Morpheus

Did you try: How manually to trigger TCP, IP, UDP, and ICMP for event testing ?   What were the results?

Did you try: >How manually to trigger TCP, IP, UDP, and ICMP for event testing

This is your line 349 output database: log, mysql, user=base password=123456 dbname=snort host=localhost sensor_name=WinIDS-Home This is what the line 349 should look like if the tutorial was followed output database: log, mysql, user=snort password=l0gg3r dbname=snort host=winids sensor_name=WinIDS-Home Not sure what you have done as it appears you have changed critical switches. Correcting these should allow a connection to the MySQL database?

Attach you barnyard.conf file.     Attach you barnyard.conf file.

Is MySQL running as a service?   Can you login to the MySQL server from the command prompt.   Open a command window and type 'mysql -u snort -pl0gg3r' (less the outside quotes), and tap the Enter key.   Type exactly as shown above.   You should be dropped into a mysql CMD prompt.   Were you able to log into the MySQL server?

I'm not sure what Windows XP has to do with this problem? It appears by the screen shot that NO traffic is being detected. This could be a MULTITUDE of problems. 1) NIC drivers, or compatibility 2) Not specifying the correct NIC in the run line 3) Connected to a unmanaged switch (needs to see ALL traffic). 4) Short not configured correctly for HOME_NET

    I found a few quirks but nothing major. Swap the files in the attached .zip with your existing files. winIDS.zip

Are you able to ping locally (127.0.0.1)?   Unable to detect ping could be firewall, or router issues?

If you are still getting these timeout errors, you may need to look at physical memory, or possibly a memory managemet problem?

This is happening because you have a gazillion events being processed and the Windows Intrusion Detection Systems (WinIDS) security console is working overtime.   Open the php.ini and change:   Original Line(s): max_execution_time = 60 Change to: max_execution_time = xx   Change the xx to accommodate the time required.   My guess is that you are processing hundreds of thousands if not millions of events that are irrelevant. Try adjusting the preprocessors and the rules to accommodate your specific needs. If you need help doing this join the snort-users mailing list. You will find a lot of advanced uses that are willing to help. 

Read this and give it a try and see if it clears up your problem.

Read >this and give it a try and see if it clears up your problem.

Getting to the point where I'm unable to reboot to fix things

It appears that the sys::syslog module failed to install per the tutorial. Go back and try installing it again.

Great

Have you tried > http://winids/base_main.php   Is there an error?

Did you follow the tutorial (exactly) and run the modder.vbs file?   Did you return to the section labeled 'Configuring Internet Information Services for PHP', and complete.   Did you try running the test.php again, and see if it displays.   Note: The test.php needs to be copied to the d:winidsinetpubwwwrootbase folder, and then accessed from the URL http://winids/test.php

What log files are in the snort/log folder, and the size?

Follow the tutorial. you are using -ix and that is wrong. The tutorial instructs you on the correct way to set the -ix switch.

It appears you missed a step. The tutorial specifically details how to get the file that is missing.

I ended up deleteing the log files to get it to correctly update the date. The events were correct but didn't have the correct date. I believe this is due to a corrupted waldo file. To fix; use the Windows Intrusion Detection Systems security console and delete all the events. Stop snort and Barnyard2 from the Task Manager, Go into the d:\winids\snort\logs folder, delete all the files, and reboot.

  Did you try this: >Link

Did you follow the tutorial, and install IIS as described using the moveiis.bat file?   Attach the configuration files requested above.

So the events are being logged but the date is not being updated?

Make sure MySQL is running by verifying in task manager. Go back to the 'Configuring Barnyard2' section and make SURE it is applied correctly.