Uncommon_security
Uncommon_security

Reputation: 11

Snort not detecting Pings with other devices

I have a problem with Snort, I've just installed the program on a R-Pi. 2 other computers on the same network can ping the R-Pi with success.

However I had the idea that snort was able to be run in Promiscuous mode meaning that it can see all traffic in a local network... without needing to run it inline in the network. When i try ping the other two computers in the same network Snort does not pick this up.

Changes i have tried....

Ruleset set to -

alert icmp any any -> any any 

Config file set to -

ipvar HOME_NET 192.168.43.0/32 (<this is my home network range)

Upvotes: 1

Views: 3476

Answers (3)

thweild
thweild

Reputation: 1

In the VirtualBox, after setting promiscuous mode you may need to reboot your virtual machine.

Upvotes: 0

If you're using a virtual machine, make sure that your network configuration is setup as bridged adapter and promiscuous mode is enabled in your virtual machine with snort.

I'm using virtual box and this is how it looks like:

network config

Upvotes: 2

AlexSin
AlexSin

Reputation: 1

Does Snort start up correctly? If the whole rule is given in the question, then perhaps the SID for it was not indicated.

You can try:

alert tcp any any -> any any (msg: "Just a test alert"; sid:1000001;)

Upvotes: 0

Related Questions