteveGantz]

Seeing the message "commencing packet processing" means that Snort is running. You also need to have one or more detection rules active if you expect Snort to generate any output, but even with the rules loaded you may not see anything on screen. Specifically, if you have not directed output to the screen (such as with the "-A console" startup option) then you will not see any activity on screen, but Snort may very well be logging to disk all the same. If you did direct output to screen but still don't see anything, you should check to make sure you are pointing Snort to the correct network interface on your system. It is possible that Snort starts up listening to an inactive interface, in which case you won't see any output.

[@Fenrir555]

When attempting to run the test, I get this message. "ERROR: Can't set DAQ BPF filter to c:Snort\etc\snort.conf -A console -T, Fatal Error, Quitting."

[@SteveGantz]

I think you may have omitted the "-c" switch in your startup command, which should come before the path to the snort.conf file. If Snort encounters a string in the startup command that is not associated with an option indicator it interprets the string as a BPF filter.

[@Fenrir555]

Steve Gantz I included the "-c" in the startup command as shown at 13:17. Still getting the error message. May try reinstalling Snort and starting over again, and see what happens.

[@kstorm93]

This is a great video sir.. thanks for sharing.

[@pardeepbhandari9847]

i installed snort, validated it worked fine for a day but now its giving error which says "ERROR :can't set DAQ BPF filter to c:\snort\etc\snort.conf -A console" . Can anybody help????

[@SteveGantz]

Make sure you preceded the snort.conf path with the option -c (has to be a lowercase c).

[@kimnoussa864]

hello, when i wanted to test Snort , it says :ERROR Invalid device number: 5 , can you please explain to me what it means ??

[@SteveGantz]

In the Snort startup command, you specify which network interface Snort should use to capture data with the -i # option, where # should be replaced with the interface number you want to use. In the video I am using interface #5, but not all computers have the same interfaces available, so you need to substitute the interface number for your own computer. You can see a list of available interfaces by running "snort -W" (it has to be a capital W) from the command line.

[@kimnoussa864]

Steve Gantz thk u very much but sorry for insisting because i have another problem ERROR: c:\Snort\etc\c:\Snort ules\app-detect.rules unable to open rules file "c:\Snort\etc\c:\Snort ules/app-detect.rules" :Invalid argument , i really need your help

[@kimnoussa864]

i know the path looks incorrect but i followed the video step by step so i don't know

[@SteveGantz]

Maalel Ons You should check the RULE_PATH declaration near the end of Step #1 in snort.conf. The RULE_PATH variable needs to be a full path to the folder where the rules files are located, typically c:\Snort ules on windows.

[@echakurnia]

many Thanks professor, I'm getting ERROR : c:\Snort\etc\C:\Snort ules/app-detect.rules unable to open rules file "c:\Snort\etc\C:\Snort ules/app-detect.rules": invalid argument. can U explain me prof? thanks before

[@SteveGantz]

You need to look closely at the paths in your snort.conf file, specifically for the RULE_PATH variable declaration in Step #1 of the config file. Typically on Windows the correct variable declaration will be "var RULE_PATH c:\Snort ules".

[@UseedNapkin]

Steve Gantz I am getting the same error when declaring the variable declaration to the absolute path var RULE_PATH c:\Snort ules it's like windows is trying to run the absolute path in the etc folder, running windows 8.1. Any ideas how to fix this? Thinking about just setting the rules inside the same etc folder as the snort.exe file...

[@SteveGantz]

The correct path declaration line in snort.conf is: var RULE_PATH c:\Snort ules If you use an absolute path it shouldn't matter what directory you are in when you start Snort (usually you would be in c:\Snort\bin), but the main reason to use a full path is that Snort will by default look first in whatever directory snort.conf is located. Try starting Snort from within c:\Snort\bin and make sure you include the conf file with a full path (using the command line option -c c:\Snort\etc\snort.conf).

[@ytrbro1041]

hello thank you for the video, my install went well, when I run snort I get: Decoding Ethernet ERROR: log_tcpdump: Failed to open log file "log/snort.log.1421404290": Result too large Fatal Error, Quitting.. any way to shorten the output? or increase the buffer?

[@1noiz]

+Steve Gantz I'm having the same problem as +arcolino1, can you help us please?

