[Snort-users] Network Variables

Seth Dunn

unread,

Apr 29, 2013, 10:22:45 AM4/29/13

to

Hello,
I am running Snort on Windows 2008 Server R2

I am trying to figure out how I can bypass traffic that is being sent from certain networks, since it is creating false-positives

Information on my setup.
My watched networks are:: 10.75.x.x/24 and 10.76.x.x/24
Now I also have two other networks, that are not being watched, but are part of my companies network and setup.
They are:: 10.10.x.x/24 <- Office network
10.30.x.x/24 <- Remote VPN users

Originally I tried putting in a .bpf file, but that did not work. (anyone know how to make it work?)

So I tried my HOME_NET like this:: [10.75.0.0/16,10.76.0.0/16,!10.10.0.0/24,!10.30.0.0/24]
That didn't work, snort still sent out alerts for the two networks.
So I put HOME_NET back to :: [10.75.0.0/16,10.76.0.0/16]
And set EXTERNAL_NET to this:: [any, !10.10.0.0/24,!10.30.0.0/24], that did not work
So I tried:: [any, [!10.10.0.0/24,10.30.0.0/24]], that did not work

Any ideas on what I can do to fix this?

My networks 10.75.x.x and 10.76.x.x are connected to the networks 10.10.x.x and 10.30.x.x via two Cisco PIX 515E's

Thanks,
Seth

Seth Dunn

unread,

Apr 30, 2013, 11:04:21 AM4/30/13

to

Ok, I think I got it corrected.
I altered my EXTERNEL_NET variable to :: [!10.30.0.0/24,!10.10.0.0/24]
That seems to have stopped the false-positives, while still logging other traffic.
So I am assuming there is a default "any" aspect to this variable.

Jeremy Hoel

unread,

Apr 30, 2013, 11:25:51 AM4/30/13

to

Yes.. since you are only negating some ip's, the rest that match will work.

> ------------------------------------------------------------------------------
> Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
> Get 100% visibility into your production application - at no cost.
> Code-level diagnostics for performance bottlenecks with <2% overhead
> Download for free and get started troubleshooting in minutes.
> http://p.sf.net/sfu/appdyn_d2d_ap1
> _______________________________________________
> Snort-users mailing list
> Snort...@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort
> news!

------------------------------------------------------------------------------
Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
Get 100% visibility into your production application - at no cost.
Code-level diagnostics for performance bottlenecks with <2% overhead
Download for free and get started troubleshooting in minutes.
http://p.sf.net/sfu/appdyn_d2d_ap1
_______________________________________________
Snort-users mailing list
Snort...@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Seth Dunn

unread,

Apr 30, 2013, 1:19:28 PM4/30/13

to

Great.
Thank you for the confirmation.

Do you know how to set up bpf filters under windows?
I would like to go that route so I can fine tune things vs. just
blocking out entire IP ranges.
But I have had no luck getting that to work.

Jeremy Hoel

unread,

Apr 30, 2013, 5:37:57 PM4/30/13

to

well snort reads a text file that contains the bpf filters.

I don't use snort in windows, but the same path structure that you use
to point to your rules, point to a text file containing the bpf filter
you want to run against.

Seth Dunn

unread,

Apr 30, 2013, 7:28:28 PM4/30/13

to

Right, and I set up the text file, and snort started and read the file.
But it didn't filter out the traffic.
And I have followed the examples I have seen creating the file, but it
is not working as expected.

waldo kitty

unread,

Apr 30, 2013, 9:47:12 PM4/30/13

to

On 4/30/2013 19:28, Seth Dunn wrote:
> Right, and I set up the text file, and snort started and read the file.
> But it didn't filter out the traffic.
> And I have followed the examples I have seen creating the file, but it
> is not working as expected.

please post the contents of the file and the command line you used to start snort...

--
NOTE: No off-list assistance is given without prior approval.
Please keep mailing list traffic on the list unless
private contact is specifically requested and granted.

Seth Dunn

unread,

Apr 30, 2013, 10:17:52 PM4/30/13

to

My bpf file is ignore.bpf and has one line in it::
not net 10.10.0.0/24 || 10.30.0.0/24

I have also tried variations of that rule using ! instead of not...
Using && instead of ||
I have also used the rule across two lines like
not net 10.10.0.0/24 &&
not net 10.30.0.0/24
But that also did not work.

I have the bpf file defined in my snort.conf file :: config bpf_file:
D:\Snort\etc\ignore.bpf
I also call it with the switch -F d:\snort\etc\ignore.bpf

Still nothing. Traffic is not ignored/filtered out....snort still
alerts on it.

-----Original Message-----
From: waldo kitty [mailto:wkit...@windstream.net]
Sent: Tuesday, April 30, 2013 9:47 PM
To: snort...@lists.sourceforge.net
Subject: Re: [Snort-users] Network Variables

Michael Green

unread,

May 1, 2013, 12:06:41 AM5/1/13

to

Try

not net 10.10.0.0/24 and not net 10.30.0.0/24

-----Original Message-----
From: Seth Dunn [mailto:se...@d2ms.com]

The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and / or privileged material that may be governed by confidential information provisions contained in the agreement between GBST and your company. Any disclosure, copying, distribution, or other use without the express consent of the sender is prohibited. If you received this in error, please contact the sender and delete the material from any computer. All rights in the information transmitted, including copyright, are reserved. Nothing in this message should be interpreted as a digital signature that can be used to authenticate a document. No warranty is given by the sender that any attachments to this email are free from viruses or other defects.

Seth Dunn

unread,

May 1, 2013, 6:43:24 AM5/1/13

to

Hey Michael,
I will give that a try and see if that works. I have not tried that
combination yet.

@Jeff,
Where are you seeing /16? Did I fat finger something?
I am trying to filter out /24 (255.255.255.0) for both networks.

Seth Dunn

unread,

May 1, 2013, 11:11:25 AM5/1/13

to

Do you have to use the -F switch to call the bpf file, or can you just
configure in the snort.conf file to use it and the bpf file is
processed?

waldo kitty

unread,

May 1, 2013, 11:49:28 AM5/1/13

to

On 5/1/2013 11:11, Seth Dunn wrote:
> Do you have to use the -F switch to call the bpf file, or can you just
> configure in the snort.conf file to use it and the bpf file is
> processed?

it should work the same either way... if it does not, it may be a bug... joel or
someone on the dev team may be able to answer that question...

