<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=unicode" /> <meta http-equiv="Content-Language" content="en-us" /> <title>Testing Snort and Basic Analysis and Security Engine (BASE) on Windows system</title> <style> <!-- p.MsoNormal {margin-top:0mm; margin-right:0mm; margin-bottom:10.0pt; margin-left:0mm; line-height:115%; font-size:12.0pt; font-family:"Times New Roman","serif";} a:link {color:blue; text-decoration:underline;} a:visited {color:purple; text-decoration:underline;} p {margin-right:0mm; margin-left:0mm; font-size:12.0pt; font-family:"Times New Roman","serif";} ol {margin-bottom:0mm;} h1 {margin-top:12.0pt; margin-right:0mm; margin-bottom:3.0pt; margin-left:0mm; page-break-after:avoid; font-size:16.0pt; font-family:Arial;} --> </style> <meta name="keywords" content="database, intrusion detection system, services, security, data, analysis, tools, packets, TCP/IP, downloads, opensource" /> <meta name="description" content="a complete tutorial on how to install, setup and test Snort and Basic Analysis and Security Engine (BASE) with MySQL database on Windows system" /> </head> <body lang="EN-US" link="#0000FF" vlink="#800080" topmargin="20" leftmargin="20" rightmargin="20" bottommargin="20"> <div class="WordSection1"> <h1 align="center" style="margin-top: 0; margin-bottom: 0"> <span style="font-weight: 400"><font size="4">&lt; <span style="text-decoration: none"><font color="#000000"> <a title="BASE, Snort Tables and PEAR" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpbaseperladodb11.html"> BASE, Snort Tables and PEAR</a></font></span> | <a title="Java and open source - information, tutorials, install, setup, configure" target="_top" href="http://www.javaguicodexample.com/"> Java &amp; Friends</a>&nbsp; | <span style="text-decoration: none"> <font color="#000000"> <a title="Perl and Oinkmaster - Snort Rules Update Tool" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpbaseperladodb13.html"> Perl and Oinkmaster - Snort Rules Update Tool</a></font></span> &gt;</font></span></h1> <hr noshade color="#FF3300" /> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <h1 align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><span style="font-weight: 400"><font face="Arial" size="6">Testing Snort and BASE with Errors Troubleshooting</font></span></h1> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font face="Arial">What do we have in this session?</font></b></p> <ol> <li> <h1 style="margin-bottom:0mm;margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font face="Arial" size="3">Testing BASE and Snort</font></span></h1> </li> <li> <h1 style="margin-bottom:0mm;margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font face="Arial" size="3">BASE and MySQL Errors</font></span></h1> </li> <li> <h1 style="margin-bottom:0mm;margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font face="Arial" size="3">More Errors</font></span></h1> </li> </ol> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt" align="center"> <script type="text/javascript"><!-- google_ad_client = "pub-8089415323104206"; /* 728x90, created 5/16/08 javaos */ google_ad_slot = "1917524460"; google_ad_width = 728; google_ad_height = 90; //--> </script> &nbsp;<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%; font-weight:bold">Testing BASE and Snort</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> First of all, let run snort manually (we failed to run it as the Windows s service previously!). Choose appropriate interface (NIC) that having traffic.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="789" height="319" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp178.png" alt="Viewing the available interfaces on the machine using Snort -W" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> We use the WAN (PPP/SLIP) interface in this case interface #4 (running in IDS mode). Execute the following Snort s command. </span></font> <font face="Courier New"><span style="font-family:&quot;Arial&quot;">-p</span></font><font face="Arial"> option is for promiscuous mode.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">C:\&gt;snort -c c:\snort\etc\snort.conf -l c:\snort\log -v -i4  p</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> When there are activities, the verbose should be visible.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="637" height="319" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp179.png" alt="Running snort with the snort -c c:\snort\etc\snort.conf -l c:\snort\log -v -i4  p command showing the sample output on the Windows console" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%; font-weight:bold">BASE and MySQL Errors</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Then, browse to <b>http://localhost/base-1.4.5/base_main.php</b> to interact with the BASE webpage. Well, we encounter the following errors. Look like the connection to mysql failed miserably. The <a href="http://www.google.com.my/#hl=en&ei=j1MCTI2GLoO7rAf1yOQ8&sa=X&oi=spellfullpage&resnum=0&ct=result&cd=1&ved=0CBMQvgUoAA&q=Warning%3A+mysql_pconnect%28%29%3A+[2002]+A+connection+attempt+failed+because+the+connected+party+did+not+%28trying&nfpr=1&fp=b93023eccf" target="_blank" title="error on connection to mysql"> errors information can be found in Google</a>.