Forums

Resolved
0 votes
Snortsam is not blocking anything and when I SSH into the box and run snortsam, I get the following output:

[root@gateway etc]# snortsam

SnortSam, v 2.70.
Copyright (c) 2001-2009 Frank Knobbe <frank@knobbe.us>. All rights reserved.

Plugin 'fwsam': v 2.5, by Frank Knobbe
Plugin 'fwexec': v 2.7, by Frank Knobbe
Plugin 'pix': v 2.9, by Frank Knobbe
Plugin 'ciscoacl': v 2.12, by Ali Basel <alib@sabanciuniv.edu>
Plugin 'cisconullroute': v 2.5, by Frank Knobbe
Plugin 'cisconullroute2': v 2.2, by Wouter de Jong <maddog2k@maddog2k.net>
Plugin 'netscreen': v 2.10, by Frank Knobbe
Plugin 'ipchains': v 2.8, by Hector A. Paterno <apaterno@dsnsecurity.com>
Plugin 'iptables': v 2.9, by Fabrizio Tivano <fabrizio@sad.it>, Luis Marichal <luismarichal@gmail.com>
Plugin 'ebtables': v 2.4, by Bruno Scatolin <ipsystems@uol.com.br>
Plugin 'watchguard': v 2.7, by Thomas Maier <thomas.maier@arcos.de>
Plugin 'email': v 2.12, by Frank Knobbe
Plugin 'email-blocks-only': v 2.12, by Frank Knobbe
Plugin 'snmpinterfacedown': v 2.3, by Ali BASEL <ali@basel.name.tr>
Plugin 'forward': v 2.8, by Frank Knobbe

Parsing config file /etc/snortsam.conf...
Linking plugin 'iptables'...
Parsing config file /etc/snortsam.d/whitelist.conf...
Parsing config file /etc/snortsam.d/dns-whitelist.conf...
Parsing config file /etc/snortsam.d/system-autowhitelist.conf...
Checking for existing state file "/var/db/snortsam.state".
Found. Reading state file.
Error: Could not bind socket.

Exiting SnortSam...





Any ideas on how to fix this issue?
Friday, January 23 2015, 01:40 PM
Share this post:
Responses (2)
  • Accepted Answer

    Friday, January 23 2015, 03:11 PM - #Permalink
    Resolved
    0 votes
    okay - i get it, so you can either start it as a service or start it that way - issue resolved. thanks
    The reply is currently minimized Show
  • Accepted Answer

    Friday, January 23 2015, 02:24 PM - #Permalink
    Resolved
    0 votes
    Why are you running it like that? Either start it from the IPS webconfig or with the command:
    service snortsam start
    The reply is currently minimized Show
Your Reply