FWIW: my understanding is that command line switches override conf file entries...

--
NOTE: No off-list assistance is given without prior approval.
Please keep mailing list traffic on the list unless
private contact is specifically requested and granted.

Seth Dunn

unread,

May 1, 2013, 1:09:46 PM5/1/13

to

Ok, that is what I was thinking.
Now my bpf file, I initially did this:

not net 10.10.0.0/24 and not net 10.30.0.0/24

And that appears to work....snort started, and I didn't get
alerts...maybe the users didn't do anything to trigger the alerts, who
knows.
So I wanted to tighten it up to make it a bit more specific.
So I wanted to comment the line: # not net 10.10.0.0/24 and not net
10.30.0.0/24
and add in this one: not net 10.10.0.0/24 and dst host 10.75.45.1 && dst
port 80 or not net 10.30.0.0/24 and dst host 10.75.45.1 && dst port 80

So if I do that, then snort fails to start, it has problems with the bpf
file....it will not let me comment lines, so I can't add descriptions.
So I deleted the first line and left in:
not net 10.10.0.0/24 and dst host 10.75.45.1 && dst port 80 or not net
10.30.0.0/24 and dst host 10.75.45.1 && dst port 80

Snort again starts and runs, and so far has not generated alerts...but
again, the users may have just not done anything to generate the alerts.
So I will watch it for the next day and see what happens.

But any ideas why snort fails to start if I add in a '#' to comment a
line??

-----Original Message-----
From: waldo kitty [mailto:wkit...@windstream.net]
Sent: Wednesday, May 01, 2013 11:49 AM
To: snort...@lists.sourceforge.net
Subject: Re: [Snort-users] Network Variables

waldo kitty

unread,

May 1, 2013, 10:07:25 PM5/1/13

to

On 5/1/2013 13:09, Seth Dunn wrote:
> But any ideas why snort fails to start if I add in a '#' to comment a
> line??

i have no clue but it sounds like a coding error not allowing comment lines i
the BPF file... only joel or one of the snort dev guys can tell us that... or
possibly a code diver who can root around in the snort code ;)

--
NOTE: No off-list assistance is given without prior approval.
Please keep mailing list traffic on the list unless
private contact is specifically requested and granted.

Russ Combs

unread,

May 2, 2013, 12:08:12 AM5/2/13

to

Snort does allow comments in the BPF file, starting with # to end of line. If there is a syntax error, you should see something like:

ERROR: Can't set DAQ BPF filter to '

...

' (pcap_daq_set_filter: pcap_compile: syntax error)!

Fatal Error, Quitting..

What DAQ are you using? Please send the BPF file that fails and the error that you get.

Seth Dunn

unread,

May 2, 2013, 7:50:06 AM5/2/13

to

What is DAQ? I have seen that, but have no idea what that is.

As far as my bpf file goes, if it is like this::

#not net 10.10.0.0/24 and not net 10.30.0.0/24

not net 10.10.0.0/24 and dst host 10.75.45.1 && dst port 80 or not net 10.30.0.0/24 and dst host 10.75.45.1 && dst port 80

It will fail with::

Reading filter from bpf file: D:\Snort\etc\ignore2.bpf

ERROR: short read D:\Snort\etc\ignore2.bpf (169 != 170)

Fatal Error, Quitting..

If I remove the commented line, then snort starts fine.
If I try to have multiple lines in the file, (all being rules, no comments) the it will fail with a similar error as above.
I have never seen a DAQ error.

From: Russ Combs [mailto:rco...@sourcefire.com]
Sent: Thursday, May 02, 2013 12:08 AM
To: waldo kitty
Cc: snort...@lists.sourceforge.net
Subject: Re: [Snort-users] Network Variables

Snort does allow comments in the BPF file, starting with # to end of line. If there is a syntax error, you should see something like:

James Lay

unread,

May 2, 2013, 8:10:09 AM5/2/13

to

Quotation marks may be needed…try appending via command line as well.

James

On May 2, 2013, at 5:50 AM, Seth Dunn <se...@d2ms.com> wrote:

What is DAQ? I have seen that, but have no idea what that is.
As far as my bpf file goes, if it is like this::

#not net 10.10.0.0/24 and not net 10.30.0.0/24
not net 10.10.0.0/24 and dst host 10.75.45.1 && dst port 80 or not net 10.30.0.0/24 and dst host 10.75.45.1 && dst port 80

It will fail with::
Reading filter from bpf file: D:\Snort\etc\ignore2.bpf
ERROR: short read D:\Snort\etc\ignore2.bpf (169 != 170)
Fatal Error, Quitting..

If I remove the commented line, then snort starts fine.
If I try to have multiple lines in the file, (all being rules, no comments) the it will fail with a similar error as above.
I have never seen a DAQ error.

Russ Combs

unread,

May 2, 2013, 8:15:56 AM5/2/13

to

On Thu, May 2, 2013 at 7:50 AM, Seth Dunn <se...@d2ms.com> wrote:

What is DAQ? I have seen that, but have no idea what that is.

The DAQ is Snort's generalized interface for reading packets. I missed your Windows mention at the outset; you are using the pcap DAQ.

As far as my bpf file goes, if it is like this::

#not net 10.10.0.0/24 and not net 10.30.0.0/24

not net 10.10.0.0/24 and dst host 10.75.45.1 && dst port 80 or not net 10.30.0.0/24 and dst host 10.75.45.1 && dst port 80

It will fail with::
Reading filter from bpf file: D:\Snort\etc\ignore2.bpf

ERROR: short read D:\Snort\etc\ignore2.bpf (169 != 170)
Fatal Error, Quitting..

This error text makes the issue clear. There is a bug in the code which requires that the whole file be read in one go. If you always get the same error (169 read out of 170) you can try deleting a character from the comment line. Otherwise, adding more comments at the end might work. But your best bet for now would be to put the comments directly in Snort's conf and keep only the active BPF in your .bpf. I'll file a bug to get the read fixed.

