error while installing the winsnort...

hi.. i am new user for the winsnort... while i installing winsnort.. i found out this error while i typed c:\snoty\bin\snort -v -i1

then it show the result after ctrl c

.......
.......
.......
.......
pcap_loop: read error: PacketReceivePacket failed
Run time for packet proccessing was 12.928000 seconds

i m using for the winpcap 3.0..

The winsnort can't work when i try to skip this error and continue the process. when i try to run the winsnort, this error happen.

could not start the snort service on local computer
Error 1067: The process terninated unexpectedly.

thx for helping me....

have you read the README file that came with snort...if I remember correctly you have to move some files around and download an extra file from somewhere for it to work.

u mean tat install for the winpcap issit, i using winpcap ver 3.0 now.. i tried to reinstall for few times also cannot solve this error.. thx for helping me...

run

Snort -T

(Note the capitalization).... and copy and paste the results here please if it errors out.

no, there is a seperate dll you need to donwload from some webpage. it is in the readme file, im just not on my laptop where i have all my "auditing" software, so I cant look it up for you.

I ran into the same problem with my install, You need a patch if you are using it on a wireless card or you need to manually switch the card into monitor mode so it acts like an ethernet interface. The Pcap loop error happens when you use an interrupt ( Ctrl + C, etc ) and that is because you are forcing the process to quit so that is normal. Make sure you are reciving packets by typing snort -dv and see if you see packets...you should instantly.

hi all... after i typed the snort -T.. it show that no such file or directory... issit mean that i less something??

while i reboot my system, in the task manager i only can find mysql-nt.exe and winmysqladmin.exe but just don have the snort.exe. i been set 'Automatic' in the service applet...

plz let me know what can i do now.. :eek:

When you type snort -T at the command prompt you either have to have changed to the snort directory _or_ have set your path to indicate the snort directory as part of it.

You seem to have MySQL installed correctly but you aren't referencing snort properly.

To be honest, your inability to have worked your way past the "No such file or directory" error message indicates that the benefits you might gain by installing snort are going to be far outweighed by the amount of time it takes you to get it running properly. Then, once you get it running properly your are unlikely to understand it's output which will simply stress you out and possibly cause you to take actions that might be destructive and unnecessary.

I would consider using something like ZoneAlarm or a similar free product for your actual defenses and try and find a different box that you can play with snort on until you get a better grasp of computing in general

My $2

hi, Tiger Shark.. really sorry for trouble u.. but i just follow the referencing to the
http://www.winsnort.com/modules.php?...artid=2&page=1

i just following all the steps, i really try to learn on it but just don know what happening..

why not just use the snort from snort.org

They have a windows installer now.
I just installed it on a new systems no problems no hassles.

hi, S3cur|ty4ng31. i downloaded for the snort-2.3.3 but i just can't get any Win32 distribution that for referencing. can u direct me to the referen tat can help me function the snort.. thx for helping...

heres a direct link
Latest Win32 Snort Installer Package

you will still need to get WinPcap 3.0 if you havent already
WinPcap 3.0

If you decide not to take TS's advice and go for something simplier...I'd advise you check out this site...

http://archives.neohapsis.com/archiv...4-07/0445.html
Neohapsis Archives - Snort Discuss - #0445 - RE: [Snort-users] No Alerts in Windows w/ Snort 2.20 RC1

Eg ;)

Snail: You weren't "troubling me".

The simple fact is that your inability to get the system working doesn't bode well for your ability to understand it's output.

Simple questions for you to ask to yourself:-

1. If you go through the Snort rules one by one without even looking at the documentation for each rule can you determine from the rule what it is detecting, why and what the potential consequences are?

2. Then try reading the documentation for each rule and see if you can work out the same.

3. Even if you manage to work it out can you determine how you would find out if the attack were successful or not?

Snort is not and Intrusion Prevention System. It does _nothing_ to protect you... It doesn't care about you or your security policy... It simply sits there and watches the data stream and giggling every time it sees an exploit fly by. Yes, it'll tell you "Guess what, Skiddie #7 just attacked your primary web server with <insert exploit here>.... Buuuuummer....."

Learning about it is all very well and I applaud you for it.... If you study Snort as a vehicle to understand networking, exploits, information gathering etc. then good.... great.... But don't try to use it as a defensive system without using actual defensive systems that work automatically without any input by you.

If you do it'll end in tears......

'nuff said?