Menu
▾
▴
snort-inline-users — The goal of this list is to help users debug/use snort_inline
You can subscribe to this list here.
| 2003 |
Jan
|
Feb
|
Mar
|
Apr
(1) |
May
(15) |
Jun
(23) |
Jul
(54) |
Aug
(20) |
Sep
(18) |
Oct
(19) |
Nov
(36) |
Dec
(30) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2004 |
Jan
(48) |
Feb
(16) |
Mar
(36) |
Apr
(36) |
May
(45) |
Jun
(47) |
Jul
(93) |
Aug
(29) |
Sep
(28) |
Oct
(42) |
Nov
(45) |
Dec
(53) |
| 2005 |
Jan
(62) |
Feb
(51) |
Mar
(65) |
Apr
(28) |
May
(57) |
Jun
(23) |
Jul
(24) |
Aug
(72) |
Sep
(16) |
Oct
(53) |
Nov
(53) |
Dec
(3) |
| 2006 |
Jan
(56) |
Feb
(6) |
Mar
(15) |
Apr
(14) |
May
(35) |
Jun
(57) |
Jul
(35) |
Aug
(7) |
Sep
(22) |
Oct
(16) |
Nov
(18) |
Dec
(9) |
| 2007 |
Jan
(8) |
Feb
(3) |
Mar
(11) |
Apr
(35) |
May
(6) |
Jun
(10) |
Jul
(26) |
Aug
(4) |
Sep
|
Oct
(29) |
Nov
|
Dec
(7) |
| 2008 |
Jan
(1) |
Feb
(2) |
Mar
(2) |
Apr
(13) |
May
(8) |
Jun
(3) |
Jul
(19) |
Aug
(20) |
Sep
(6) |
Oct
(5) |
Nov
|
Dec
(4) |
| 2009 |
Jan
(1) |
Feb
|
Mar
(1) |
Apr
|
May
|
Jun
(10) |
Jul
(2) |
Aug
(5) |
Sep
|
Oct
(1) |
Nov
|
Dec
(5) |
| 2010 |
Jan
(10) |
Feb
(10) |
Mar
(2) |
Apr
|
May
(7) |
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
(1) |
Dec
|
| 2011 |
Jan
|
Feb
(4) |
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2012 |
Jan
|
Feb
|
Mar
|
Apr
(1) |
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2013 |
Jan
|
Feb
(2) |
Mar
(3) |
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Victor J. <vi...@nk...> - 2006-11-04 22:28:44
|
Francisco Mu=F1oz wrote: > Thanks for all the help. > > On screen the dump is just the same. (as without debug). This is 10 > seconds (approx.) of snort_inline output: > > =3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D= +=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+= =3D+ > > > 11/04-18:13:45.663780 192.168.1.22:39681 <http://192.168.1.22:39681> > -> 201.209.205.194:44456 <http://201.209.205.194:44456> > UDP TTL:127 TOS:0x0 ID:60827 IpLen:20 DgmLen:45 > Len: 17 > =3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D= +=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+= =3D+ > > 11/04-18:13:45.752568 201.209.205.194:44456 > <http://201.209.205.194:44456> -> 192.168.1.22:39681 > <http://192.168.1.22:39681> > UDP TTL:123 TOS:0x0 ID:7305 IpLen:20 DgmLen:536 > Len: 508 > =3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D= +=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+= =3D+ > > 11/04-18:13:45.765346 192.168.1.22:39681 <http://192.168.1.22:39681> > -> 201.209.205.194:44456 <http://201.209.205.194:44456> > UDP TTL:127 TOS:0x0 ID:60828 IpLen:20 DgmLen:45 > Len: 17 > =3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D= +=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+= =3D+ > > 11/04-18:13:45.775428 201.209.205.194:44456 > <http://201.209.205.194:44456> -> 192.168.1.22:39681 > <http://192.168.1.22:39681> > UDP TTL:123 TOS:0x0 ID:7306 IpLen:20 DgmLen:195 > Len: 167 > =3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D= +=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+= =3D+ > > > 11/04-18:13:45.816135 192.168.1.22:39681 <http://192.168.1.22:39681> > -> 201.209.205.194:44456 <http://201.209.205.194:44456> > UDP TTL:127 TOS:0x0 ID:60829 IpLen:20 DgmLen:45 > Len: 17 > =3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D= +=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+= =3D+ > > 11/04-18:13:45.875033 201.209.205.194:44456 > <http://201.209.205.194:44456> -> 192.168.1.22:39681 > <http://192.168.1.22:39681> > UDP TTL:123 TOS:0x0 ID:7309 IpLen:20 DgmLen:536 > Len: 508 > =3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D= +=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+= =3D+ > > 11/04-18:13:45.905730 201.209.205.194:44456 > <http://201.209.205.194:44456> -> 192.168.1.22:39681 > <http://192.168.1.22:39681> > UDP TTL:123 TOS:0x0 ID:7310 IpLen:20 DgmLen:102 > Len: 74 > =3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D= +=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+= =3D+ > > 11/04-18:13: 45.944983 201.209.205.194:44456 > <http://201.209.205.194:44456> -> 192.168.1.22:39681 > <http://192.168.1.22:39681> > UDP TTL:123 TOS:0x0 ID:7312 IpLen:20 DgmLen:536 > Len: 508 > =3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D= +=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+= =3D+ > > > 11/04-18:13:45.966097 201.209.205.194:44456 > <http://201.209.205.194:44456> -> 192.168.1.22:39681 > <http://192.168.1.22:39681> > UDP TTL:123 TOS:0x0 ID:7313 IpLen:20 DgmLen:50 > Len: 22 > =3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D= +=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+= =3D+ > > 11/04-18:13:46.062997 192.168.1.26:1202 <http://192.168.1.26:1202> -> > 64.4.36.39:1863 <http://64.4.36.39:1863> > TCP TTL:127 TOS:0x0 ID:2042 IpLen:20 DgmLen:217 DF > ***AP*** Seq: 0x65DFED9F Ack: 0xC85378F4 Win: 0xFA71 TcpLen: 20 > =3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D= +=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+= =3D+ > > 11/04-18:13:46.230546 201.209.205.194:44456 > <http://201.209.205.194:44456> -> 192.168.1.22:39681 > <http://192.168.1.22:39681> > UDP TTL:123 TOS:0x0 ID:7316 IpLen:20 DgmLen:536 > Len: 508 > =3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D= +=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+=3D+= =3D+ > I don't see any clamav output in there. Thats strange... ahh it looks as if the debugging is not yet enabled. Not only is clamav debugging missing, but also other snort debug info... In your source directory do: make clean ./configure --enable-debug <your other configure options, if any> make make install then rerun Snort_inline with: export SNORT_DEBUG=3D67108864 [root@camel log]# snort_inline -c /etc/snort_inline/snort_inline.conf -Q If there still is no per-packet clamav output, please check if the value of 67108864 is correct. To do this do from your source directory: $ grep CLAMAV src/debug.h #define DEBUG_CLAMAV 0x04000000 /* 67108864 */ That is the output I get. Maybe yours is different... Cheers! Victor |
|
From: <per...@gm...> - 2006-11-04 22:18:49
|
Thanks for all the help.
On screen the dump is just the same. (as without debug). This is 10 seconds
(approx.) of snort_inline output:
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
11/04-18:13:45.663780 192.168.1.22:39681 -> 201.209.205.194:44456
UDP TTL:127 TOS:0x0 ID:60827 IpLen:20 DgmLen:45
Len: 17
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
11/04-18:13:45.752568 201.209.205.194:44456 -> 192.168.1.22:39681
UDP TTL:123 TOS:0x0 ID:7305 IpLen:20 DgmLen:536
Len: 508
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
11/04-18:13:45.765346 192.168.1.22:39681 -> 201.209.205.194:44456
UDP TTL:127 TOS:0x0 ID:60828 IpLen:20 DgmLen:45
Len: 17
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
11/04-18:13:45.775428 201.209.205.194:44456 -> 192.168.1.22:39681
UDP TTL:123 TOS:0x0 ID:7306 IpLen:20 DgmLen:195
Len: 167
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
11/04-18:13:45.816135 192.168.1.22:39681 -> 201.209.205.194:44456
UDP TTL:127 TOS:0x0 ID:60829 IpLen:20 DgmLen:45
Len: 17
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
11/04-18:13:45.875033 201.209.205.194:44456 -> 192.168.1.22:39681
UDP TTL:123 TOS:0x0 ID:7309 IpLen:20 DgmLen:536
Len: 508
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
11/04-18:13:45.905730 201.209.205.194:44456 -> 192.168.1.22:39681
UDP TTL:123 TOS:0x0 ID:7310 IpLen:20 DgmLen:102
Len: 74
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
11/04-18:13:45.944983 201.209.205.194:44456 -> 192.168.1.22:39681
UDP TTL:123 TOS:0x0 ID:7312 IpLen:20 DgmLen:536
Len: 508
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
11/04-18:13:45.966097 201.209.205.194:44456 -> 192.168.1.22:39681
UDP TTL:123 TOS:0x0 ID:7313 IpLen:20 DgmLen:50
Len: 22
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
11/04-18:13:46.062997 192.168.1.26:1202 -> 64.4.36.39:1863
TCP TTL:127 TOS:0x0 ID:2042 IpLen:20 DgmLen:217 DF
***AP*** Seq: 0x65DFED9F Ack: 0xC85378F4 Win: 0xFA71 TcpLen: 20
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
11/04-18:13:46.230546 201.209.205.194:44456 -> 192.168.1.22:39681
UDP TTL:123 TOS:0x0 ID:7316 IpLen:20 DgmLen:536
Len: 508
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
===============================================================================
Snort processed 109 packets.