Thanks

Russ

Seth Dunn

unread,

May 2, 2013, 9:59:08 AM5/2/13

to

I tried using quotes,
Starting with " #
Starting and ending with " "
Tried starting with ## and ending with ##

If I have a blank line, with the rule on the next line,
Tried calling the file with the -F switch, and not through snort.conf file
All come back with the same error.

Very odd, not being able to comment out a line, when the snort.conf file is full of commented lines.

Nothing seems to work with the bpf file, and it seems I am stuck to having just one rule in the file.

From: James Lay [mailto:jl...@slave-tothe-box.net]
Sent: Thursday, May 02, 2013 8:10 AM
To: Snort
Subject: Re: [Snort-users] Network Variables

Quotation marks may be needed…try appending via command line as well.

James

On May 2, 2013, at 5:50 AM, Seth Dunn <se...@d2ms.com> wrote:

What is DAQ? I have seen that, but have no idea what that is.

As far as my bpf file goes, if it is like this::

#not net 10.10.0.0/24 and not net 10.30.0.0/24

not net 10.10.0.0/24 and dst host 10.75.45.1 && dst port 80 or not net 10.30.0.0/24 and dst host 10.75.45.1 && dst port 80

It will fail with::

Reading filter from bpf file: D:\Snort\etc\ignore2.bpf

ERROR: short read D:\Snort\etc\ignore2.bpf (169 != 170)

Fatal Error, Quitting..

If I remove the commented line, then snort starts fine.

If I try to have multiple lines in the file, (all being rules, no comments) the it will fail with a similar error as above.
I have never seen a DAQ error.

Seth Dunn

unread,

May 2, 2013, 10:09:23 AM5/2/13

to

Also of note.
It seems that if snort starts with a bpf file configured....then for whatever reason, all traffic is no longer monitored, even though snort has started.
So while this rule::

not net 10.10.0.0/24 and dst host 10.75.45.1 && dst port 80 or not net 10.30.0.0/24 and dst host 10.75.45.1 && dst port 80

is pretty specific.....
I have another rule set in my local.rules file that should alert on any FTP attempt to IP 10.76.65.1....and if the bpf file is configured for snort, then the attempt is not alerted by snort.
If I remove the bpf file from being used, then any FTP attempt is again alerted.

James Lay

unread,

May 2, 2013, 10:12:02 AM5/2/13

to

What happens when you try it via command line?

On 2013-05-02 08:09, Seth Dunn wrote:
> Also of note.
> It seems that if snort starts with a bpf file configured....then for
> whatever reason, all traffic is no longer monitored, even though
> snort
> has started.
> So while this rule::
> not net 10.10.0.0/24 and dst host 10.75.45.1 && dst port 80 or not
> net
> 10.30.0.0/24 and dst host 10.75.45.1 && dst port 80
>
> is pretty specific.....
> I have another rule set in my local.rules file that should alert on
> any FTP attempt to IP 10.76.65.1....and if the bpf file is configured
> for snort, then the attempt is not alerted by snort.
> If I remove the bpf file from being used, then any FTP attempt is
> again alerted.
>

> FROM: James Lay [mailto:jl...@slave-tothe-box.net]
> SENT: Thursday, May 02, 2013 8:10 AM
> TO: Snort
> SUBJECT: Re: [Snort-users] Network Variables

>
> Quotation marks may be needed…try appending via command line as
> well.
>
> James
>

> On May 2, 2013, at 5:50 AM, Seth Dunn <se...@d2ms.com [1]> wrote:
>
> What is DAQ? I have seen that, but have no idea what that is.
>
> As far as my bpf file goes, if it is like this::
>
> #not net 10.10.0.0/24 and not net 10.30.0.0/24
>
> not net 10.10.0.0/24 and dst host 10.75.45.1 && dst port 80 or not
> net
> 10.30.0.0/24 and dst host 10.75.45.1 && dst port 80
>
> It will fail with::
>

> Reading filter from bpf file: D:Snortetcignore2.bpf
>
> ERROR: short read D:Snortetcignore2.bpf (169 != 170)

>
> Fatal Error, Quitting..
>
> If I remove the commented line, then snort starts fine.
> If I try to have multiple lines in the file, (all being rules, no
> comments) the it will fail with a similar error as above.
> I have never seen a DAQ error.
>

> FROM: Russ Combs [mailto:rco...@sourcefire.com [2]]
> SENT: Thursday, May 02, 2013 12:08 AM
> TO: waldo kitty
> CC: snort...@lists.sourceforge.net [3]
> SUBJECT: Re: [Snort-users] Network Variables

> http://p.sf.net/sfu/appdyn_d2d_ap1 [5]
> _______________________________________________
> Snort-users mailing list
> Snort...@lists.sourceforge.net [6]

> Go to this URL to change user options or unsubscribe:

> https://lists.sourceforge.net/lists/listinfo/snort-users [7]

> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

> [8]
>
> Please visit http://blog.snort.org [9] to stay current on all the

> latest Snort news!
>
>
> ------------------------------------------------------------------------------
> Introducing AppDynamics Lite, a free troubleshooting tool for
> Java/.NET
> Get 100% visibility into your production application - at no cost.
> Code-level diagnostics for performance bottlenecks with <2% overhead
> Download for free and get started troubleshooting in minutes.
>
> http://p.sf.net/sfu/appdyn_d2d_ap1_______________________________________________

> [10]
> Snort-users mailing list
> Snort...@lists.sourceforge.net [11]

> Go to this URL to change user options or unsubscribe:

> https://lists.sourceforge.net/lists/listinfo/snort-users [12]

> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

> [13]
>
> Please visit http://blog.snort.org [14] to stay current on all the
> latest Snort news!
>
>
>
> Links:
> ------
> [1] mailto:se...@d2ms.com
> [2] http://sourcefire.com
> [3] mailto:snort...@lists.sourceforge.net
> [4] mailto:wkit...@windstream.net
> [5] http://p.sf.net/sfu/appdyn_d2d_ap1
> [6] mailto:Snort...@lists.sourceforge.net
> [7] https://lists.sourceforge.net/lists/listinfo/snort-users
> [8]
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> [9] http://blog.snort.org
> [10]
>
> http://p.sf.net/sfu/appdyn_d2d_ap1_______________________________________________
> [11] mailto:Snort...@lists.sourceforge.net
> [12] https://lists.sourceforge.net/lists/listinfo/snort-users
> [13]
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> [14] http://blog.snort.org