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><i> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; font-style:italic">...Notice: Undefined index: QUERY_STRING in C:\Inetpub\wwwroot\base-1.4.5\includes\base_state_criteria.inc.php on line 248 Warning: mysql_pconnect(): [2002] A connection attempt failed because the connected party did not (trying to connect via tcp://localhost:3306) in C:\PHP\adodb5\drivers\adodb-mysql.inc.php on line 383 Warning: mysql_pconnect(): A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. in C:\PHP\adodb5\drivers\adodb-mysql.inc.php on line 383 Fatal error: Maximum execution time of 30 seconds exceeded in C:\PHP\adodb5\drivers\adodb-mysql.inc.php on line 383 PHP Notice: Undefined index: QUERY_STRING in C:\Inetpub\wwwroot\base-1.4.5\includes\base_state_criteria.inc.php on line 248 PHP Warning: mysql_pconnect(): [2002] A connection attempt failed because the connected party did not (trying to connect via tcp://localhost:3306) in C:\PHP\adodb5\drivers\adodb-mysql.inc.php on line 383 PHP Warning: mysql_pconnect(): A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. in C:\PHP\adodb5\drivers\adodb-mysql.inc.php on line 383 PHP Fatal error: Maximum execution time of 30 seconds exceeded in C:\PHP\adodb5\drivers\adodb-mysql.inc.php on line 383...</span></font></i></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Then, as suggested, we change all the &#39;localhost&#39; occurrences to &#39;127.0.0.1&#39; (without the single quote) in base_conf.php file. These errors should be resolved if we setup BASE, mySQL, PHP etc on the real server that having real domain name. Then, reopen the URL.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="1047" height="743" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp180.png" alt="Basic Analysis and Security Engine (BASE) in action loaded through Internet browser" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%; font-weight:bold">More Errors</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Well, less errors! At the top page, we have the following errors.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><i> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; font-style:italic">Notice: Undefined index: QUERY_STRING in C:\Inetpub\wwwroot\base-1.4.5\includes\base_state_criteria.inc.php on line 248 Notice: Undefined index: REQUEST_URI in C:\Inetpub\wwwroot\base-1.4.5\includes\base_output_html.inc.php on line 92</span></font></i></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> And at the bottom with the following errors.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><i> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; font-style:italic">PHP Notice: Undefined index: QUERY_STRING in C:\Inetpub\wwwroot\base-1.4.5\includes\base_state_criteria.inc.php on line 248 PHP Notice: Undefined index: REQUEST_URI in C:\Inetpub\wwwroot\base-1.4.5\includes\base_output_html.inc.php on line 92</span></font></i></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> When there is no data, errors will be thrown. To resolve these errors, re-open base_state_criteria.inc.php and find line 248. Replace the original code:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%">$query_string = CleanVariable($_SERVER[&quot;QUERY_STRING&quot;], VAR_PERIOD | VAR_DIGIT | VAR_PUNC | VAR_LETTER);</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> With the following and save the file.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%">$query_string = CleanVariable(<font color="red"><span style="color:red">(isset($_SERVER[&quot;QUERY_STRING&quot;]) ? $_SERVER[&quot;QUERY_STRING&quot;] : &#39;&#39;)</span></font>, VAR_PERIOD | VAR_DIGIT | VAR_PUNC | VAR_LETTER);</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Next, open base_output_html.inc.php file find code on line 92. Replace the original code:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%">htmlspecialchars(CleanVariable($_SERVER[&quot;REQUEST_URI&quot;], VAR_FSLASH | VAR_PERIOD | VAR_DIGIT | VAR_PUNC | VAR_LETTER), ENT_QUOTES).&#39;&quot;&gt;&#39;.&quot;\n&quot;;</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> With the following and save the file.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%">htmlspecialchars(CleanVariable(<font color="red"><span style="color:red">(isset($_SERVER[&quot;REQUEST_URI&quot;]) ? $_SERVER[&quot;REQUEST_URI&quot;] : &#39;&#39;)</span></font>, VAR_FSLASH | VAR_PERIOD | VAR_DIGIT | VAR_PUNC | VAR_LETTER), ENT_QUOTES).&#39;&quot;&gt;&#39;.&quot;\n&quot;;</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Then let do a simple customization by changing the following code in </span> </font><font face="Courier New"><span style="font-family:&quot;Arial&quot;"> base_main.php</span></font><font face="Arial"> to enable the custom footer. A simple custom sample footer is under <b><span style="font-weight:bold">contrib</span></b> sub folder.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%">/* Custom footer addition.&nbsp; The below variable, if set, will cause</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%">&nbsp;*&nbsp; base_main.php to include whatever file is specified.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%">&nbsp;*&nbsp; A sample custom footer file is in the contrib directory</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%">&nbsp;*/</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" color="red" face="Courier New"> <span style="font-size:12.0pt; line-height:115%;color:red">$base_custom_footer = &#39;/contrib/custom_base_footer.php&#39;;</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Reload the base_main.php file from browser.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="1086" height="716" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp181.png" alt="Reloading Basic Analysis and Security Engine (BASE) through Internet browser" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Those errors vanished! Everything looks fine! Click one of the links, for example any protocol.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="605" height="377" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp182.png" alt="Testing a link in Basic Analysis and Security Engine (BASE) GUI" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt" align="center"> -------------------------------------------------------------</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt" align="center"> <script type="text/javascript"> <!