Re: [Os-sim-support] Snort Unified

[Jon U. <jur...@ya...>]

Hi Brian,

Building snort is being a strange experience for me, because I get to 
many issues I can not fully understand. I'm trying not to uninstall any 
of the standard libs (libpcap) to have a "dual system", and I got 
binnaries (linked to the correct libs (/usr/local/lib)) with no errors. 
But the unified file format they generate is wrong because it´s full of 
messages of this kind:

"snortunified.cfg[**] [116:6:1] (snort_decoder) WARNING: IP dgm len > IP 
Hdr len! [**]"

Even if we have the option to avoid these messages in snort.conf. I 
guess I get a message for each packet we receive...

We have an old snort binnary linked to modified libpcap (that's what ldd 
says...) that seems to work ok (loads pfring on startup and gives normal 
alerts), but I compiled it before we had the pfring change (kernel and 
new libpcaps)??? It shouldn't work this way.

But our critical problem now is that we are not getting any snort event 
in ossim, even with the working snort!! And I can assure that alerts are 
being generated ...

The snortunified.cfg file does not parse the snort.log file by Perl 
Regular Expressions syntax, so we can not follow what the agent is doing 
when it's supposed to parse events... The python scripts for this parsing

We need help.

Thanx,

Jon



Brian Lavender escribió:
> Jon,
> 
> I am going to have to do the snort from scratch. I have finals at the
> moment (grad school), so I won't be going into work too much, but I
> am inspired by your post to roll this from scratch. Have you looked at
> the O'Reilly "Network Security Hacks" book? It has a Barnyard setup and
> more. Its hacks have claried a number of security questions I have had.
> 
> For snort, I have only currently relied upon the Ossim install CD. I
> know it doesn't have the ring buffer, so I am going to have to figure
> this out. I know at my work, we have the Nortel implementation of
> Sourcefire. I need to figure out if it can give a feed.
> 
> brian
> 
> On Tue, May 13, 2008 at 06:41:59PM +0200, Jon Uriona wrote:
>> Hi again,
>>
>> The snort issue is about a strange functioning of our compilation. We 
>> have a new snort that creates a correct snort.log files...
>>
>> Then I still have the rest of my questions... ossim-agent is not parsing 
>> snort's log at all. There are alerts generated but no event inserted in 
>> ossim server.
>>
>> Any ideas??
>>
>> Regards
>>
>> Jon
>>
>> Jon Uriona escribió:
>>> Hi all,
>>>
>>> We have snort (with pf_ring) logging in unified format, analizyng a link 
>>> at about 50 Mbps. The output line is:
>>>
>>> "output unified: filename snort, limit 128"
>>>
>>> At this rate, a file (128 MB) is generated every minute or two. My first 
>>> question is... Is this normal? There has been a snort config depuration 
>>> and the alert rate is not very high, so even if the whole packets 
>>> (generating alerts) are logged, it is a very big amount!! The error 
>>> should be here... What's your opinion about this??
>>>
>>> We have an instance of ossim-agent with snortunified plugin, here the 
>>> config:
>>>
>>> "[config]
>>> type=detector
>>> enable=yes
>>> source=snortlog
>>> process=snort
>>> start=no; launch plugin process when agent starts
>>> stop=no; shutdown plugin process when agent stops
>>> startup=/etc/init.d/%(process)s start
>>> shutdown=/etc/init.d/%(process)s stop
>>> directory=/var/log/snort/
>>> prefix=snort
>>> linklayer=ethernet
>>> "
>>>
>>> But there is no snort event logged into the server. How can I assure 
>>> that ossim-agent is reading the unified files? lsof does not say 
>>> anything (no open files). Is it going to be fast enough to read that 
>>> amount of data??
>>> How can the agent's unified parser be aware of the rotation of this 
>>> files (snort logs)? I need to rotate them periodically (disk space is 
>>> not infinite...) and I need to know how much of the agents work is done!!
>>>
>>> Please help!! Regards,
>>>
>>> Jon
>>>
>>> -------------------------------------------------------------------------
>>> This SF.net email is sponsored by: Microsoft 
>>> Defy all challenges. Microsoft(R) Visual Studio 2008. 
>>> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
>>>
>>>
>>> ------------------------------------------------------------------------
>>>
>>> _______________________________________________
>>> Os-sim-support mailing list
>>> Os-...@li...
>>> https://lists.sourceforge.net/lists/listinfo/os-sim-support
>>
>>
>> -------------------------------------------------------------------------
>> This SF.net email is sponsored by: Microsoft 
>> Defy all challenges. Microsoft(R) Visual Studio 2008. 
>> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
>> _______________________________________________
>> Os-sim-support mailing list
>> Os-...@li...
>> https://lists.sourceforge.net/lists/listinfo/os-sim-support
> 


      ______________________________________________ 
Enviado desde Correo Yahoo! La bandeja de entrada más inteligente.