===============================================================================
Breakdown by protocol:
TCP: 33 (30.275%)
UDP: 76 (69.725%)
ICMP: 0 (0.000%)
ARP: 0 (0.000%)
EAPOL: 0 (0.000%)
IPv6: 0 (0.000%)
ETHLOOP: 0 (0.000%)
IPX: 0 (0.000%)
FRAG: 0 (0.000%)
OTHER: 0 (0.000%)
DISCARD: 0 (0.000%)
===============================================================================
Action Stats:
ALERTS: 0
LOGGED: 0
PASSED: 0
===============================================================================
TCP Stream Reassembly Stats:
TCP Packets Used: 33 (30.275%)
Stream Trackers: 3
Stream flushes: 0
Segments used: 0
Stream4 Memory Faults: 0
===============================================================================
Going to try to restore iptables rules /sbin/iptables-restore <
/var/log/snort_inline/iptables-rules
iptables rules restored ok now oink oink exit
Final Flow Statistics
,----[ FLOWCACHE STATS ]----------
Memcap: 10485760 Overhead Bytes 16400 used(%0.195322)/blocks (20481/12)
Overhead blocks: 1 Could Hold: (28263)
IPV4 count: 11 frees: 0
low_time: 1162678422, high_time: 1162678426, diff: 0h:00:04s
finds: 109 reversed: 26(%23.853211)
find_sucess: 98 find_fail: 11
percent_success: (%89.908257) new_flows: 11
Protocol: 6 (%30.275229)
finds: 33
reversed: 7(%21.212121)
find_sucess: 23
find_fail: 10
percent_success: (%69.696970)
new_flows: 10
Protocol: 17 (%69.724771)
finds: 76
reversed: 19(%25.000000)
find_sucess: 75
find_fail: 1
percent_success: (%98.684211)
new_flows: 1
Snort exiting
--
Regards,
Francisco
|
|
From: Victor J. <vi...@nk...> - 2006-11-04 22:09:49
|
Francisco Mu=F1oz wrote: > I just compiled snort_inline with --enable-debug, exported SNORT_DEBUG > but... > > where do i get the debug log? I think if you run snort_inline like this 'snort_inline -c /etc/snort_inline/snort_inline.conf -Q', it should just print the debug info to the screen. William also thought it might be somewhere in /tmp/ The rest of the output looks normal... Regards, Victor |
|
From: <per...@gm...> - 2006-11-04 22:02:30
|
I just compiled snort_inline with --enable-debug, exported SNORT_DEBUG
but...
where do i get the debug log?
snort_inline just works the same (dropping all), and i got no logs in
/var/log or /var/log/snort_inline.
by the way, created /tmp/snort_inline for clamav, set mode 777 and still
nothing.
here is the initialization info:
export SNORT_DEBUG=3D67108864
[root@camel log]# snort_inline -c /etc/snort_inline/snort_inline.conf -Q -=
N
-l /var/log/snort_inline -v
Reading from iptables
Running in IDS mode
Initializing Inline mode
--=3D=3D Initializing Snort =3D=3D--
Initializing Output Plugins!
Setting the Packet Processor to decode packets from iptables
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file /etc/snort_inline/snort_inline.conf
+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
default iptcmd is /sbin/iptables
default iptsave is /sbin/iptables-save >
/var/log/snort_inline/iptables-rules
default iptrestore is /sbin/iptables-restore <
/var/log/snort_inline/iptables-rules
,-----------[Flow Config]----------------------
| Stats Interval: 0
| Hash Method: 2
| Memcap: 10485760
| Rows : 4099
| Overhead Bytes: 16400(%0.16)
`----------------------------------------------
stream4inline mode enabled
truncating mode enabled
Stream4 config:
Stateful inspection: ACTIVE
Session statistics: INACTIVE
Session timeout: 3600 seconds
Session memory cap: 134217728 bytes
Session count max: 8192 sessions
Session cleanup count: 5
State alerts: INACTIVE
Evasion alerts: INACTIVE
Scan alerts: INACTIVE
Log Flushed Streams: INACTIVE
MinTTL: 1
TTL Limit: 5
Async Link: 0
State Protection: 0
Self preservation threshold: 50
Self preservation period: 90
Suspend threshold: 200
Suspend period: 30
Enforce TCP State: ACTIVE
Midstream Drop Alerts: INACTIVE
Server Data Inspection Limit: -1
Inline-mode options:
Inline-mode enabled? (stream4inline): Yes
Sliding Windowsize (window_size): 4096 (max full conn: 32768)
Memcap reached method (truncate): Truncate
Truncate percentage (truncate_percentage): 33
DROP out-of-window packets (drop_out_of_window): No
DROP data on unestablised session state (drop_data_on_unest): No
DROP no tcp-flags on establised packets (drop_no_tcp_on_est): No
DROP packet not within session limits (drop_not_in_limits): No
DROP ttl evasion (drop_ttl_evasion): No
Store/Load state from/to disk: No
WARNING /etc/snort_inline/snort_inline.conf(306) =3D> flush_behavior set in
config file, using old static flushpoints (0)
Stream4_reassemble config:
Server reassembly: INACTIVE
Client reassembly: ACTIVE
Reassembler alerts: ACTIVE
Zero out flushed packets: INACTIVE
Flush stream on alert: INACTIVE
flush_data_diff_size: 500
Reassembler Packet Preferance : Favor Old
Packet Sequence Overlap Limit: -1
Flush behavior: Small (<255 bytes)
Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521
3306
Emergency Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513
1433 1521 3306
ClamAV config:
Ports: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 ...