[@SteveGantz]

Kory Wright Please confirm that you have specified a correct log directory in Step #2 of snort.conf. You can also specify the directory as part of the startup command using the -l option (that's a lowercase L), such as by including "-l c:\Snort\log" in your startup command.

[@1noiz]

Steve Gantz​ thanks for getting back to me! I was able to figure it out. My error was completely unrelated to my logdir path

[@sreyass7358]

Hai Sir.. Nice tutorial.. Worked well... Sir, can you help me for how to put the alerts from snort into a database. Please help me with the database issue. What i want to do to get the alerts into a database. Thankyou... Waiting for your reply. Thanks again.

[@SteveGantz]

There is no easy way to get Snort log and alert output into a database, at least not on Windows. Snort has not had the functionality to write directly to a database for almost three years (since version 2.9.3), and the most popular tool (Barnyard) for getting Snort data into a database like MySQL does not run on Windows unless you use Cygwin or an equivalent tool to allow you to compile Barnyard in a Unix-like environment on Windows. I would recommend considering moving to a Linux deployment of Snort, either in a virtual machine running on Windows (like VMware or VirtualBox) or on a standalone Linux install.

[@jebuschrist3958]

Steve Gantz I am working on a windows version of barnyard. All though it is slimmed down quite a bit. It is based on Python. I need it for a project at Uni and had a need to use both Linux and Windows snort sensors.

[@farceadentus]

Thanks for the video professor, its very helpful. I'm getting: ERROR: c:\Snort\etc\snort.conf(511) => Unable to open address file C:\Snort ule s\white_list, Error: No such file or directory Fatal Error, Quitting.. In the conf file, I have it set to: var WHITE_LIST_PATH C:\Snort ules var BLACK_LIST_PATH C:\Snort ules and whitelist $WHITE_LIST_PATH\white_list, \ blacklist $BLACK_LIST_PATH/black_list I set the backslash in the path to the white list as you did, no luck. I cant see anything wrong with the configuration? Any ideas?

[@SteveGantz]

Did you create a file called white_list and save it in the c:\Snort ules directory? The error you are getting means Snort can't find the whitelist file referenced in snort.conf. It doesn't exist by default; you have to create it.

[@farceadentus]

Steve Gantz Ok, that was it, it was in a wrong folder, now I get: Initializing rule chains... ERROR: C:\Snort ules/local.rules(24) Bad protocol: tco. Fatal Error, Quitting..

[@SteveGantz]

I think you have a typo in one of your rules. The "tco" in the error, if that string is in a rule, should probably be tcp.

[@farceadentus]

Steve Gantz Fantastic, thanks Steve, its working ;)

[@SteveGantz]

***** If the error is related to the reputation preprocessor (including the whitelist and/or blacklist files) then there aren't that many places a problem could be. In Step #5 of snort.conf where the reputation preprocessor settings are, the paths to the whitelist and blacklist files have to point to the right directory and the files named in the configuration have to match exactly with the files stored in the target directory. If your filenames look right but you are still seeing an error, check to make sure that you don't have a hidden .txt extension on the blacklist or whitelist files - especially if you used Notepad to create them.

[@bottomoftheiceberg]

fantastic video thank you

[@ishitaraut1136]

Hi, thank you so much for the video! Helped a lot. I got this error saying - Active response: can't open ip! I'm completely clueless about what to do!

[@SteveGantz]

Are you running the Windows command shell as Administrator? Snort needs to be run with admin privileges.

[@salihsisman9978]

Thank you.

[@anishmhrj7114]

Error: c:\Snort ules\app-detect.rules(33) Unknown ClassType: web-application-attack Fatal Error, Quitting.. help me as fast as u can sir????

[@SteveGantz]

anish mhrj Make sure the rules you are using match the version of Snort you installed. It sounds like you have a mismatch.

[@anishmhrj7114]

Steve Gantz its corrected but now i having a new problem again...i have been waiting so long in cmd prompt for commencing packet processing.no any responses now after commencing packet processing. help me sir??

[@SteveGantz]

anish mhrj If Snort is running but you don't see any alerts you are either listening on the wrong interface or you don't have output directed to the screen. Try a different interface number (-i 1, -i 2, etc) if you aren't sure you have Snort listening on the right one. Use -A console in your startup command to direct alerts to the cmd prompt screen.

