|
Sujet : [NT4] Verouillage d'un compte inexpliqué !! Aide sur SNORT?? |
| Pims |
Bon, je me lance dans SNORT !!!
Mais c'est pas évident evident ...
Surtout sous win2k :??:
Premierement il a fallu que je récupère deux DLL que je n'avais pas ... ensuite il me tape une erreur bizarre à chaque fois:
Code :
- D:\Snort>snort -W
- Initializing Output Plugins!
- -*> Snort! <*-
- Version 1.9.0-ODBC-MySQL-WIN32 (Build 209)
- By Martin Roesch (roesch@sourcefire.com, www.snort.org)
- 1.7-WIN32 Port By Michael Davis (mike@datanerds.net, www.datanerds.net/~mike)
- 1.8-1.9 WIN32 Port By Chris Reid (chris.reid@codecraftconsultants.com)
- Interface Device Description
- -------------------------------------------
- 1 \Device\Packet_{0EE35F58-B5C1-414F-BAD5-E4380B6BC0B7} (Unknown)
- 2 \Device\Packet_NdisWanIp (Unknown)
|
-----------------------------------
Code :
- D:\Snort>snort -i 1
- Initializing Output Plugins!
- Log directory = log
- Initializing Network Interface \
- ERROR: OpenPcap() device \Device\Packet_{0EE35F58-B5C1-414F-BAD5-E4380B6BC0B7} open:
- Error opening adapter: Le fichier spÚcifiÚ est introuvable.
- Fatal Error, Quitting..
|
-----------------------------------
Code :
- D:\Snort>snort -i 2
- Initializing Output Plugins!
- Log directory = log
- Initializing Network Interface \
- ERROR: OpenPcap() device \Device\Packet_NdisWanIp open:
- Error opening adapter: Le fichier spÚcifiÚ est introuvable.
- Fatal Error, Quitting..
|
-----------------------------------
Mais que ce passe t il ?
Ci joint: l'aide:
Code :
- D:\Snort>snort -?
- Initializing Output Plugins!
- -*> Snort! <*-
- Version 1.9.0-ODBC-MySQL-WIN32 (Build 209)
- By Martin Roesch (roesch@sourcefire.com, www.snort.org)
- 1.7-WIN32 Port By Michael Davis (mike@datanerds.net, www.datanerds.net/~mike)
- 1.8-1.9 WIN32 Port By Chris Reid (chris.reid@codecraftconsultants.com)
- USAGE: snort [-options] <filter options>
- snort /SERVICE /INSTALL [-options] <filter options>
- snort /SERVICE /UNINSTALL
- snort /SERVICE /SHOW
- Options:
- -A Set alert mode: fast, full, console, or none (alert file alerts only)*
- "unsock" enables UNIX socket logging (experimental).
- -a Display ARP packets
- -b Log packets in tcpdump format (much faster!)
- -c <rules> Use Rules File <rules>
- -C Print out payloads with character data only (no hex)
- -d Dump the Application Layer
- -D Run Snort in background (daemon) mode
- -e Display the second layer header info
- -E Log alert messages to NT Eventlog. (Win32 only)
- -f Turn off fflush() calls after binary log writes
- -F <bpf> Read BPF filters from file <bpf>
- -g <gname> Run snort gid as <gname> group (or gid) after initialization*
- -G <mode> Add reference ids back into alert msgs (modes: basic, url)
- -h <hn> Home network = <hn>
- -i <if> Listen on interface <if>
- -I Add Interface name to alert output
- -l <ld> Log to directory <ld>
- -m <umask> Set umask = <umask>
- -n <cnt> Exit after receiving <cnt> packets
- -N Turn off logging (alerts still work)
- -o Change the rule testing order to Pass|Alert|Log
- -O Obfuscate the logged IP addresses
- -p Disable promiscuous mode sniffing
- -P <snap> set explicit snaplen of packet (default: 1514)
- -q Quiet. Don't show banner and status report
- -r <tf> Read and process tcpdump file <tf>
- -R <id> Include 'id' in snort_intf<id>.pid file name
- -s <server:port> Log alert messages to syslog server (default port: 514) -S <n=v> Set rules file variable n equal to value
- v
- -t <dir> Chroots process to <dir> after initialization
- -T Test and report on the current Snort configuration
- -u <uname> Run snort uid as <uname> user (or uid) after initialization*
- -U Use UTC for timestamps
- -v Be verbose
- -V Show version number
- -W Lists available interfaces. (Win32 only)
- -w Dump 802.11 management and control frames
- -X Dump the raw packet data starting at the link layer
- -y Include year in timestamp in the alert and log files
- -z Set assurance mode, match on established sesions (for TCP)
- -? Show this information
- <Filter Options> are standard BPF options, as seen in TCPDump
- * denotes an option that is NOT SUPPORTED in this WIN32 port of snort.
|
|