Virus found action: DROP
Virus definitions dir: '/var/clamav'
Virus DB reload time: '600'
Scan only traffic to the client
Directory for tempfiles (file descriptor mode): '/tmp/snort_inline'
LibClamAV Warning: ********************************************************
LibClamAV Warning: *** This version of the ClamAV engine is outdated. ***
LibClamAV Warning: *** DON'T PANIC! Read http://www.clamav.net/faq.html ***
LibClamAV Warning: ********************************************************
HttpInspect Config:
GLOBAL CONFIG
Max Pipeline Requests: 0
Inspection Type: STATELESS
Detect Proxy Usage: NO
IIS Unicode Map Filename: /etc/snort_inline/unicode.map
IIS Unicode Map Codepage: 1252
rpc_decode arguments:
Ports to decode RPC on: 111 32771
alert_fragments: INACTIVE
alert_large_fragments: ACTIVE
alert_incomplete: ACTIVE
alert_multiple_requests: ACTIVE
telnet_decode arguments:
Ports to decode telnet on: 21 23 25 119
Portscan Detection Config:
Detect Protocols: TCP UDP ICMP IP
Detect Scan Type: portscan portsweep decoy_portscan
distributed_portscan
Sensitivity Level: Low
Memcap (in bytes): 10000000
Number of Nodes: 36900
4601 Snort rules read...
4601 Option Chains linked into 239 Chain Headers
0 Dynamic rules
+++++++++++++++++++++++++++++++++++++++++++++++++++
Warning: flowbits key 'dce.isystemactivator.bind.call.attempt' is set but
not ever checked.
Warning: flowbits key 'trojan' is set but not ever checked.
Warning: flowbits key 'dce.bind.veritas' is set but not ever checked.
Warning: flowbits key 'ssh.brute.attempt' is set but not ever checked.
InitInline stage 2: InitInlinePostConfig starting...
+-----------------------[thresholding-config]------------------------------=
----
| memory-cap : 1048576 bytes
+-----------------------[thresholding-global]------------------------------=
----
| none
+-----------------------[thresholding-local]-------------------------------=
----
| gen-id=3D1 sig-id=3D2002994 type=3DBoth tracking=3Dsrc count=
=3D20
seconds=3D120
| gen-id=3D1 sig-id=3D2002801 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D360
| gen-id=3D1 sig-id=3D2003068 type=3DThreshold tracking=3Dsrc count=
=3D5
seconds=3D120
| gen-id=3D1 sig-id=3D2001034 type=3DLimit tracking=3Dsrc count=
=3D2
seconds=3D360
| gen-id=3D1 sig-id=3D2000048 type=3DLimit tracking=3Ddst count=
=3D1
seconds=3D60
| gen-id=3D1 sig-id=3D2002878 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D360
| gen-id=3D1 sig-id=3D2001796 type=3DThreshold tracking=3Dsrc count=
=3D10
seconds=3D60
| gen-id=3D1 sig-id=3D2400001 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D3600
| gen-id=3D1 sig-id=3D2002758 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D120
| gen-id=3D1 sig-id=3D2001858 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D360
| gen-id=3D1 sig-id=3D2001906 type=3DBoth tracking=3Dsrc count=
=3D5
seconds=3D60
| gen-id=3D1 sig-id=3D2410002 type=3DLimit tracking=3Ddst count=
=3D1
seconds=3D3600
| gen-id=3D1 sig-id=3D5323 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D60
| gen-id=3D1 sig-id=3D2002992 type=3DBoth tracking=3Dsrc count=
=3D20
seconds=3D120
| gen-id=3D1 sig-id=3D2002761 type=3DBoth tracking=3Dsrc count=
=3D5
seconds=3D3600
| gen-id=3D1 sig-id=3D2923 type=3DThreshold tracking=3Ddst count=
=3D10
seconds=3D60
| gen-id=3D1 sig-id=3D2924 type=3DThreshold tracking=3Ddst count=
=3D10
seconds=3D60
| gen-id=3D1 sig-id=3D2001713 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D30
| gen-id=3D1 sig-id=3D2001043 type=3DLimit tracking=3Dsrc count=
=3D10
seconds=3D60
| gen-id=3D1 sig-id=3D2002911 type=3DThreshold tracking=3Dsrc count=
=3D5
seconds=3D60
| gen-id=3D1 sig-id=3D2001872 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D360
| gen-id=3D1 sig-id=3D5322 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D60
| gen-id=3D1 sig-id=3D2000340 type=3DLimit tracking=3Ddst count=
=3D1
seconds=3D600
| gen-id=3D1 sig-id=3D2400000 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D3600
| gen-id=3D1 sig-id=3D2001569 type=3DBoth tracking=3Dsrc count=
=3D70
seconds=3D60
| gen-id=3D1 sig-id=3D2001219 type=3DThreshold tracking=3Dsrc count=
=3D5
seconds=3D120
| gen-id=3D1 sig-id=3D2001904 type=3DBoth tracking=3Dsrc count=
=3D30
seconds=3D60
| gen-id=3D1 sig-id=3D2523 type=3DBoth tracking=3Ddst count=
=3D10
seconds=3D10
| gen-id=3D1 sig-id=3D2000031 type=3DLimit tracking=3Ddst count=
=3D1
seconds=3D60
| gen-id=3D1 sig-id=3D2410003 type=3DLimit tracking=3Ddst count=
=3D1
seconds=3D3600
| gen-id=3D1 sig-id=3D5321 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D60
| gen-id=3D1 sig-id=3D2001267 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D3600