Seth Dunn

unread,

May 2, 2013, 10:16:42 AM5/2/13

to

Same.
It doesn't matter if the call is using the .conf file, or through the -F command line switch

-----Original Message-----
From: James Lay [mailto:jl...@slave-tothe-box.net]
Sent: Thursday, May 02, 2013 10:12 AM
To: Snort
Subject: Re: [Snort-users] Network Variables

> -------- Introducing AppDynamics Lite, a free troubleshooting tool for

> Java/.NET Get 100% visibility into your production application - at no
> cost.
> Code-level diagnostics for performance bottlenecks with <2% overhead
> Download for free and get started troubleshooting in minutes.
> http://p.sf.net/sfu/appdyn_d2d_ap1 [5]
> _______________________________________________
> Snort-users mailing list
> Snort...@lists.sourceforge.net [6]
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users [7]
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> [8]
>
> Please visit http://blog.snort.org [9] to stay current on all the
> latest Snort news!
>
>
> ----------------------------------------------------------------------

> -------- Introducing AppDynamics Lite, a free troubleshooting tool for

> Java/.NET Get 100% visibility into your production application - at no
> cost.
> Code-level diagnostics for performance bottlenecks with <2% overhead
> Download for free and get started troubleshooting in minutes.
>

> http://p.sf.net/sfu/appdyn_d2d_ap1____________________________________
> ___________

> [10]
> Snort-users mailing list
> Snort...@lists.sourceforge.net [11] Go to this URL to change user
> options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users [12]
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> [13]
>
> Please visit http://blog.snort.org [14] to stay current on all the
> latest Snort news!
>
>
>
> Links:
> ------
> [1] mailto:se...@d2ms.com
> [2] http://sourcefire.com
> [3] mailto:snort...@lists.sourceforge.net
> [4] mailto:wkit...@windstream.net
> [5] http://p.sf.net/sfu/appdyn_d2d_ap1
> [6] mailto:Snort...@lists.sourceforge.net
> [7] https://lists.sourceforge.net/lists/listinfo/snort-users
> [8]
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> [9] http://blog.snort.org
> [10]
>
> http://p.sf.net/sfu/appdyn_d2d_ap1____________________________________

> ___________ [11] mailto:Snort...@lists.sourceforge.net

James Lay

unread,

May 2, 2013, 10:30:33 AM5/2/13

to

This worked like a champ for me:

[08:19:26 me@box:~/snort$ sudo snort -c snort.conf 'not net

10.10.0.0/24 and dst host 10.75.45.1 && dst port 80 or not net

10.30.0.0/24 and dst host 10.75.45.1 && dst port 80'
Running in IDS mode
--== Initializing Snort ==--
Initializing Output Plugins!
Initializing Preprocessors!
Initializing Plug-ins!
<snip>
Decoding Ethernet

--== Initialization Complete ==--

,,_ -*> Snort! <*-
o" )~ Version 2.9.4.6 GRE (Build 73)
'''' By Martin Roesch & The Snort Team:
http://www.snort.org/snort/snort-team
Copyright (C) 1998-2012 Sourcefire, Inc., et al.
Using libpcap version 1.1.1
Using PCRE version: 8.12 2011-01-15
Using ZLIB version: 1.2.3.4

Rules Engine: SF_SNORT_DETECTION_ENGINE Version 1.17
<Build 18>
Preprocessor Object: SF_SDF Version 1.1 <Build 1>
<snip>
Preprocessor Object: SF_DNP3 Version 1.1 <Build 1>
Commencing packet processing (pid=28871)

James

Seth Dunn

unread,

May 2, 2013, 10:39:53 AM5/2/13

to

Ok, doing my command line like this::
C:\>d:\snort\bin\snort -c d:\snort\etc\snort2.conf -i2 'not net 10.10.0.0/24 and

dst host 10.75.45.1 && dst port 80 or not net 10.30.0.0/24 and dst host 10.75.4

5.1 && dst port 80' -T

I get this::
The DAQ version does not support reload.
Acquiring network traffic from "\Device\NPF_{62D05284-3337-4ED4-8151-E1D6D292691
8}".
ERROR: Can't set DAQ BPF filter to ''not net 10.10.0.0/24 and dst host 10.75.45.
1' (╠πQ)!
Fatal Error, Quitting..

Seth Dunn

unread,

May 2, 2013, 10:42:52 AM5/2/13

to

To make the command line more simple, I did this::
C:\>d:\snort\bin\snort -c d:\snort\etc\snort2.conf -i2 'not net 10.10.0.0/24' -T

I get this result::
pcap DAQ configured to passive.

The DAQ version does not support reload.
Acquiring network traffic from "\Device\NPF_{62D05284-3337-4ED4-8151-E1D6D292691
8}".

ERROR: Can't set DAQ BPF filter to ''not net 10.10.0.0/24' -T' (╠πQ)!

James Lay

unread,

May 2, 2013, 10:46:56 AM5/2/13

to

Your filter should be the last thing, so shift that -T to in front of
it. Any of the winsnort folks wanna chime in here?

James

Castle, Shane

unread,

May 2, 2013, 10:50:55 AM5/2/13

to

I dunno - I can parse that BPF expression several different ways, and the parsing results in different capture characteristics.

Does the first "not" apply to just "net 10.10.0.0/24" or to the expr "net 10.10.0.0/24 and dst host 10.75.45.1 && dst port 80"? (For instance.) This depends on the precedence and order of how Snort parses the string. I can find no doc on this in the Snort manpage, the tcpdump manpage, or the Snort manual. I suggest using parentheses for grouping so that your intent is clear.

