Morpheus

If you are running Pulled Pork you do not want to manually run the create sid-map file. Pulled Pork will run it's own, more advavced utility during the process of updating the rules.

For some unknown reason this happens when configuring IIS, at random installs.

Yes, that could happen depending on copnnectivity. Also, manually delete all the files in all the temp folders.

Could be a few things:   1) No inteernet access 2) Trying to connect out through a proxy 3) the repository is down for some unknown reason

Go back to the tutorial and complete the section labled 'Testing the Snort configuration file'. Post the results.

Did you try: How manually to trigger TCP, IP, UDP, and ICMP for event testing ?   What were the results?

Did you try: >How manually to trigger TCP, IP, UDP, and ICMP for event testing

This is your line 349 output database: log, mysql, user=base password=123456 dbname=snort host=localhost sensor_name=WinIDS-Home This is what the line 349 should look like if the tutorial was followed output database: log, mysql, user=snort password=l0gg3r dbname=snort host=winids sensor_name=WinIDS-Home Not sure what you have done as it appears you have changed critical switches. Correcting these should allow a connection to the MySQL database?

Attach you barnyard.conf file.     Attach you barnyard.conf file.

Is MySQL running as a service?   Can you login to the MySQL server from the command prompt.   Open a command window and type 'mysql -u snort -pl0gg3r' (less the outside quotes), and tap the Enter key.   Type exactly as shown above.   You should be dropped into a mysql CMD prompt.   Were you able to log into the MySQL server?

I'm not sure what Windows XP has to do with this problem? It appears by the screen shot that NO traffic is being detected. This could be a MULTITUDE of problems. 1) NIC drivers, or compatibility 2) Not specifying the correct NIC in the run line 3) Connected to a unmanaged switch (needs to see ALL traffic). 4) Short not configured correctly for HOME_NET

    I found a few quirks but nothing major. Swap the files in the attached .zip with your existing files. winIDS.zip

Are you able to ping locally (127.0.0.1)?   Unable to detect ping could be firewall, or router issues?

If you are still getting these timeout errors, you may need to look at physical memory, or possibly a memory managemet problem?

This is happening because you have a gazillion events being processed and the Windows Intrusion Detection Systems (WinIDS) security console is working overtime.   Open the php.ini and change:   Original Line(s): max_execution_time = 60 Change to: max_execution_time = xx   Change the xx to accommodate the time required.   My guess is that you are processing hundreds of thousands if not millions of events that are irrelevant. Try adjusting the preprocessors and the rules to accommodate your specific needs. If you need help doing this join the snort-users mailing list. You will find a lot of advanced uses that are willing to help. 

Read this and give it a try and see if it clears up your problem.

Read >this and give it a try and see if it clears up your problem.

Getting to the point where I'm unable to reboot to fix things

It appears that the sys::syslog module failed to install per the tutorial. Go back and try installing it again.

Great

Have you tried > http://winids/base_main.php   Is there an error?

Did you follow the tutorial (exactly) and run the modder.vbs file?   Did you return to the section labeled 'Configuring Internet Information Services for PHP', and complete.   Did you try running the test.php again, and see if it displays.   Note: The test.php needs to be copied to the d:winidsinetpubwwwrootbase folder, and then accessed from the URL http://winids/test.php

What log files are in the snort/log folder, and the size?

Follow the tutorial. you are using -ix and that is wrong. The tutorial instructs you on the correct way to set the -ix switch.

It appears you missed a step. The tutorial specifically details how to get the file that is missing.