[@anishmhrj7114]

Steve Gantz i am still stucked in the same line.

[@bluejaeuk]

Thanks for this professor I'm getting this: ERROR: c:\Snort\etc\snort.conf Missing/incorrect dynamic engine lib specifier. But, I set to: dynamicengine c:\Snort\lib\snort_dynamicengine\sf_engine.dll This path & dll file certainly exist

[@bluejaeuk]

ERROR: c:\Snort\etc\snort.conf => Invalid argument: include

[@SteveGantz]

Brian Lee By line 533, snort.conf is at the end of Step #6 or beginning of Step #7, both of which have include statements in them. The error suggests that where Snort is encountering the include statement it is reading it as part of a previous statement instead of the beginning of a new line, so check the syntax of any of the output settings you have in Step #6.

[@halo64654]

Thanks for the tutorial, it was very helpful! But I get this error when testing.. ERROR: Invalid device number: 5. Fatal Error, Quitting.. I don't understand what I did wrong. can you please help me?

[@SteveGantz]

You have to choose an interface number the is available on your computer. I use -i 5 in the video because 5 is the interface I have active, but on your computer it could be 2 or 3 or something else.

[@kimberlywatson3964]

I am also running as administrator

[@bobaidoo6193]

sir i have done everything following your lead but i'm having a challenge . Index Physical Address IP Address Device Name Description ----- ---------------- ---------- ----------- ----------- no network can detected. please help

[@SteveGantz]

If snort -W doesn't return any interfaces you may not have the NPF packet capture driver running. Have you installed WinPcap? Download and install the latest version of WinPcap (you may need to restart your computer to make sure e driver is loaded) and try snort -W again.

[@focalfury]

Your guide was very helpful. I am very close but at the end I get the following error Decoding Ethernet ERROR: log_tcpdump: Failed to open log file "log/snort.log.1409115629": Result too large Fatal Error, Quitting.. I appreciate your help here and thank you again for making this video

[@SteveGantz]

Tcpdump log output settings are in the pcap output plugin configuration (in Step #6 of snort.conf). You can either comment out the line entirely or, if you want it active, replace the log destination argument with one that includes the full path to the log file, such as c:\Snort\log\tcpdump.log

[@pardeepbhandari9847]

Steve Gantz was getting same error about tcpdump.log. Solved. Thanks. One thing more your voice is so good and subtle. i love listening to.

[@vishalm2338]

Hi Steve thankyou for the awesome video, As suggested I am trying the pcap output path as : output log_tcpdump: c:\Snort\log\tcpdump.log for the error below: Decoding Ethernet ERROR: log_tcpdump: Failed to open log file "log/snort.log.1409115629": Result too large Fatal Error, Quitting.. and now i am receiving the error as: Decoding Ethernet ERROR: log_tcpdump: Failed to open log file "log/c:\Snort\log\tcpdump.log.141380 2402": Result too large Fatal Error, Quitting.. I appreciate any help provided.

[@vishalm2338]

Vishal Mehta For me the following worked: STEP 1: I kept the below lines as usual commented in snort.conf: # pcap # output log_tcpdump: C:\Snort\log\tcpdump.log STEP 2: On the cmd prompt : C:\>snort -i1 -c c:\Snort\etc\snort.conf -A console -l c:\Snort\log Again Thanks Steve, the above video really saved lot of time in configuring snort on windows.

[@MrTbk08]

Vishal Mehta tnx, it worked for me too

[@LahiruRanasinghe1]

Thanks alot, very nicely explained... however i couldn't get any alerts.. everything is 0%

[@SteveGantz]

If Snort starts successfully and you have testing rules loaded but you don't see any alerts, you are either listening on the wrong network interface or you are directing output to someplace where you aren't looking. I recommend using the -A console option in your startup command while you are testing so you can immediately see Snort alerts on screen. To check available interfaces, run snort -W (it has to be a capital W) and then make sure you indicate the appropriate interface with the -i # startup option (where you put the interface number in place of the #). If you have multiple interfaces active (for example, both wired and wireless) it's a good idea to disable all but one of them, because you cannot specify which interface Windows programs will use when they run.

