<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=unicode" /> <meta http-equiv="Content-Language" content="en-us" /> <title>Editing and testing Snort new configuration and rules, setting up Snort as Windows service</title> <style> <!-- p.MsoNormal, li.MsoNormal {margin-top:0mm; margin-right:0mm; margin-bottom:10.0pt; margin-left:0mm; line-height:115%; font-size:12.0pt; font-family:"Times New Roman","serif";} a:link {color:blue; text-decoration:underline;} a:visited {color:purple; text-decoration:underline;} p {margin-right:0mm; margin-left:0mm; font-size:12.0pt; font-family:"Times New Roman","serif";} ol {margin-bottom:0mm;} h1 {margin-top:12.0pt; margin-right:0mm; margin-bottom:3.0pt; margin-left:0mm; page-break-after:avoid; font-size:16.0pt; font-family:Arial;} --> </style> <meta name="keywords" content="services, applications, technology, Snort, IDS, intrusion, detection, data, applications, database, system, configurations" /> <meta name="description" content="Testing Snort with new config file and rules. also included are the steps on how to install Snort as Windows service. However we failed with meaningless messages" /> </head> <body lang="EN-US" link="#0000FF" vlink="#800080" topmargin="20" leftmargin="20" rightmargin="20" bottommargin="20"> <div class="WordSection1"> <h1 align="center" style="margin-top: 0; margin-bottom: 0"> <span style="font-weight: 400"><font size="4">&lt; <span style="text-decoration: none"><font color="#000000"> <a title="Snort and MySQL Database" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpbaseperladodb8.html"> Snort and MySQL Database</a></font></span> | <a title="Java and open source - information, tutorials, install, setup, configure" target="_top" href="http://www.javaguicodexample.com/"> Java &amp; Friends</a>&nbsp; | <span style="text-decoration: none"> <font color="#000000"> <a title="MySQL, PHP Code, Basic Analysis and Security Engine (BASE) and ADODB" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpbaseperladodb10.html"> MySQL, PHP Code, Basic Analysis and Security Engine (BASE) and ADODB</a></font></span> &gt;</font></span></h1> <hr noshade color="#FF3300" /> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <h1 align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><span style="font-weight: 400"><font face="Arial" size="6">Testing the New Snort<span style="line-height:115%;"> Configuration</span></font></span></h1> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font face="Arial">What do we have in this session?</font></b></p> <ol> <li> <h1 style="margin-bottom:0mm;margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">Testing the New Snort Configuration</font></span></h1> </li> <li> <h1 style="margin-bottom:0mm;margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">Configuring Snort as a Service (failed!)</font></span></h1> </li> </ol> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt" align="center"> <script type="text/javascript"><!-- google_ad_client = "pub-8089415323104206"; /* 728x90, created 5/16/08 javaos */ google_ad_slot = "1917524460"; google_ad_width = 728; google_ad_height = 90; //--> </script> &nbsp;<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%; font-weight:bold">Testing the New Snort Configuration</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Then, let test Snort with MySQL database. Issue the following command. Any error(s) should be visible.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">C:\&gt;snort -c c:\snort\etc\snort.conf -l c:\snort\log  i4 -T</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="717" height="434" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp140.png" alt="Testing new Snort config file from Windows command line" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Look likes all working properly.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="613" height="211" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp141.png" alt="MySQL database work properly for Snort" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%; font-weight:bold">Configuring Snort as a Service</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> In order to run Snort as a background service on Windows 2000, XP, 2003 and so on, you must know:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <ol style="margin-top:0mm" start="1" type="1"> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height: 115%">Where your config file is (in this case: C:\Snort\etc\snort.conf)</span></font></li> <li class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height: 115%">Where you want Snort to create its log file (in this case: C:\Snort\log)</span></font></li> </ol> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> We already have this information. When we added the database output configuration to the snort.conf file, we made Snort rely on MySQL. If we try to run Snort as a service without having MySQL installed and configured, the Snort service fails because it s looking for MySQL databases which we already &#39;told&#39; her through snort.conf. The following examples are a generic configuration. Your configuration may vary slightly and you should change accordingly.</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">Lastly we need to setup Snort to log to the Event Logs and to run as a service. This can be done easily by running the following command from a command prompt:</span></font></p> <p style="margin:0mm;margin-bottom:.0001pt"><font size="3" face="Arial"> <span style="font-size:12.0pt">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">C:\&gt;snort /SERVICE /INSTALL -l C:\Snort\log -c C:\Snort\etc\snort.conf -i2 -E</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> The following screenshots show the Snorts service options.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="637" height="271" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp142.png" alt="Showing Snort /SERVICE command options" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> The following screenshot shows how to install Snort as Windows service.