| gen-id=3D1 sig-id=3D2400003 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D3600
| gen-id=3D1 sig-id=3D2001873 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D60
| gen-id=3D1 sig-id=3D2001846 type=3DThreshold tracking=3Ddst count=
=3D30
seconds=3D300
| gen-id=3D1 sig-id=3D2001583 type=3DBoth tracking=3Dsrc count=
=3D70
seconds=3D60
| gen-id=3D1 sig-id=3D2002664 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D60
| gen-id=3D1 sig-id=3D2410001 type=3DLimit tracking=3Ddst count=
=3D1
seconds=3D3600
| gen-id=3D1 sig-id=3D2410004 type=3DLimit tracking=3Ddst count=
=3D1
seconds=3D3600
| gen-id=3D1 sig-id=3D2001841 type=3DThreshold tracking=3Dsrc count=
=3D40
seconds=3D300
| gen-id=3D1 sig-id=3D2002973 type=3DBoth tracking=3Dsrc count=
=3D10
seconds=3D60
| gen-id=3D1 sig-id=3D2001855 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D360
| gen-id=3D1 sig-id=3D2002402 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D360
| gen-id=3D1 sig-id=3D2402000 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D3600
| gen-id=3D1 sig-id=3D2001235 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D3600
| gen-id=3D1 sig-id=3D2001972 type=3DBoth tracking=3Dsrc count=
=3D20
seconds=3D360
| gen-id=3D1 sig-id=3D2002364 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D3600
| gen-id=3D1 sig-id=3D2001580 type=3DBoth tracking=3Dsrc count=
=3D70
seconds=3D60
| gen-id=3D1 sig-id=3D2000005 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D120
| gen-id=3D1 sig-id=3D2001809 type=3DThreshold tracking=3Dsrc count=
=3D10
seconds=3D60
| gen-id=3D1 sig-id=3D2001663 type=3DLimit tracking=3Dsrc count=
=3D2
seconds=3D360
| gen-id=3D1 sig-id=3D2400004 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D3600
| gen-id=3D1 sig-id=3D2002760 type=3DBoth tracking=3Dsrc count=
=3D10
seconds=3D600
| gen-id=3D1 sig-id=3D2002993 type=3DBoth tracking=3Dsrc count=
=3D20
seconds=3D120
| gen-id=3D1 sig-id=3D2002749 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D360
| gen-id=3D1 sig-id=3D2002732 type=3DThreshold tracking=3Dsrc count=
=3D10
seconds=3D60
| gen-id=3D1 sig-id=3D2002180 type=3DThreshold tracking=3Dsrc count=
=3D5
seconds=3D60
| gen-id=3D1 sig-id=3D2001712 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D360
| gen-id=3D1 sig-id=3D2002383 type=3DThreshold tracking=3Ddst count=
=3D5
seconds=3D120
| gen-id=3D1 sig-id=3D2000049 type=3DLimit tracking=3Ddst count=
=3D1
seconds=3D60
| gen-id=3D1 sig-id=3D2002995 type=3DBoth tracking=3Dsrc count=
=3D20
seconds=3D120
| gen-id=3D1 sig-id=3D2001315 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D360
| gen-id=3D1 sig-id=3D2002400 type=3DLimit tracking=3Dsrc count=
=3D2
seconds=3D360
| gen-id=3D1 sig-id=3D3527 type=3DLimit tracking=3Ddst count=
=3D5
seconds=3D60
| gen-id=3D1 sig-id=3D2002742 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D120
| gen-id=3D1 sig-id=3D2001795 type=3DLimit tracking=3Dsrc count=
=3D30
seconds=3D60
| gen-id=3D1 sig-id=3D2400002 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D3600
| gen-id=3D1 sig-id=3D2410000 type=3DLimit tracking=3Ddst count=
=3D1
seconds=3D3600
| gen-id=3D1 sig-id=3D2001316 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D360
| gen-id=3D1 sig-id=3D2002842 type=3DBoth tracking=3Dsrc count=
=3D5
seconds=3D60
| gen-id=3D1 sig-id=3D2001582 type=3DBoth tracking=3Dsrc count=
=3D70
seconds=3D60
| gen-id=3D1 sig-id=3D2002910 type=3DThreshold tracking=3Dsrc count=
=3D5
seconds=3D60
| gen-id=3D1 sig-id=3D2001579 type=3DBoth tracking=3Dsrc count=
=3D70
seconds=3D60
| gen-id=3D1 sig-id=3D2002750 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D360
| gen-id=3D1 sig-id=3D2275 type=3DThreshold tracking=3Ddst count=
=3D5
seconds=3D60
| gen-id=3D1 sig-id=3D2001553 type=3DThreshold tracking=3Dsrc count=
=3D100
seconds=3D60
| gen-id=3D1 sig-id=3D2001581 type=3DBoth tracking=3Dsrc count=
=3D70
seconds=3D60
| gen-id=3D1 sig-id=3D2002751 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D360
| gen-id=3D1 sig-id=3D2000929 type=3DLimit tracking=3Dsrc count=
=3D1
seconds=3D360
+-----------------------[suppression]--------------------------------------=
----
| none
---------------------------------------------------------------------------=
----
Rule application order:
->activation->dynamic->drop->sdrop->reject->rejectboth->rejectsrc->rejectds=
t->alert->pass->log
Log directory =3D /var/log/snort_inline
--=3D=3D Initialization Complete =3D=3D--
,,_ -*> Snort_Inline! <*-
o" )~ Version 2.4.5 (Build 29)
'''' By Martin Roesch & The Snort Team: http://www.snort.org/team.htm=
l
(C) Copyright 1998-2005 Sourcefire Inc., et al.