-- google_ad_client = "pub-8089415323104206"; /* 300x250, created 5/16/08javaos */ google_ad_slot = "8146009330"; google_ad_width = 300; google_ad_height = 250; //--> </script> &nbsp;<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt" align="center"> <font face="Arial"> ----------------------------------------------------------------------</font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="873" height="383" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp183.png" alt="Anothe PHP warning of the Basic Analysis and Security Engine (BASE)" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> At bottom of the page, there are more errors.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><i> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; font-style:italic">Warning: Unknown: 1 result set(s) not freed. Use mysql_free_result to free result sets which were requested using mysql_query() in Unknown on line 0 PHP Warning: Unknown: 1 result set(s) not freed. Use mysql_free_result to free result sets which were requested using mysql_query() in Unknown on line 0</span></font></i></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> To resolve these non-critical warnings, re-open php.ini file. Find the following code.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-size:12.0pt;">; Trace mode. When trace_mode is active (=On), warnings for table/index scans and</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-size:12.0pt;">; SQL-Errors will be displayed.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-size:12.0pt;">; http://php.net/mysql.trace-mode</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-size:12.0pt;">mysql.trace_mode = On</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Turn off mysql.trace_mode.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-size:12.0pt;">; Trace mode. When trace_mode is active (=On), warnings for table/index scans and</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-size:12.0pt;">; SQL-Errors will be displayed.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-size:12.0pt;">; http://php.net/mysql.trace-mode</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-size:12.0pt;">mysql.trace_mode = Off</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> mysql_free_result() will free all memory associated with the result identifier result and only needs to be called if you are concerned about how much memory is being used for queries that return large result sets. All associated result memory is automatically freed at the end of the script&#39;s execution. </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Save the file and reload the base_main.php and try any links.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="823" height="525" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp184.png" alt="Basic Analysis and Security Engine (BASE) in action with no more error" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Hmmm, no more errors when clicking any links. Click another link, as in this case, 1. </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="728" height="545" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp185.png" alt="Basic Analysis and Security Engine (BASE) - another PHP notices" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Another PHP Notice& .However these also are non critical errors which can be suppressed by modifying the </span></font><font face="Courier New"> <span style="font-family: &quot;Arial&quot;">error_reporting</span></font><font face="Arial"> variable in php.ini file that can be found at:</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">http://php.net/error-reporting</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="699" height="151" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp186.png" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> A lot of configuration options for Snort, BASE, PHP and also mysql were not covered in this lengthy tutorial. However we have successfully demonstrated how to run Snort with BASE (together with other required &#39;friends&#39; such as PHP, MySQL and IIS server.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> This was intended to be a how-to on getting all these thingies running on Windows XP Pro SP2. There are many other considerations to take into account such as where to place the IDS sensor on the network, refined configuration of Snort and Snort rules, setting up SMTP alert notifications in BASE, security implications and many more. Those things should be customized to your organization needs.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;<div align="center"><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=728X90&cwpid=527221&cwwidth=728&cwheight=90&cwpnet=1&cwtagid=85440"></script></div></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <hr noshade color="#FF3300" /> <p class="MsoNormal" style="margin-top: 0; margin-bottom: 0" align="center"> <script type="text/javascript"><!-- google_ad_client = "pub-8089415323104206"; google_ad_slot = "3545464564"; google_ad_width = 728; google_ad_height = 15; //--> </script> &nbsp;<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script></p> <h1 align="center" style="margin-top: 0; margin-bottom: 0"> <span style="font-weight: 400"><font size="4">&lt; <span style="text-decoration: none"><font color="#000000"> <a title="BASE, Snort Tables and PEAR" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpbaseperladodb11.html"> BASE, Snort Tables and PEAR</a></font></span> | <a title="Java and open source - information, tutorials, install, setup, configure" target="_top" href="http://www.javaguicodexample.com/"> Java &amp; Friends</a>&nbsp; | <span style="text-decoration: none"> <font color="#000000"> <a title="Perl and Oinkmaster - Snort Rules Update Tool" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpbaseperladodb13.html"> Perl and Oinkmaster - Snort Rules Update Tool</a></font></span> &gt;</font></span></h1> </div> </body> </html>