[@00011theman]

Nevermind, hand to uncomment "output log_tcpdump: tcpdump.log" :D

[@AnkurSharmaGodSMACK]

CooL.... (y)

[@prasannatekumudi100]

i solved the problem local.rules(21) Port value missing in rule! but i am not able to capturing the data what im browsing in my system. tell me how to solve this problem? where i did wrong?

[@prasannatekumudi100]

i give the administator privilages to cmd " Run as Administator" on cmd. i got an error on interface 5 ERROR: Invalid device number: 5 and i change the interface numbers as 1,2,3,4 for these ERROR: c:\snort ules/local.rules(21) Port value missing in rule! How to fix this problem?

[@SteveGantz]

To make sure you have Snort listening on the right interface, run "snort -W" from the command line and choose the right interface number from the list shown. The port value error is a syntax problem in one or more rules in your local.rules file.

[@dinukcaldera2798]

hi i am getting error indicating when test if the snort rules are working(snort.conf -A console that part). Loading dynamic engine C:\Snort\lib\snort_dynamicengine... ERROR: Failed to load C:\Snort\lib\snort_dynamicengine: 126 Fatal Error, Quitting.. please help. i ran cmd prompt as administrator as well followed the steps as well. thank you

[@SteveGantz]

You need to make sure your dynamicengine path is correct (in step #4 of snort.conf). It looks like you put the right directory in your config file, but the dynamic engine declaration in Windows is pointing to a specific file, called sf_engine.dll. This is different than the default filename listed in snort.conf, since that one is for Linux. The dynamicengine declaration needs to include this filename.

[@dinukcaldera2798]

Steve Gantz thank you sooo much it works !!!

[@TrungNguyenVan-ln7bp]

Can you resolve my proplem : "Invalid device number 5" when i run command line "c:\Snort\bin>snort -i 5 -c c:\Snort\etc\snort.conf - T

[@SteveGantz]

the video shows my computer, which has more interfaces tgan is typical because I run virtual machines. to see the interfaces available on your computer you need to run "snort -W" from the command line. A value of 1 2 or 3 is most common on Windows.

[@HauNguyen-li2rz]

Help When I running "snort -c c:\Snort\etc\snort.conf -i c:\Snort\log -K ascii " in cmd. it shows "ERROR:Can't start DAQ (-1) - H0<

[@Xhizorsization]

+Hậu Nguyễn I have same issue

[@SteveGantz]

+Xhizorsization Unless you have a typo in the error message you provided, the problem is that the -i flag needs to be followed by a number (to indicate the interface Snort should use to listen to have the log file location after -i but it should go after -l (a lowercase L).

[@tripzd649]

hi there i am having problem i followed every step,but when i try to run snort with out testing -T, it don't show no packets but gives me a message saying "commencing packet processing (pid=9124)" please help???

[@SteveGantz]

The commencing packet processing message means that Snort is running. If you have rules loaded and if you are listening on the correct interface and if you have directed output to the screen, any alerts from Snort will appear in the console below that message.

[@tripzd649]

Steve Gantz thanks for the help,could you please upload a video on how to link SNORT with MYSQL and Base please.

[@SteveGantz]

Using Snort with MySQL is actually pretty hard on Windows, because there is no direct output to databases supported in Snort (since v2.9.3). It is relatively simple to install MySQL, Apache, and BASE on a Windows machine, but you need a tool to take the output from Snort (in a supported format such as unified2, syslog, etc.) and insert it into MySQL. The typical way to do that on Linux is to use Barnyard, but Barnyard does not run on Windows, so you would need to us Cygwin or another tool that would let you compile Barnyard from source on Windows.

[@tripzd649]

Steve Gantz Thanks once more ,if possible could you please upload a video how to configure cygwin to be able to get output from mysql and to display data (Snort Captured packets ) on BASE browser.this would be appreciated.

[@SteveGantz]

Tripz Don You should be able to find other online tutorials (written or video) on installing Cygwin. If you're going to go to all that effort, however, I suggest you consider installing VMware Player or VirtualBox and just setting up a Linux VM to run Snort with Barnyard, MySQL, and BASE. Snort really isn't optimized to run on Windows so you may be happier on Linux.