Snort_Inline Mod by William Metcalf, Victor Julien, Nick Rogness=
,
Dave Remien, Rob McMillen and Jed Haile
NOTE: Snort's default output has changed in version 2.4.1!
The default logging mode is now PCAP, use "-K ascii" to activate
the old default logging mode.
On 11/4/06, Francisco Mu=F1oz <per...@gm...> wrote:
>
>
> ---------- Forwarded message ----------
> From: Victor Julien <vi...@nk...>
> Date: Nov 4, 2006 4:59 PM
> Subject: Re: [Snort-inline-users] Fwd: Clamav
> To: Francisco Mu=F1oz <per...@gm...>
> Cc: sno...@li...
>
> >
> >
> > I'll not be running snort_inline chrooted again. I thought it'd
> > improve performance.
> >
> So without the -t option it still doesn't work?
>
> No, doesn't work, still drops all packets.
>
> Can you add and remove files from /clamscan manually? Have you tried
> supplying a ordinary directory to the clamav preprocessor?
>
> I can add and remove files manually as an ordinary user to /clamscan
>
> I don't know how to supply a ordinary directory to the clamav
> preprocessor.
>
> If that all doesn't work you can compile snort_inline in debug mode. You
> do that by adding --enable-debug to ./configure.
>
> Then, when you have rebuild snort_inline, you can run it like this:
> export SNORT_DEBUG=3D67108864
> snort_inline <all your normal args>
>
> This will hopefully give some interesting output :-)
>
> Ok, i'll do it and post my findings.
>
>
> Regards,
> Victor
>
> Thanks a lot.
>
> --
> Regards,
> Francisco
--=20
Saludos,
Francisco
|
|
From: Victor J. <vi...@nk...> - 2006-11-04 21:14:02
|
Francisco Mu=F1oz wrote: > > ---------- Forwarded message ---------- > From: *Victor Julien* <vi...@nk... <mailto:vi...@nk...>> > Date: Nov 4, 2006 4:59 PM > Subject: Re: [Snort-inline-users] Fwd: Clamav > To: Francisco Mu=F1oz <per...@gm... <mailto:per...@gm...>= > > Cc: sno...@li... > <mailto:sno...@li...> > > > > > > > I'll not be running snort_inline chrooted again. I thought it'd > > improve performance. > > > So without the -t option it still doesn't work? > > No, doesn't work, still drops all packets. > > Can you add and remove files from /clamscan manually? Have you tried > supplying a ordinary directory to the clamav preprocessor? > > I can add and remove files manually as an ordinary user to /clamscan > > I don't know how to supply a ordinary directory to the clamav > preprocessor. > Just do 'mkdir /tmp/somedir' and use 'descriptor-temp-dir /tmp/somedir' in your snort config. > If that all doesn't work you can compile snort_inline in debug mode. Yo= u > do that by adding --enable-debug to ./configure. > > Then, when you have rebuild snort_inline, you can run it like this: > export SNORT_DEBUG=3D67108864 > snort_inline <all your normal args> > > This will hopefully give some interesting output :-) > > Ok, i'll do it and post my findings. Ok, let us know :-) Cheers! Victor |
|
From: <per...@gm...> - 2006-11-04 21:07:19
|
---------- Forwarded message ---------- From: Victor Julien <vi...@nk...> Date: Nov 4, 2006 4:59 PM Subject: Re: [Snort-inline-users] Fwd: Clamav To: Francisco Mu=F1oz <per...@gm...> Cc: sno...@li... > > > I'll not be running snort_inline chrooted again. I thought it'd > improve performance. > So without the -t option it still doesn't work? No, doesn't work, still drops all packets. Can you add and remove files from /clamscan manually? Have you tried supplying a ordinary directory to the clamav preprocessor? I can add and remove files manually as an ordinary user to /clamscan I don't know how to supply a ordinary directory to the clamav preprocessor. If that all doesn't work you can compile snort_inline in debug mode. You do that by adding --enable-debug to ./configure. Then, when you have rebuild snort_inline, you can run it like this: export SNORT_DEBUG=3D67108864 snort_inline <all your normal args> This will hopefully give some interesting output :-) Ok, i'll do it and post my findings. Regards, Victor Thanks a lot. --=20 Regards, Francisco |
|
From: Victor J. <vi...@nk...> - 2006-11-04 20:59:15
|
> > > I'll not be running snort_inline chrooted again. I thought it'd > improve performance. > So without the -t option it still doesn't work? Can you add and remove files from /clamscan manually? Have you tried supplying a ordinary directory to the clamav preprocessor? If that all doesn't work you can compile snort_inline in debug mode. You do that by adding --enable-debug to ./configure. Then, when you have rebuild snort_inline, you can run it like this: export SNORT_DEBUG=67108864 snort_inline <all your normal args> This will hopefully give some interesting output :-) Regards, Victor |
|
From: <per...@gm...> - 2006-11-04 20:48:09
|
Sorry for replying to you directly. I'm replying to the list now.
