Menu
▾
▴
Re: [Snort-inline-users] Snort_Inline not recognizing 'drop' rule
|
From: Will M. <wil...@gm...> - 2007-07-16 14:46:44
|
not only that but you need to queue both sides of the conversation so iptables -I INPUT -p tcp --dport 80 -j QUEUE iptables -I OUTPUT -p tcp --sport 80 -j QUEUE On 7/16/07, David Gunnarsson <gu...@in...> wrote: > > Yout rule: > *drop tcp any 80 -> any 80 (classtype:attempted-user; msg:"Port 80 > connection initiated";sid:1000001;) > The first port of 80 is the source port, a webclient will most certainly > never send with sourceport 80, just destination port 80, the second one, > that is why this rule never is trigger.. Try with any any -> any 80 .... > instead. > good luck! > * > > Piyush_Mundra wrote: > > Dear will, > > > > Regarding ip_queue i followed the following steps: > > > > 1) *modprobe ip_queue* > > > > *2) iptables -I INPUT -p tcp --dport 80 -j QUEUE* > > > > 3) snort -c /etc/snort_inline/snort_inline.conf -Q -N -l > > /var/log/snort_inline/ -t /var/log/snort_inline/ -v > > > > Previously i was working with snort_inline but somehow there was some > > problem compiling it. Then later on i started with snort-2.6.1.5 along > > with libdnet, libpcap, iptables and pcre libraries. After installation > > snort runs but is not able to process packets as mentioned in my > > previous mail. > > > > Looking forward eagerly for your reply, > > > > Thanks > > > > Regards, > > > > Piyush > > > > ------------------------------------------------------------------------ > > *From:* Will Metcalf [mailto:wil...@gm...] > > *Sent:* Sat 7/14/2007 7:47 PM > > *To:* Piyush_Mundra > > *Cc:* sno...@li... > > *Subject:* Re: [Snort-inline-users] Snort_Inline not recognizing > > 'drop' rule > > > > what do your iptables rules look like? > > > > On 7/14/07, *Piyush_Mundra* <Piy...@sa... > > <mailto:Piy...@sa...>> wrote: > > > > Hello will, > > Thanks very much. > > I tried to install the snort_inline on fedora and the installation > > process worked fine. > > Right now i'm using snort_inline-2.6.1.5 > > <http://2.6.1.5>.Now,after inserting the ip_queue module i am > > running the following command > > > > *snort_inline -Q -v -c /etc/snort_inline/snort_inline.conf -l > > /var/log/snort_inline > > * > > I am getting the following summary: > > > > > =============================================================================== > > *Snort processed 0 packets*. > > > =============================================================================== > > Breakdown by protocol: > > TCP: 0 (0.000%) > > UDP: 0 (0.000%) > > ICMP: 0 (0.000%) > > ARP: 0 (0.000%) > > EAPOL: 0 (0.000%) > > IPv6: 0 (0.000%) > > ETHLOOP: 0 (0.000%) > > IPX: 0 (0.000%) > > FRAG: 0 (0.000%) > > OTHER: 0 (0.000%) > > DISCARD: 0 (0.000%) > > > =============================================================================== > > Action Stats: > > ALERTS: 0 > > LOGGED: 0 > > PASSED: 0 > > > =============================================================================== > > In my snort.conf file i have commented all the rules except one > > *include $RULE_PATH/web-attacks.rules* > > At the end of the web-attacks.rule file i have added a simple rule: > > *drop tcp any 80 -> any 80 (classtype:attempted-user; msg:"Port 80 > > connection initiated";sid:1000001;)* > > > > Kindly tell me where i am going wrong. Why snort_inline is not > > able to process any packet. > > > > Regards, > > > > Piyush > > > > > ------------------------------------------------------------------------ > > *From:* Will Metcalf [mailto:wil...@gm... > > <mailto:wil...@gm...>] > > *Sent:* Wed 7/11/2007 9:48 PM > > *To:* Piyush_Mundra > > *Cc:* sno...@li... > > <mailto:sno...@li...> > > *Subject:* Re: [Snort-inline-users] Snort_Inline not recognizing > > 'drop' rule > > > > for snort_inline-2.6.x you need libdnet installed. I'm not sure > what > > OS you are running but you may want to make distclean ./autojunk.sh > && > > ./configure && make && make install from the source directory. > > > > Regards, > > > > Will > > > > On 7/11/07, Piyush_Mundra <Piy...@sa... > > <mailto:Piy...@sa...>> wrote: > > > > > > > > > Hello everybody, > > > > > > I am working on Redhat. To make use of the packet dropping and > > rejecting > > > facility i installed the Snort_Inline. Snort inline makes use of > the > > > > > > iptables > > > Libnet-1.0.2a-FC2-Fixed > > > pcre-7.2 > > > snort_inline-1.9.1 > > > > > > The installation process went fine without any failure. I have > > installed > > > snort_inline for the packet dropping facility. For that purpose i > > need to > > > write rules in the snort.conf file in the > > Snort_Inline/etc/snort.conf file. > > > > > > There i wrote a very basic rule: > > > > > > drop tcp any any -> any any (msg: "Dropped Packet"; sid: 1000001;) > > > > > > This should cause all traffic coming to my system to be dropped > and > > > corresspondingly logging the alert to a default alert file. > > > > > > But When i try to run Snort_Inline after making above changes to > the > > > snort.conf file the Snort_Inline doesn't work stating: > > > > > > Unknown Rule Type: Drop. > > > > > > This thing get further clarified by the fact that when in > > snort.conf file we > > > write any rule like "alert" "drop" then being the keyword these > > words become > > > "Yellowish". As against them "drop" keyword is not becoming same > > which means > > > the .Conf file is not able to recognize it as a command. > > > > > > > > > Kindly tell me where the things are going wrong. Its really > > important. Is > > > there any other way to configure Snort itself for dropping > > packet. I am > > > running Snort-2.6.1.4 also and i tried to configure it using > > > > > > ./configure --enable_Inline > > > > > > configure and make and make install are running fine but later on > > when i > > > insert the drop rule it is giving the same problem as above. > > > > > > Thanks in advance. > > > > > > Regards > > > Piyush > > > > > > > > > > > > DISCLAIMER: > > > This email (including any attachments) is intended for the sole > > use of the > > > intended recipient/s and may contain material that is > > CONFIDENTIAL AND > > > PRIVATE COMPANY INFORMATION. Any review or reliance by others or > > copying or > > > distribution or forwarding of any or all of the contents in this > > message is > > > STRICTLY PROHIBITED. If you are not the intended recipient, > > please contact > > > the sender by email and delete all copies; your cooperation in > > this regard > > > is appreciated.. > > > > ------------------------------------------------------------------------- > > > This SF.net email is sponsored by DB2 Express > > > Download DB2 Express C - the FREE version of DB2 express and take > > > control of your XML. No limits. Just data. Click to get it now. > > > http://sourceforge.net/powerbar/db2/ > > > _______________________________________________ > > > Snort-inline-users mailing list > > > Sno...@li... > > <mailto:Sno...@li...> > > > https://lists.sourceforge.net/lists/listinfo/snort-inline-users > > > > > > > > > > DISCLAIMER: > > This email (including any attachments) is intended for the sole > > use of the intended recipient/s and may contain material that is > > CONFIDENTIAL AND PRIVATE COMPANY INFORMATION. Any review or > > reliance by others or copying or distribution or forwarding of any > > or all of the contents in this message is STRICTLY PROHIBITED. If > > you are not the intended recipient, please contact the sender by > > email and delete all copies; your cooperation in this regard is > > appreciated.. > > > > > > > ------------------------------------------------------------------------- > > This SF.net email is sponsored by DB2 Express > > Download DB2 Express C - the FREE version of DB2 express and take > > control of your XML. No limits. Just data. Click to get it now. > > http://sourceforge.net/powerbar/db2/ > > _______________________________________________ > > Snort-inline-users mailing list > > Sno...@li... > > <mailto:Sno...@li...> > > https://lists.sourceforge.net/lists/listinfo/snort-inline-users > > > > > > DISCLAIMER: > > This email (including any attachments) is intended for the sole use of > > the intended recipient/s and may contain material that is CONFIDENTIAL > > AND PRIVATE COMPANY INFORMATION. Any review or reliance by others or > > copying or distribution or forwarding of any or all of the contents in > > this message is STRICTLY PROHIBITED. If you are not the intended > > recipient, please contact the sender by email and delete all copies; > > your cooperation in this regard is appreciated.. > > > > ------------------------------------------------------------------------ > > > > > ------------------------------------------------------------------------- > > This SF.net email is sponsored by DB2 Express > > Download DB2 Express C - the FREE version of DB2 express and take > > control of your XML. No limits. Just data. Click to get it now. > > http://sourceforge.net/powerbar/db2/ > > ------------------------------------------------------------------------ > > > > _______________________________________________ > > Snort-inline-users mailing list > > Sno...@li... > > https://lists.sourceforge.net/lists/listinfo/snort-inline-users > > > > > ------------------------------------------------------------------------- > This SF.net email is sponsored by DB2 Express > Download DB2 Express C - the FREE version of DB2 express and take > control of your XML. No limits. Just data. Click to get it now. > http://sourceforge.net/powerbar/db2/ > _______________________________________________ > Snort-inline-users mailing list > Sno...@li... > https://lists.sourceforge.net/lists/listinfo/snort-inline-users > |
