50

Chapter 2     Installing Snort and Getting Started

   143  then

   144     echo "Snort test failed."

   145     echo "Aborting ..."

   146     exit 1

   147  fi

   148

   149  echo "Stopping Snort ..."

   150  pkill snort >/dev/null 2>&1

   151

   152  if [ $?  ne 0 ]

   153  then

   154     echo "Snort stopping failed."

   155     echo "Aborting ..."

   156     exit 1

   157  fi

   158

   159  echo

   160  echo "Done. Snort installation is working properly"

   161  echo

As you may have noted, this scripts creates alert file in the /tmp directory which

is used to find out if the alert creation was successful. When you run the script and

everything is working fine, you will see  the following output:

###########################################################

#            Script to test Snort Installation            #

#                       Written By                        #

#                                                         #

#                     Rafeeq Rehman                       #

#                  rr@argusnetsec.com                     #

#           Argus Network Security Services Inc.          #

#               http://www.argusnetsec.com                #

###########################################################

###########################################################

The script generates three alerts in file /tmp/alert

Each alert should start with message like the following:

      "ATTACK RESPONSES id check returned root"

##########################################################

Starting Snort ...

Now generating alerts.

Alert generation complete

Stopping Snort ...

Done. Snort installation is working properly