---------- Forwarded message ----------
From: Francisco Mu=F1oz <per...@gm...>
Date: Nov 4, 2006 4:46 PM
Subject: Re: [Snort-inline-users] Clamav
To: Victor Julien <vi...@nk...>
Thanks a lot Victor, for the quick reply.
>
> > When i uncomment the "preprocessor clamav" line, all traffic is dropped=
.
>
> This behaviour is consistent with the directory spp_clamav uses not
> being usable for some reason.
Well, i suppose then the compile process is right, i must be doing somethin=
g
else wrong.
What else can i do to make it work? i'll do anything you say.
> #preprocessor clamav: toclientonly, ports all !22 !443, action-drop,
> > descriptor-temp-dir /clamscan, dbreload-time 43200
> Does the directory /clamscan (in the root filesystem) exist? If so, does
> Snort_inline have permissions to read and write there?
Yes, the directory exists. But using /tmp doesn't help either.
# This file is edited by fstab-sync - see 'man fstab-sync' for details
/dev/VolGroup00/LogVol00 / ext3 defaults 1 =
1
LABEL=3D/boot1 /boot ext3 defaults 1=
2
none /dev/pts devpts gid=3D5,mode=3D620 =
0 0
none /dev/shm tmpfs defaults 0 0
none /proc proc defaults 0 0
none /sys sysfs defaults 0 0
/dev/hdb4 swap swap defaults 0 0
/dev/VolGroup00/LogVol01 swap swap defaults 0 =
0
none /clamscan tmpfs
mode=3D0775,size=3D64m,nr_inodes=3D256k 0 0
/dev/hdc /media/cdrom auto
pamconsole,exec,noauto,managed 0 0
/dev/hdb2 /tools ext3 defaults 1 1
and is currently mounted:
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
37317304 3598848 31822828 11% /
/dev/hda1 101086 14894 80973 16% /boot
none 517404 0 517404 0% /dev/shm
none 65536 0 65536 0% /clamscan
/dev/hdb2 76306808 52932092 19498504 74% /tools
>
> >
> > i'm running snort_inline (for test purposes only) this way:
> > snort_inline -c /etc/snort_inline/snort_inline.conf -Q -N -l
> > /var/log/snort_inline -t /var/log/snort_inline -v
> -t means:
> -t <dir> Chroots process to <dir> after initialization
>
> I think this might be a problem. If you want to run snort_inline in a
> chroot (i've never tried this) make sure the temp directory for clamav
> exists in there.
I'll not be running snort_inline chrooted again. I thought it'd improve
performance.
Hope this helps!
> Victor
>
>
Thanks again.
--
Francisco
|
|
From: Victor J. <vi...@nk...> - 2006-11-04 20:20:40
|
Francisco Mu=F1oz wrote:
> (by the way, i'm using vuurmuur 0.5.71 to generate my iptables rules.
> Kudos to Victor Julien)
Thanks ;-)
>
> I did use a tmpfs directory and set permissions to 0755 on that.
> sometimes i let file-descriptor-dir unconfigured so snort_inline uses
> /tmp but no luck anyway.
>
> When i uncomment the "preprocessor clamav" line, all traffic is dropped.
This behaviour is consistent with the directory spp_clamav uses not
being usable for some reason.
> #preprocessor clamav: toclientonly, ports all !22 !443, action-drop,
> descriptor-temp-dir /clamscan, dbreload-time 43200
Does the directory /clamscan (in the root filesystem) exist? If so, does
Snort_inline have permissions to read and write there?
>
>
> i'm running snort_inline (for test purposes only) this way:
> snort_inline -c /etc/snort_inline/snort_inline.conf -Q -N -l
> /var/log/snort_inline -t /var/log/snort_inline -v
-t means:
-t <dir> Chroots process to <dir> after initialization
I think this might be a problem. If you want to run snort_inline in a
chroot (i've never tried this) make sure the temp directory for clamav
exists in there.
Hope this helps!
Victor
|
|
From: <per...@gm...> - 2006-11-04 20:05:56
|
Greetings.
I'm using snort_inline for several months and want to use the clamav
preprocessor, but i have no luck.
iptables is properly configured to use the QUEUE target and snort_inline is
able to process traffic bidirectionally.