--
Shane Castle
Data Security Mgr, Boulder County IT

-----Original Message-----
From: Seth Dunn [mailto:se...@d2ms.com]

Sent: Thursday, May 02, 2013 08:09
To: James Lay; Snort
Subject: Re: [Snort-users] Network Variables

Also of note.
It seems that if snort starts with a bpf file configured....then for whatever reason, all traffic is no longer monitored, even though snort has started.
So while this rule::
not net 10.10.0.0/24 and dst host 10.75.45.1 && dst port 80 or not net 10.30.0.0/24 and dst host 10.75.45.1 && dst port 80

is pretty specific.....
I have another rule set in my local.rules file that should alert on any FTP attempt to IP 10.76.65.1....and if the bpf file is configured for snort, then the attempt is not alerted by snort.
If I remove the bpf file from being used, then any FTP attempt is again alerted.

From: James Lay [mailto:jl...@slave-tothe-box.net]
Sent: Thursday, May 02, 2013 8:10 AM
To: Snort
Subject: Re: [Snort-users] Network Variables

Quotation marks may be needed...try appending via command line as well.

James

On May 2, 2013, at 5:50 AM, Seth Dunn <se...@d2ms.com> wrote:

What is DAQ? I have seen that, but have no idea what that is.

As far as my bpf file goes, if it is like this::

#not net 10.10.0.0/24 and not net 10.30.0.0/24

not net 10.10.0.0/24 and dst host 10.75.45.1 && dst port 80 or not net 10.30.0.0/24 and dst host 10.75.45.1 && dst port 80

It will fail with::

Reading filter from bpf file: D:\Snort\etc\ignore2.bpf

ERROR: short read D:\Snort\etc\ignore2.bpf (169 != 170)

Fatal Error, Quitting..

If I remove the commented line, then snort starts fine.
If I try to have multiple lines in the file, (all being rules, no comments) the it will fail with a similar error as above.
I have never seen a DAQ error.

From: Russ Combs [mailto:rco...@sourcefire.com]

Sent: Thursday, May 02, 2013 12:08 AM
To: waldo kitty
Cc: snort...@lists.sourceforge.net

Subject: Re: [Snort-users] Network Variables

Snort does allow comments in the BPF file, starting with # to end of line. If there is a syntax error, you should see something like:

ERROR: Can't set DAQ BPF filter to '

...

' (pcap_daq_set_filter: pcap_compile: syntax error)!

Fatal Error, Quitting..

What DAQ are you using? Please send the BPF file that fails and the error that you get.

On Wed, May 1, 2013 at 10:07 PM, waldo kitty <wkit...@windstream.net> wrote:

On 5/1/2013 13:09, Seth Dunn wrote:
> But any ideas why snort fails to start if I add in a '#' to comment a
> line??

i have no clue but it sounds like a coding error not allowing comment lines i
the BPF file... only joel or one of the snort dev guys can tell us that... or
possibly a code diver who can root around in the snort code ;)

--
NOTE: No off-list assistance is given without prior approval.
Please keep mailing list traffic on the list unless
private contact is specifically requested and granted.

Seth Dunn

unread,

May 2, 2013, 10:54:02 AM5/2/13

to

Ok, but I did the simple variation on the command line, so it is just 'not net 10.10.0.0/24'

Also, per James suggestion, I switched the -T, still now dice.
Command line::
C:\>d:\snort\bin\snort -c d:\snort\etc\snort2.conf -i2 -T 'not net 10.10.0.0/24'

Result::

The DAQ version does not support reload.
Acquiring network traffic from "\Device\NPF_{62D05284-3337-4ED4-8151-E1D6D292691
8}".

ERROR: Can't set DAQ BPF filter to ''not net 10.10.0.0/24'' (╠πQ)!

Fatal Error, Quitting..

-----Original Message-----

From: Castle, Shane [mailto:sca...@bouldercounty.org]
Sent: Thursday, May 02, 2013 10:51 AM
To: Seth Dunn; 'James Lay'; 'Snort'
Subject: RE: [Snort-users] Network Variables

Seth Dunn

unread,

May 2, 2013, 11:01:40 AM5/2/13

to

If I do quotes " vs. apostrophe '
That seems to work on the command line

James Lay

unread,

May 2, 2013, 11:03:11 AM5/2/13

to

Yea that was a single quote ;) Guessing it's a windows-ism, but glad
it's working now :)

James

Seth Dunn

unread,

May 2, 2013, 11:06:18 AM5/2/13

to

This works::
C:\>d:\snort\bin\snort -c d:\snort\etc\snort2.conf -i2 -T "not net

10.10.0.0/24
and dst host 10.75.45.1 && dst port 80 or not net 10.30.0.0/24 and dst

host 10.7
5.45.1 && dst port 80"

So how can I transfer that from the command line, to the bpf file?
Because as I mentioned earlier, using multiple lines in the file, it
fails.
Trying to comment a line, it fails.

Not to mention that when using the bpf file, it seems to stop alerting
on anything.....so all traffic is captured, because I see activity on
the interface....but snort does not alert on stuff it should.

Seth Dunn

unread,

May 2, 2013, 11:07:47 AM5/2/13

to

Yeah, it is a windows thing.....gotta love it. :D

-----Original Message-----
From: James Lay [mailto:jl...@slave-tothe-box.net]
Sent: Thursday, May 02, 2013 11:03 AM
To: Snort
Subject: Re: [Snort-users] Network Variables

Yea that was a single quote ;) Guessing it's a windows-ism, but glad
it's working now :)

James

On 2013-05-02 09:01, Seth Dunn wrote:
> If I do quotes " vs. apostrophe '
> That seems to work on the command line
>

James Lay

unread,

May 2, 2013, 11:14:30 AM5/2/13

to

Try adding the quotes in the bpf file and see what happens.

On 2013-05-02 09:06, Seth Dunn wrote:
> This works::

> C:\>d:\snort\bin\snort -c d:\snort\etc\snort2.conf -i2 -T "not net

> 10.10.0.0/24
> and dst host 10.75.45.1 && dst port 80 or not net 10.30.0.0/24 and
> dst

> host 10.7
> 5.45.1 && dst port 80"
>
> So how can I transfer that from the command line, to the bpf file?
> Because as I mentioned earlier, using multiple lines in the file, it
> fails.
> Trying to comment a line, it fails.
>
> Not to mention that when using the bpf file, it seems to stop
> alerting
> on anything.....so all traffic is captured, because I see activity on
> the interface....but snort does not alert on stuff it should.