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="661" height="241" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp143.png" alt="Running Snort command to install Snort as Service" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> The following is another example with interface #2 as the interface.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="661" height="241" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp144.png" alt="Another example on how to install Snort as Windows service" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> The following is another example.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="661" height="319" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp145.png" alt="More example on installing Snort as the Windows service" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> After the </span></font><span style="font-size:12.0pt;line-height:115%"> <font size="3" face="Courier New">/SERVICE /INSTALL</font><font size="3" face="Arial"> successfully run, Snort s service should be visible in Windows Services snap-in.</font></span></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="601" height="451" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp146.png" alt="Snort service seen in Windows service snap in" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Now, let start the Snort service. Select Snort service &gt; right-click mouse &gt; select Start menu.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="623" height="383" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp147.png" alt="Starting Snort Service from Windows Service snap-in" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Or, open Snort service s property page &gt; click the Start button. The following screenshot shows Snort s Properties page.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt" align="center"> <script type="text/javascript"> <!-- google_ad_client = "pub-8089415323104206"; /* 300x250, created 5/16/08javaos */ google_ad_slot = "8146009330"; google_ad_width = 300; google_ad_height = 250; //--> </script> &nbsp;<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt" align="center"> <font face="Arial">--------------------------------------------------------</font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="410" height="468" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp148.png" alt="Snort as Windows service property page" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Hmmm, we failed to start Snort service with the following error: <b> <span style="font-weight:bold">Error 5: Access is denied</span></b>.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="329" height="133" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp149.png" alt="Failed to start snort service on Windows machine" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Let view the actual error message from Windows Event Viewer. Open Windows Event Viewer &gt; double click the error.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="679" height="308" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp150.png" alt="Windows system error for Snort service start-up" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> The following screenshot shows the error details.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="404" height="455" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp151.png" alt="The details of Snort service failed to start seen in Windows Event properties page" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Let, restart the Windows machine. Hmmm& also fail to start Snort s service. <a href="http://www.google.com.my/search?q=could+not+start+snort+service+on+local+computer+error+5+access+is+denied&ie=utf-8&oe=utf-8&aq=t&client=firefox-a&rlz=1R1GGGL_en___MY355" target="_blank" title="could not start snort service on local computer error 5 access is denied"> No good answer from Mr. Google though</a>. We also have tried some solutions from <a href="http://www.winsnort.com/" target="_blank" title="Snort for Windows - WinSnort.com"> Winsnort.com</a>, also failed!</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> To verify Snort service from console, issue the following command.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">C:\&gt;snort /SERVICE /SHOW</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="645" height="169" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp152.png" alt="Viewing Snort service from Windows command line" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Well, Snort service correctly configured. Forget about the Snort as a Windows service, however, snort service won t start automatically. We need to run snort manually. As for other Windows services, if Snort s service run properly, the service should be visible in Windows Task Manager as shown below.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="622" height="455" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp153.png" alt="Snort service should be visible in Windows Task Manager if the service started successfully" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> The registry key looks fine and the permission already using LocalSystem.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="576" height="315" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp154.png" alt="Snort service seen as Windows registry keys" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="600" height="266" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp155.png" alt="Snort service details seen as Windows registry keys" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> The following paragraph extracted from Snort installation document. Look likes not much information provided for us to find the solutions.