snort-users May 2011 archive
Main Archive Page > Month Archives  > snort-users archives
snort-users: [Snort-users] Testing IPTABLES (Snort Inline Mode,

[Snort-users] Testing IPTABLES (Snort Inline Mode, NFQUEUE, Local Rules) No alerts!

From: turki <turki_00_at_nospam>
Date: Fri May 20 2011 - 15:54:24 GMT

Snort: (inline mode with single interface eth0 using NFQ)
DAQ: 0.5

Problem: Snort/Barnyard2 is not reporting any alerts to the following local rule (simple http traffic)


alert tcp any any <> any any (content:""; msg:"NO YAHOO 4U"; sid:1000006;rev:1;)

Iptables configuration:

> iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
NFQUEUE icmp -- anywhere anywhere NFQUEUE num 0
NFQUEUE tcp -- anywhere anywhere tcp dpt:www NFQUEUE
num 0
ACCEPT all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
NFQUEUE tcp -- anywhere anywhere tcp spt:www NFQUEUE
num 0


Command to Run Snort:

> snort --daq nfq -Q -c snort.conf --daq-dir /usr/local/lib/daq --daq-var device=eth0

I am running the following command to trigger the rule:


Snort in PCAP mode is reporting alerts with the same rules, but the problem that in inline it is not.

Can you help me, please

What Every C/C++ and Fortran developer Should Know!
Read this article and learn how Intel has extended the reach of its
next-generation tools to help Windows* and Linux* C/C++ and Fortran
developers boost performance applications - including clusters.

Snort-users mailing list
Go to this URL to change user options or unsubscribe:
Snort-users list archive: