I've been trying to get Snort running on my lab network, but haven't been having much luck.
I installed Snort 2.9.14 on both Windows 10 & Ubuntu 18.04 (Running in VirtualBox 5.2.22). I seems to have the snort.conf file set up correctly in both environments, because when I test snort in either one... it exits with a "Snort successfully validated the configuration!" message.
Unfortunately, when I try to start snort out of test mode.... It seems to start and displays the "Commencing packet processing" message... But hangs afterwards... Snort on Ubuntu doesn't show anything after that... But Snort installed on Windows 10 displays "Decoding LoopBack". And doesn't display anything after that.
I've edited the local.rules to display messages if the machine's been pinged or if I view a page with a browser. I have the NIC in promiscuous mode and I'm running the cmd window as an administrator.
Can someone please suggest what might be going on, or a solution? Thanks!