[Snort-inline-users] Snort_inline not detecting web attacks

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 422-6466

Hi ALL,&nbsp;&nbsp;&nbsp; I am using snort_inline-2.6.1.5 on my fedora 6 PC. I
wanted to use snort_inline as an IPS for my system so I was testing
snort_inline's&nbsp; capability to detect web attacks. For this I wrote a
simple TCP client program which will send HTTP GET requests to my
system (I will be running this program on another machine in LAN) and
in that GET request I added a URI pattern from web-cgi.rules file whci
looks like "GET http://10.0.0.1/hsx.cgi HTTP/1.0 \r\nnn".When I executed the program snort_inline neither droped this packet nor it logged.I tested same thing with some other web attack patterns but with the same results.Is this a intended behaviour of snort_inline or am I doing some thing wrong. Below is my snort_inline.conf for reference.&nbsp; var HOME_NET [10.0.0.1/32]&nbsp; var HONEYNET any&nbsp; var EXTERNAL_NET !$HOME_NET&nbsp; var SMTP_SERVERS any&nbsp; var TELNET_SERVERS any&nbsp; var HTTP_SERVERS 10.0.0.1&nbsp; var SQL_SERVERS any&nbsp; var DNS_SERVERS any&nbsp; var HTTP_PORTS 80# Ports you want to look for SHELLCODE on.&nbsp;var SHELLCODE_PORTS !80&nbsp;# Ports you do oracle attacks on&nbsp;var ORACLE_PORTS 1521&nbsp;#ports you want to look for SSH on&nbsp;var SSH_PORTS 22var AIM_SERVERS
[64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.18&nbsp;&nbsp;&nbsp;
8.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] var RULE_PATH&nbsp; /home/vishal/snort/ips_rulespreprocessor stickydrop: max_entries 50, logpreprocessor stickydrop-timeouts: sfportscan 60preprocessor stickydrop-ignorehosts: 10.0.0.1/32preprocessor flow: stats_interval 0 hash 2 preprocessor stream4:&nbsp;&nbsp; disable_evasion_alerts, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; stream4inline, &nbsp;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; enforce_state drop, &nbsp;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; midstream_drop_alerts, &nbsp;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; state_file /var/log/ips/state_file.log, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; state_file /var/log/state_file.log, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; detect_scans, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; memcap 100000000, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; timeout 3600, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; truncate, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; window_size 3000, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; detect_state_problems, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; self_preservation_threshold 100, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; self_preservation_period 30, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; state_protection enable, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; suspend_threshold 200, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; suspend_period 60, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; enable_udp_sessions, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; max_udp_sessions 9000preprocessor stream4_reassemble: both, ports "default", favor_new preprocessor http_inspect: global &nbsp;&nbsp;&nbsp; iis_unicode_map unicode.map 1252&nbsp;preprocessor http_inspect_server: server default &nbsp;&nbsp;&nbsp;&nbsp; profile all ports { 80 8080 8180 } oversize_dir_length 500preprocessor rpc_decode: 111 32771preprocessor bopreprocessor telnet_decode: 21 23 25 119preprocessor ftp_telnet: global &nbsp;&nbsp; encrypted_traffic yes &nbsp;&nbsp; inspection_type stateful &nbsp;&nbsp; check_encrypted preprocessor ftp_telnet_protocol: telnet &nbsp;&nbsp;&nbsp; ports { 23 } &nbsp;&nbsp;&nbsp; normalize &nbsp;&nbsp;&nbsp; ayt_attack_thresh 10 &nbsp;&nbsp;&nbsp; detect_anomaliespreprocessor ftp_telnet_protocol: ftp server default &nbsp;&nbsp;&nbsp; def_max_param_len 100 &nbsp;&nbsp;&nbsp; alt_max_param_len 200 { CWD } &nbsp;&nbsp;&nbsp; cmd_validity MODE &lt; char ASBCZ &gt; &nbsp;&nbsp;&nbsp; cmd_validity MDTM &lt; [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string &gt; &nbsp;&nbsp;&nbsp; chk_str_fmt { USER