Castle, Shane

unread,

May 2, 2013, 11:34:29 AM5/2/13

to

Speaking of Windows - it's possible that the Windows version of Snort does not correctly read a Windows text file, which is what the BPF file is, and that it expects lines to end with only LF (\n) rather than CR-LF (\n\r) - the latter is the Windows style. (This seems farfetched now that I'm rereading this before sending it, since the snort.conf will have to be processed correctly, but hey, maybe they didn't update the BPF reading section.)

The old Wordpad used to let you save files in Unix line-end style rather than Windows, but I don't see that capability any more. You can get dos2unix from SourceForge that will take care of the conversion, if that's required.

None of the Snort docs admit to allowing comment lines in the BPF expression file - I suspect it is parsed the same way that it would be if it were on the command line, in which a comment would not make sense. Yes, for a filter expression file, allowing comments does make sense - maybe we could get the Snort developers to permit that?

It'd be nice for a Snort developer or innards whiz to comment on this thread. He might shrug and say "run it in Linux, don't use Windows" but still - it's no fun programming in the dark.

> not net 10.10.0.0/24 and dst host 10.75.45.1 && dst port 80 or not
> net

> 10.30.0.0/24 and dst host 10.75.45.1 && dst port 80
>
> is pretty specific.....
> I have another rule set in my local.rules file that should alert on
> any
> FTP attempt to IP 10.76.65.1....and if the bpf file is configured for
> snort, then the attempt is not alerted by snort.
> If I remove the bpf file from being used, then any FTP attempt is
> again
> alerted.
>
>
>
> From: James Lay [mailto:jl...@slave-tothe-box.net]
> Sent: Thursday, May 02, 2013 8:10 AM
> To: Snort
> Subject: Re: [Snort-users] Network Variables
>
>
>
> Quotation marks may be needed...try appending via command line as
> well.
>
>
>
> James
>
>
>
> On May 2, 2013, at 5:50 AM, Seth Dunn <se...@d2ms.com> wrote:
>
>
>
>
>
> What is DAQ? I have seen that, but have no idea what that is.
>
> As far as my bpf file goes, if it is like this::
>
>
>
> #not net 10.10.0.0/24 and not net 10.30.0.0/24
>

> not net 10.10.0.0/24 and dst host 10.75.45.1 && dst port 80 or not
> net

> Introducing AppDynamics Lite, a free troubleshooting tool for
> Java/.NET
> Get 100% visibility into your production application - at no cost.
> Code-level diagnostics for performance bottlenecks with <2% overhead
> Download for free and get started troubleshooting in minutes.
> http://p.sf.net/sfu/appdyn_d2d_ap1
> _______________________________________________
> Snort-users mailing list
> Snort...@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
>
>
>
>

------------------------------------------------------------------------

> ------
> Introducing AppDynamics Lite, a free troubleshooting tool for
> Java/.NET
> Get 100% visibility into your production application - at no cost.
> Code-level diagnostics for performance bottlenecks with <2% overhead
> Download for free and get started troubleshooting in minutes.
>
>
http://p.sf.net/sfu/appdyn_d2d_ap1______________________________________
> _________
> Snort-users mailing list
> Snort...@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!

------------------------------------------------------------------------

waldo kitty

unread,

May 2, 2013, 11:51:40 AM5/2/13

to

On 5/2/2013 07:50, Seth Dunn wrote:
> What is DAQ? I have seen that, but have no idea what that is.

DAQ == Data AcQuisition module

--
NOTE: No off-list assistance is given without prior approval.
Please keep mailing list traffic on the list unless
private contact is specifically requested and granted.

se...@d2ms.com

unread,

May 2, 2013, 11:53:43 AM5/2/13

to

I can do some looking into this. But for my editor I am using notepad2. That I got from winsnort web site
Sent by BlackBerry

> On May 2, 2013, at 5:50 AM, Seth Dunn <se...@d2ms.com> wrote:
>
>
>
>
>
> What is DAQ? I have seen that, but have no idea what that is.
>

> --
> NOTE: No off-list assistance is given without prior approval.
> Please keep mailing list traffic on the list unless
> private contact is specifically requested and granted.
>
>
>
------------------------------------------------------------------------
> ------
> Introducing AppDynamics Lite, a free troubleshooting tool for
> Java/.NET
> Get 100% visibility into your production application - at no cost.
> Code-level diagnostics for performance bottlenecks with <2% overhead
> Download for free and get started troubleshooting in minutes.
> http://p.sf.net/sfu/appdyn_d2d_ap1
> _______________________________________________
> Snort-users mailing list
> Snort...@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
>
>
>
>

------------------------------------------------------------------------

> ------
> Introducing AppDynamics Lite, a free troubleshooting tool for
> Java/.NET
> Get 100% visibility into your production application - at no cost.
> Code-level diagnostics for performance bottlenecks with <2% overhead
> Download for free and get started troubleshooting in minutes.
>
>
http://p.sf.net/sfu/appdyn_d2d_ap1______________________________________
> _________
> Snort-users mailing list
> Snort...@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!

------------------------------------------------------------------------

se...@d2ms.com

unread,

May 2, 2013, 11:58:13 AM5/2/13

to

Thank you :)

Sent by BlackBerry

-----Original Message-----
From: waldo kitty <wkit...@windstream.net>
Date: Thu, 02 May 2013 11:51:40
To: <snort...@lists.sourceforge.net>
Subject: Re: [Snort-users] Network Variables

On 5/2/2013 07:50, Seth Dunn wrote:
> What is DAQ? I have seen that, but have no idea what that is.

DAQ == Data AcQuisition module

--
NOTE: No off-list assistance is given without prior approval.
Please keep mailing list traffic on the list unless
private contact is specifically requested and granted.

Seth Dunn

unread,

May 2, 2013, 1:04:52 PM5/2/13

to

Awesome call on that one Shane.
As I mentioned I am using notepad2
So I checked the settings on it, and they have an option where you can
choose how to handle line returns.
It was set to windows, which as you noted is CR-LF vs Unix which is LF
So I changed to LF, and tested.
Snort read the file and started.
I put in line 1 # This is a comment
And Line 2 was my rule

So that looks good now....I will do some playing with file now and see
if I can tune things a bit closer.