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><i> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; font-family:&quot;Arial&quot;;font-style:italic">&quot;...If you intend to run snort as a Win32 Service, ALWAYS run snort from the command line FIRST to ensure there are no configuration or rule errors. Snort will NOT report errors when run as a Service; it will simply abort providing no clue why it aborted. The syntax for running snort as a Service can be seen by simply executing snort from the command line (no command line parameters) and reviewing the first several lines displayed...&quot;</span></font></i></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font face="Arial">However one of our readers has tried and given the following &#39;tip&#39;. You can try the following steps and thank you for the feedback.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><i> <font face="Arial"><span style="background-color: #C0C0C0">Dear friend,</span></font></i></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><i> <font face="Arial"><span style="background-color: #C0C0C0">Today I found your website www.javaguicodexample.com and found it very interesting as it hosts lots of useful sysadmin articles centered around Windows platform. Thanks a lot for your efforts and great contribution to IT community. I am reading your article on Windows XP Pro SP2, Snort 2.8.6, MySQL and BASE for Fun (<a title="snort, iis, php, mysql, BASE, perl, ado and Windows XP tutorials" target="_top" href="http://www.javaguicodexample.com/snortiisphpmysqlbaseperladodbwinxp.pdf">snortiisphpmysqlbaseperladodbwinxp.pdf</a>) and have found on page number 51 that you have listed a command to install Snort as a Windows Service.</span></font></i></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <i><font face="Arial"><span style="background-color: #C0C0C0">C:\&gt;snort /SERVICE /INSTALL -l C:\Snort\log -c C:\Snort\etc\snort.conf -i2 -E</span></font></i></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><i> <font face="Arial"><span style="background-color: #C0C0C0">The command produces no error, because earlier in this PDF article, you have appended C:\Snort\bin in PATH environment variable so that snort may be called from any folder (here C:\ instead of C:\Snort\bin). If you launch Services.mmc snap-in, you will see that Snort is listed in services database, but if you try to start the service, it fails. The solution to the problem is that you should launch above command from C:\Snort\bin folder where snort.exe physically resides, even if you have modified the PATH environment variable. Then not only snort will be added to the Windows services database, you will also be able to start the service. Therefore issue following command.</span></font></i></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <i><font face="Arial"><span style="background-color: #C0C0C0"> C:\Snort\bin&gt;snort /SERVICE /INSTALL -l C:\Snort\log -c C:\Snort\etc\snort.conf -i2 -E</span></font></i></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><i> <font face="Arial"><span style="background-color: #C0C0C0">The command works perfectly on my PC, and hope it will also work on your Windows machine also.</span></font></i></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><i> <font face="Arial"><span style="background-color: #C0C0C0">Thanks again for your great efforts.</span></font></i></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><i> <font face="Arial"><span style="background-color: #C0C0C0">Best regards,</span></font></i></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><i> <font face="Arial"><span style="background-color: #C0C0C0">Babby Boss</span></font></i></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> To uninstall Snort service, issue the following command.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">C:\&gt;snort /SERVICE /UNINSTALL</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="693" height="241" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp156.png" alt="Uninstall Snort service from Windows command line" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> If the service is started and running, the Windows </span></font><b> <font face="Courier New"> <span style="font-family:&quot;Arial&quot;;font-weight:bold">net</span></font></b><font face="Arial"> command also can be used to start and/or stop the Snort service.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="437" height="223" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp157.png" alt="Using Windows NET command to start/stop/restart Snort service in Windows" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;<div align="center"><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=527221&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=85439"></script></div> </p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <hr noshade color="#FF3300" /> <p class="MsoNormal" style="margin-top: 0; margin-bottom: 0" align="center"> <script type="text/javascript"><!-- google_ad_client = "pub-8089415323104206"; google_ad_slot = "3545464564"; google_ad_width = 728; google_ad_height = 15; //--> </script> &nbsp;<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script></p> <h1 align="center" style="margin-top: 0; margin-bottom: 0"> <span style="font-weight: 400"><font size="4">&lt; <span style="text-decoration: none"><font color="#000000"> <a title="Snort and MySQL Database" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpbaseperladodb8.html"> Snort and MySQL Database</a></font></span> | <a title="Java and open source - information, tutorials, install, setup, configure" target="_top" href="http://www.javaguicodexample.com/"> Java &amp; Friends</a>&nbsp; | <span style="text-decoration: none"> <font color="#000000"> <a title="MySQL, PHP Code, Basic Analysis and Security Engine (BASE) and ADODB" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpbaseperladodb10.html"> MySQL, PHP Code, Basic Analysis and Security Engine (BASE) and ADODB</a></font></span> &gt;</font></span></h1> </div> </body> </html>