PASS RNFR RNTO SITE MKD } &nbsp;&nbsp;&nbsp; telnet_cmds yes &nbsp;&nbsp;&nbsp; data_chan&nbsp;preprocessor ftp_telnet_protocol: ftp client default &nbsp;&nbsp;&nbsp; max_resp_len 256 &nbsp;&nbsp;&nbsp; bounce yes &nbsp;&nbsp;&nbsp; telnet_cmds yes preprocessor smtp: &nbsp;&nbsp; ports { 25 } &nbsp;&nbsp; inspection_type stateful &nbsp;&nbsp; normalize cmds &nbsp;&nbsp; normalize_cmds { EXPN VRFY RCPT } &nbsp;&nbsp; alt_max_command_line_len 260 { MAIL } &nbsp;&nbsp; alt_max_command_line_len 300 { RCPT } &nbsp;&nbsp; alt_max_command_line_len 500 { HELP HELO ETRN } &nbsp;&nbsp; alt_max_command_line_len 255 { EXPN VRFY } preprocessor sfportscan: proto&nbsp; { all } &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; memcap { 10000000 } &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; scan_type { all } &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; sense_level { medium } &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; logfile { sfport_scan.log }preprocessor dcerpc: &nbsp;&nbsp;&nbsp;&nbsp; autodetect &nbsp;&nbsp;&nbsp;&nbsp; max_frag_size 3000 &nbsp;&nbsp;&nbsp;&nbsp; memcap 100000preprocessor dns: &nbsp;&nbsp;&nbsp;&nbsp; ports { 53 } &nbsp;&nbsp;&nbsp;&nbsp; enable_rdata_overflow output alert_fast: snort_inline-fastinclude $RULE_PATH/classification.config&nbsp;include $RULE_PATH/reference.config ### The Drop Rules&nbsp;# Enabled&nbsp;# include $RULE_PATH/test.rules&nbsp; include $RULE_PATH/attack-responses.rules&nbsp; include $RULE_PATH/bad-traffic.rules&nbsp; include $RULE_PATH/misc.rules&nbsp; include $RULE_PATH/scan.rules&nbsp; include $RULE_PATH/exploit.rules&nbsp; include $RULE_PATH/finger.rules&nbsp; include $RULE_PATH/ftp.rules&nbsp; include $RULE_PATH/telnet.rules&nbsp; include $RULE_PATH/rpc.rules&nbsp;include $RULE_PATH/rservices.rules&nbsp;include $RULE_PATH/dos.rules&nbsp; include $RULE_PATH/ddos.rules&nbsp; include $RULE_PATH/dns.rules&nbsp; include $RULE_PATH/tftp.rules&nbsp; include $RULE_PATH/web-cgi.rules&nbsp; include $RULE_PATH/web-coldfusion.rules&nbsp; include $RULE_PATH/web-iis.rules&nbsp; include $RULE_PATH/web-frontpage.rules&nbsp; include $RULE_PATH/web-misc.rules&nbsp; include $RULE_PATH/web-client.rules&nbsp; include $RULE_PATH/web-php.rules&nbsp; include $RULE_PATH/sql.rules&nbsp; include $RULE_PATH/x11.rules&nbsp; include $RULE_PATH/icmp.rules&nbsp; include $RULE_PATH/netbios.rules&nbsp; include $RULE_PATH/oracle.rules&nbsp; include $RULE_PATH/mysql.rules&nbsp; include $RULE_PATH/snmp.rules&nbsp; include $RULE_PATH/smtp.rules&nbsp; include $RULE_PATH/imap.rules&nbsp; include $RULE_PATH/pop3.rules&nbsp; include $RULE_PATH/pop2.rules&nbsp; include $RULE_PATH/web-attacks.rules&nbsp;include $RULE_PATH/virus.rules&nbsp; include $RULE_PATH/nntp.rules&nbsp; include $RULE_PATH/other-ids.rules&nbsp; include $RULE_PATH/backdoor.rules&nbsp; include $RULE_PATH/shellcode.rules&nbsp; include $RULE_PATH/policy.rules&nbsp;include $RULE_PATH/porn.rules&nbsp; include $RULE_PATH/info.rules&nbsp; include $RULE_PATH/icmp-info.rules&nbsp; include $RULE_PATH/chat.rules&nbsp; include $RULE_PATH/multimedia.rules&nbsp; include $RULE_PATH/p2p.rules&nbsp; include $RULE_PATH/spyware-put.rules&nbsp; include $RULE_PATH/voip.rules&nbsp;### Bleeding Rules&nbsp;# include $RULE_PATH/bleeding-all.rules&nbsp; include $RULE_PATH/bleeding.rules&nbsp; include $RULE_PATH/bleeding-attack_response.rules&nbsp; include $RULE_PATH/bleeding-botcc.rules&nbsp; include $RULE_PATH/bleeding-dos.rules&nbsp; include $RULE_PATH/bleeding-dshield.rules&nbsp; include $RULE_PATH/bleeding-exploit.rules&nbsp; include $RULE_PATH/bleeding-game.rules&nbsp; include $RULE_PATH/bleeding-inappropriate.rules&nbsp; include $RULE_PATH/bleeding-malware.rules&nbsp; include $RULE_PATH/bleeding-p2p.rules&nbsp; include $RULE_PATH/bleeding-policy.rules&nbsp; include $RULE_PATH/bleeding-scan.rules&nbsp; include $RULE_PATH/bleeding-virus.rules&nbsp; include $RULE_PATH/bleeding-voip.rules&nbsp; include $RULE_PATH/bleeding-web.rules&nbsp; include $RULE_PATH/bleeding-custom.rules&nbsp; include $RULE_PATH/bleeding-rbn.rules&nbsp; include $RULE_PATH/bleeding-web_sql_injection.rules

Thanks and Regards,
Vishal Kotalwar,
Software Engineer,
Aricent,
Chennai-35.
09884074047.