Thanks for throwing stuff out there.....you eventually find something.
:D

Subject: Re: [Snort-users] Network Variables

Yeah, it is a windows thing.....gotta love it. :D

-----Original Message-----
From: James Lay [mailto:jl...@slave-tothe-box.net]
Sent: Thursday, May 02, 2013 11:03 AM
To: Snort

Subject: Re: [Snort-users] Network Variables

> Subject: Re: [Snort-users] Network Variables
>

> Also of note.
> It seems that if snort starts with a bpf file configured....then for
> whatever reason, all traffic is no longer monitored, even though
> snort
> has started.
> So while this rule::
> not net 10.10.0.0/24 and dst host 10.75.45.1 && dst port 80 or not
> net
> 10.30.0.0/24 and dst host 10.75.45.1 && dst port 80
>
> is pretty specific.....
> I have another rule set in my local.rules file that should alert on
> any
> FTP attempt to IP 10.76.65.1....and if the bpf file is configured for
> snort, then the attempt is not alerted by snort.
> If I remove the bpf file from being used, then any FTP attempt is
> again
> alerted.
>
>
>
> From: James Lay [mailto:jl...@slave-tothe-box.net]
> Sent: Thursday, May 02, 2013 8:10 AM
> To: Snort

> Subject: Re: [Snort-users] Network Variables
>
>
>

> Quotation marks may be needed...try appending via command line as
> well.
>
>
>
> James
>
>
>

> On May 2, 2013, at 5:50 AM, Seth Dunn <se...@d2ms.com> wrote:
>
>
>
>
>
> What is DAQ? I have seen that, but have no idea what that is.
>

> As far as my bpf file goes, if it is like this::
>
>
>
> #not net 10.10.0.0/24 and not net 10.30.0.0/24
>
> not net 10.10.0.0/24 and dst host 10.75.45.1 && dst port 80 or not
> net
> 10.30.0.0/24 and dst host 10.75.45.1 && dst port 80
>
>
> It will fail with::
>
> Reading filter from bpf file: D:\Snort\etc\ignore2.bpf
>
> ERROR: short read D:\Snort\etc\ignore2.bpf (169 != 170)
>
> Fatal Error, Quitting..
>
>
>
> If I remove the commented line, then snort starts fine.
> If I try to have multiple lines in the file, (all being rules, no
> comments) the it will fail with a similar error as above.
> I have never seen a DAQ error.
>
>
>
> From: Russ Combs [mailto:rco...@sourcefire.com]
> Sent: Thursday, May 02, 2013 12:08 AM
> To: waldo kitty

> Cc: snort...@lists.sourceforge.net
> Subject: Re: [Snort-users] Network Variables
>
>
>

> Snort does allow comments in the BPF file, starting with # to end of
> line. If there is a syntax error, you should see something like:
>
>
>
> ERROR: Can't set DAQ BPF filter to '
>
> ...
>
> ' (pcap_daq_set_filter: pcap_compile: syntax error)!
>
> Fatal Error, Quitting..
>
>
>
> What DAQ are you using? Please send the BPF file that fails and the
> error that you get.
>
>
>
> On Wed, May 1, 2013 at 10:07 PM, waldo kitty
> <wkit...@windstream.net>
> wrote:
>
> On 5/1/2013 13:09, Seth Dunn wrote:
>> But any ideas why snort fails to start if I add in a '#' to comment
>> a
>> line??
>
> i have no clue but it sounds like a coding error not allowing comment
> lines i the BPF file... only joel or one of the snort dev guys can
> tell
> us that... or possibly a code diver who can root around in the snort
> code ;)
>
>

Seth Dunn

unread,

May 2, 2013, 1:23:00 PM5/2/13

to

So now my question comes, since you were wondering about the rule I was
using.
This is my rule::

not net 10.10.0.0/24 and dst host 10.75.45.1 && dst port 80 or not net
10.30.0.0/24 and dst host 10.75.45.1 && dst port 80

By my understanding, and my desire to see happen is this.
Traffic from the network 10.10.0.0/24 going to http at 10.75.45.1 should
be ignored.
Also, traffic from the network 10.30.0.0/24 going to http at 10.75.45.1
should be ignored.
All other traffic is still monitored.

Is this correct, base on the rule above, or should it be worded another
way?

beenph

unread,

May 2, 2013, 1:32:45 PM5/2/13

to

This might help you Seth

http://biot.com/capstats/bpf.html

James Lay

unread,

May 2, 2013, 1:35:34 PM5/2/13

to

Parenthesis will help:

"not (net 10.10.0.0/24 && dst host 10.75.45.1 && dst port 80) or (not
net 10.30.0.0/24 && dst host 10.75.45.1 && dst port 80)"

James

On 2013-05-02 11:23, Seth Dunn wrote:
> So now my question comes, since you were wondering about the rule I
> was
> using.
> This is my rule::
> not net 10.10.0.0/24 and dst host 10.75.45.1 && dst port 80 or not
> net
> 10.30.0.0/24 and dst host 10.75.45.1 && dst port 80
>
> By my understanding, and my desire to see happen is this.
> Traffic from the network 10.10.0.0/24 going to http at 10.75.45.1
> should
> be ignored.
> Also, traffic from the network 10.30.0.0/24 going to http at
> 10.75.45.1
> should be ignored.
> All other traffic is still monitored.
>
> Is this correct, base on the rule above, or should it be worded
> another
> way?

Seth Dunn

unread,

May 2, 2013, 1:39:09 PM5/2/13

to

Ok, I will give that a shot.

-----Original Message-----
From: James Lay [mailto:jl...@slave-tothe-box.net]
Sent: Thursday, May 02, 2013 1:36 PM
To: snort...@lists.sourceforge.net
Subject: Re: [Snort-users] Network Variables

Seth Dunn

unread,

May 2, 2013, 2:08:15 PM5/2/13

to

Ok, I set up my bpf file like you suggested, but it isn't working.
Just got this alert::
May 02 14:05:35 CX-Management snort: [1:9990003:1] NT2-SQL
Injection-Exec [Classification: Web Application Attack] [Priority: 1]
{TCP} 10.30.0.21:37215 -> 10.75.45.1:80

waldo kitty

unread,

May 2, 2013, 3:00:04 PM5/2/13

to

On 5/2/2013 13:23, Seth Dunn wrote:
> So now my question comes, since you were wondering about the rule I was
> using.
> This is my rule::

> not net 10.10.0.0/24 and dst host 10.75.45.1&& dst port 80 or not net

> 10.30.0.0/24 and dst host 10.75.45.1&& dst port 80

ok, i'm going to try to break this down and interpret your wants one section at
a time...

