title: Snort doesn't detect rules except ping
body: <p>Hi I have a problem with Snort configuration.</p>
  
  <p>I set up a virtual network with vagrant hosts, a host of them runs Snort (with Barnyard2), the Snort host is in promiscuous mode so I can read all packets in 192.168.10.*/24.
  Everything works well with PING, I have a rule in /etc/snort/rules/local.rules:</p>
  
  <pre><code>alert icmp any any -&gt; $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:001;)
  </code></pre>
  
  <p>this rule is mapped correctly and I can see every PING between any host, barnyard2 reads the output and stores it in DB.</p>
  
  <p>The problem is when I try to add another rule, I tried logging SSH and NMAP for example:</p>
  
  <pre><code>alert tcp any any -&gt; any any (sid:1000005; gid:1; flow:stateless; ack:0; flags:S; ttl:&gt;220; priority:1; msg:"nmap scan"; classtype:network-scan; rev:1;)
  alert tcp any any -&gt; $HOME_NET 22 (msg:"Potential SSH Brute Force Attack"; flow:to_server; flags:S; threshold:type threshold, track by_src, count 3, seconds 60; classtype:attempted-dos; sid:2001219; rev:4; resp:rst_all; )
  </code></pre>
  
  <p>I can't see any alert or logging with these two rules. </p>
  
  <p>I also used PulledPork to get updated rules and I tried <a href="http://www.hsc.fr/ressources/outils/idswakeup/" rel="nofollow">IDSwakeup</a> to check if them worked but obviously nothing happened.</p>
  
  <p>The config file /etc/snort/snort.conf seems to be configured correctly (without comments):</p>
  
  <pre><code>vagrant@vagrant-ubuntu-trusty-64:~$ cat /etc/snort/snort.conf | grep rules
  var RULE_PATH /etc/snort/rules
  var SO_RULE_PATH /etc/snort/so_rules
  var PREPROC_RULE_PATH /etc/snort/preproc_rules
  var WHITE_LIST_PATH /etc/snort/rules
  var BLACK_LIST_PATH /etc/snort/rules
  dynamicdetection directory /usr/local/lib/snort_dynamicrules
     whitelist $WHITE_LIST_PATH/white_list.rules, \
     blacklist $BLACK_LIST_PATH/black_list.rules 
  include $RULE_PATH/local.rules
  include $RULE_PATH/snort.rules
  </code></pre>
  
  <p>And the rule files seem to be in the correct place:</p>
  
  <pre><code>vagrant@vagrant-ubuntu-trusty-64:~$ tree /etc/snort/rules/
  /etc/snort/rules/
  ├── black_list.rules
  ├── iplists
  │   └── default.blacklist
  ├── iplistsIPRVersion.dat
  ├── local.rules
  ├── snort.rules
  ├── test.rules
  └── white_list.rules
  </code></pre>
  
  <p>I also tried to empty snort.rules and keep only local.rules to understand if it doesn't work due to an hardware limit but nothing changed. </p>
  
  <p>I don't know if it could be due to:
  - wrong configuration
  - wrong rules
  - wrong attack
  - hardware requirements</p>
  
  <p>Can you help me? :)</p>