I have a virtual machine with Fedora 19 acting as a router. This machine as an interface (p8p1) with the IP 172.16.1.254 that is connected to another machine (IP 172.16.1.1) that's simulating the external network.

I've installed snort 2.9.2.2, applied the snortsam-2.9.2.2.diff.gz patch and installed snortsam 2.70 on the routermachine

In snort.conf besides altering some RULE_PATH I believe I've only added the following line to the file.

output alert_fwsam: 127.0.0.1:898/password

After doing this two comands:

ifconfig p8p1 promisc
/usr/local/snort/bin/snort -v -i p8p1

If I ping from the external network to the router IP, I can see the info about the pings.

One of the rules that I have is icmp-info.rules that as this single line:

alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP-INFO Echo Reply"; icode:0; itype:0; classtype:misc-activity; sid:408; rev:6;fwsam: src, 5 minutes;)

snortsam.conf as this data:

defaultkey password
accept localhost
keyinterval 30 minutes
dontblock 192.168.1.1   # rede local
rollbackhosts 50
rollbackthreshold 20 / 30 secs
rollbacksleeptime 1 minute
logfile /var/log/snort/snortsam.log
loglevel 3
daemon
nothreads
# linha importante para gerar os bloqueios via iptables
iptables p8p1 LOG
bindip 127.0.0.1

Now I run this command:

/usr/local/snort/bin/snort -u snort -i p8p1 -c /etc/snort/snort.conf -l /var/log/snort -Dq

Terminal gives this message:

Spawning daemon child...
My daemon child 2080 lives...
Daemon parent exiting (0)

and when I runsnortsam in terminal i got this:

SnortSam, v 2.70. Copyright (c) 2001-2009 Frank Knobbe . All rights reserved.

Plugin 'fwsam': v 2.5, by Frank Knobbe
Plugin 'fwexec': v 2.7, by Frank Knobbe
Plugin 'pix': v 2.9, by Frank Knobbe
Plugin 'ciscoacl': v 2.12, by Ali Basel <[email protected]>
Plugin 'cisconullroute': v 2.5, by Frank Knobbe
Plugin 'cisconullroute2': v 2.2, by Wouter de Jong <[email protected]>
Plugin 'netscreen': v 2.10, by Frank Knobbe
Plugin 'ipchains': v 2.8, by Hector A. Paterno <[email protected]>
Plugin 'iptables': v 2.9, by Fabrizio Tivano <[email protected]>, Luis Marichal <[email protected]>
Plugin 'ebtables': v 2.4, by Bruno Scatolin <[email protected]>
Plugin 'watchguard': v 2.7, by Thomas Maier <[email protected]>
Plugin 'email': v 2.12, by Frank Knobbe
Plugin 'email-blocks-only': v 2.12, by Frank Knobbe
Plugin 'snmpinterfacedown': v 2.3, by Ali BASEL <[email protected]>
Plugin 'forward': v 2.8, by Frank Knobbe

Parsing config file /etc/snortsam.conf...
Linking plugin 'iptables'...
Checking for existing state file "/var/db/snortsam.state".
Found. Reading state file.
Starting to listen for Snort alerts.

and snortsam.log as an entry like this 2013/10/25, 10:15:17, -, 1, snortsam, Starting to listen for Snort alerts.

Now, from the external machine I do ping 172.16.1.254 and it starts showing the info and an alert file is created in /var/log/snort/ that as the info about the PINGS. Something like:

[**] [1:408:6] ICMP-INFO Echo Reply [**]
[Classification: Misc activity] [Priority: 3] 
10/25-10:35:16.061319 172.16.1.254 -> 172.16.1.1
ICMP TTL:64 TOS:0x0 ID:38720 IpLen:20 DgmLen:84
Type:0  Code:0  ID:1389  Seq:1  ECHO REPLY

Also, if I run instead /usr/local/snort/bin/snort snort -v -i p8p1 i got this message:

Running in packet dump mode

        --== Initializing Snort ==--
Initializing Output Plugins!
Snort BPF option: snort
pcap DAQ configured to passive.
The DAQ version does not support reload.
Acquiring network traffic from "p8p1".
ERROR: Can't set DAQ BPF filter to 'snort' (pcap_daq_set_filter: pcap_compile: syntax error)!
Fatal Error, Quitting..

So, this are my questions:

Shouldn't snortsam block the PING?

Is that DAQ error causing the problem? If so, How can I solve it?