> By my understanding, and my desire to see happen is this.
> Traffic from the network 10.10.0.0/24 going to http at 10.75.45.1 should
> be ignored.

(net 10.10.0.0/24 and (host 10.75.45.1 and port 80))

> Also, traffic from the network 10.30.0.0/24 going to http at 10.75.45.1
> should be ignored.

(net 10.30.0.0/24 and (host 10.75.45.1 and port 80))

> All other traffic is still monitored.

the above should qualify your two wants... now, let's streamline them a bit to
make it more legible...

first, let's combine the two source networks into one statement...

net (10.10.0.0/24 or 10.30.0.0/24)

now the destination host and destination port...

host 10.75.45.1 and port 80

then combine those two lines...

net (10.10.0.0/24 or 10.30.0.0/24) and host 10.75.45.1 and port 80

and lastly negate the whole thing by enclosing it in parens with 'not' on the
outside...

not (net (10.10.0.0/24 or 10.30.0.0/24) and host 10.75.45.1 and port 80)

plug that line into your bpf with the double quotes or whatever you need to wrap
around it and see what happens ;)

FWIW: this was minimally tested on my network via tcpdump and manually checking
the pcap with wireshark...

NOTES:
1. using 'src net' and 'dst host' plus 'dst port' resulted in only the traffic
/to/ the server being ignored but all the traffic from the server was seen...

2. removing the 'src' and 'dst' designators denotes all traffic in both
directions that fits the mask (if i can use that term to describe this object)...

--
NOTE: No off-list assistance is given without prior approval.
Please keep mailing list traffic on the list unless
private contact is specifically requested and granted.

------------------------------------------------------------------------------

Get 100% visibility into Java/.NET code with AppDynamics Lite
It's a free troubleshooting tool designed for production
Get down to code-level detail for bottlenecks, with <2% overhead.

Download for free and get started troubleshooting in minutes.

http://p.sf.net/sfu/appdyn_d2d_ap2

James Lay

unread,

May 2, 2013, 3:08:07 PM5/2/13

to

Nicely done Waldo.

James

Seth Dunn

unread,

May 2, 2013, 3:24:09 PM5/2/13

to

Yes, as James said, thanks for breaking it down.
Very instructive.

I have configured my bpf file as you suggested::

not (net (10.10.0.0/24 or 10.30.0.0/24) and host 10.75.45.1 and port 80)

Snort starts and is running, so I will watch it and see how things go.

Since this is in a file, I don't have to do quotes there, only if I run it from the command line.
The problem with the bpf file was what Shane suggested earlier, how the text editor was handling the end of line character. Snort, (I am guessing the bpf engine it uses) does not like the Windows style characters...it is only configured for *nix style editors. May be something they want to address in future releases....because it is an odd problem and one I didn't immediately think of (obviously)....especially since the snort.conf file is read fine.

Thanks again to all for the help and information on this....it has been very enlightening.

-----Original Message-----
From: waldo kitty [mailto:wkit...@windstream.net]
Sent: Thursday, May 02, 2013 3:00 PM
To: snort...@lists.sourceforge.net; Seth Dunn
Subject: Re: [Snort-users] Network Variables

waldo kitty

unread,

May 2, 2013, 3:28:05 PM5/2/13

to

On 5/2/2013 15:08, James Lay wrote:
> Nicely done Waldo.

thank ya kindly, sir!

it's my programmer/analyst aspect that comes out at times ;)

i hope it works for seth's network in the way he wants it to... my testing
seemed to indicate that it did WAD (Work As Desired) on my networks and servers
while googlebot was slurping about and other traffic was flowing... i saw
traffic to/from those networks to/from that host but none to/from port 80 of
that host...

we really just needed to see exactly what was wanted in a clear and concise
statement rather than generalities like we get so many times :)

> James
>
> On 2013-05-02 13:00, waldo kitty wrote:

waldo kitty

unread,

May 2, 2013, 3:35:25 PM5/2/13

to

On 5/2/2013 15:24, Seth Dunn wrote:
> Yes, as James said, thanks for breaking it down. Very instructive.

you are welcome... sometimes we have to back up from the forest to see
everything clearly and then we can take small bites out of its arse as needed :P

> I have configured my bpf file as you suggested:: not (net (10.10.0.0/24 or

> 10.30.0.0/24) and host 10.75.45.1 and port 80)
>

> Snort starts and is running, so I will watch it and see how things go.

good deal... and since you figured out the EoL problem was the culprit, i
suggest you place some comment lines explaining what that object mask does for
you just in case you have to add others and/or someone else needs to maintain
the setup ;)

> Since this is in a file, I don't have to do quotes there, only if I run it
> from the command line. The problem with the bpf file was what Shane suggested
> earlier, how the text editor was handling the end of line character. Snort,
> (I am guessing the bpf engine it uses) does not like the Windows style
> characters...it is only configured for *nix style editors. May be something
> they want to address in future releases....because it is an odd problem and
> one I didn't immediately think of (obviously)....especially since the
> snort.conf file is read fine.

as i wrote to you in private, good catch on that... now we can only hope that
the maintainers handle that problem so that it doesn't rear its head and bite
someone else :)

> Thanks again to all for the help and information on this....it has been very
> enlightening.

i'm glad it has helped and i hope that others gain some insight, too :)

Seth Dunn

unread,

May 2, 2013, 3:42:49 PM5/2/13

to

Yep, I plan to comment, because I am sure that it will be me coming back
to the file sometime later and totally forgetting everything. :D

I have also update the forum over at WinSnort, so that anyone else that
is setting it up on Windows will be aware of the issue.

-----Original Message-----
From: waldo kitty [mailto:wkit...@windstream.net]
Sent: Thursday, May 02, 2013 3:35 PM
To: snort...@lists.sourceforge.net
Subject: Re: [Snort-users] Network Variables