(by the way, i'm using vuurmuur 0.5.71 to generate my iptables rules. Kudos
to Victor Julien)
snort_inline 2.4.5a, compiled with ./configure --enable-clamav
--with-clamav-includes=/usr/include --with-clamav-defdir=/var/clamav
libnet 1.0.2a
libdnet 1.11-1.2
iptables 1.3.1
kernel 2.6.12 on CentOS 4.4
libclamav 0.88
Actually i'm using the bleeding edge rules with full success. All suspicious
traffic is dropped and logged:
BLEEDING-EDGE P2P Gnutella Connect [**] [Classification: Potential Corporate
Privacy Violation] [Priority: 1] {TCP} 192.168.1.31:2973 ->
66.169.16.160:51793
11/04-15:22:36.587473 [**] [1:2001855:16] BLEEDING-EDGE MALWARE Fun Web
Products Spyware User Agent (1) [**] [Classification: A Network Trojan was
detected] [Priority: 1] {TCP} 192.168.1.31:2976 -> 200.69.229.81:80
11/04-15:22:39.769548 [**] [1:2001664:3] BLEEDING-EDGE P2P Gnutella Connect
[**] [Classification: Potential Corporate Privacy Violation] [Priority: 1]
{TCP} 192.168.1.31:2979 -> 87.4.226.253:52799
I did use a tmpfs directory and set permissions to 0755 on that.
sometimes i let file-descriptor-dir unconfigured so snort_inline uses /tmp
but no luck anyway.
When i uncomment the "preprocessor clamav" line, all traffic is dropped.
this is my snort_inline.conf.
### Network variables
var HOME_NET 192.168.1.0/24
# var HONEYNET any
var EXTERNAL_NET any
var SMTP_SERVERS any
var TELNET_SERVERS any
var HTTP_SERVERS any
var SQL_SERVERS any
var HTTP_PORTS 80
var SHELLCODE_PORTS !80
var ORACLE_PORTS 1521
var SSH_PORTS 22
config checksum_mode: all
var RULE_PATH /etc/snort_inline/rules
# config layer2resets: 00:04:75:A0:40:5E
# config flowbits recommendation
config flowbits_size: 256
preprocessor stickydrop: max_entries 3000,log
preprocessor stickydrop-timeouts: sfportscan 3000, portscan2 3000, clamav
3000
preprocessor stickydrop-ignorehosts: 192.168.1.0/24
preprocessor bait-and-switch: max_entries 200,log,insert_before
preprocessor bait-and-switch-ignorehosts: 192.168.1.0/24
preprocessor flow: stats_interval 0 hash 2
preprocessor stream4: disable_evasion_alerts, stream4inline, \
enforce_state, memcap 134217728, timeout 3600, \
truncate, window_size 4096
preprocessor stream4_reassemble
#preprocessor clamav: toclientonly, ports all !22 !443, action-drop,
descriptor-temp-dir /clamscan, dbreload-time 43200
preprocessor http_inspect: global \
iis_unicode_map unicode.map 1252
preprocessor rpc_decode: 111 32771
preprocessor bo
preprocessor telnet_decode
preprocessor sfportscan: proto { all } \
memcap { 10000000 } \
sense_level { low }
output alert_fast: snort_inline-fast
include $RULE_PATH/classification.config
include $RULE_PATH/reference.config
# bleeding
include $RULE_PATH/bleeding-policy.rules
include $RULE_PATH/bleeding-botcc.rules
include $RULE_PATH/bleeding-dos.rules
include $RULE_PATH/bleeding-drop.rules
include $RULE_PATH/bleeding-dshield.rules
include $RULE_PATH/bleeding-exploit.rules
include $RULE_PATH/bleeding-game.rules
include $RULE_PATH/bleeding-malware.rules
include $RULE_PATH/bleeding-p2p.rules
include $RULE_PATH/bleeding-scan.rules
include $RULE_PATH/bleeding-virus.rules
include $RULE_PATH/bleeding-web.rules
include $RULE_PATH/bleeding.rules
i'm running snort_inline (for test purposes only) this way: snort_inline -c
/etc/snort_inline/snort_inline.conf -Q -N -l /var/log/snort_inline -t
/var/log/snort_inline -v
TIA
--
Francisco
|
|
From: Will M. <wil...@gm...> - 2006-10-31 23:47:33
|
I'll whip one up tonight...... maybe, I'm pretty freaking busy... sometime in the next couple of day's sounds better ;-) On 10/31/06, Bill Warren <bw...@op...> wrote: > I am looking for snort-2.4.5-clamonly.diff. I looked at > http://www.bleedingthreats.net/cgi-bin/viewcvs.cgi/snort-clamav/?root=Snort-Clamav > and I don't see it there anymore. Would somebody point me to the right > place or email it to me? > > > Thanks, > Bill > -- > > Bill Warren > > Network Systems Administrator > Optivel, Inc. > 317.275.2305 office > 317.523.8468 cell > www.optivel.com > > > ------------------------------------------------------------------------- > Using Tomcat but need to do more? Need to support web services, security? > Get stuff done quickly with pre-integrated technology to make your job easier > Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 > _______________________________________________ > Snort-inline-users mailing list > Sno...@li... > https://lists.sourceforge.net/lists/listinfo/snort-inline-users > |
|
From: Bill W. <bw...@op...> - 2006-10-31 18:43:46
|
I am looking for snort-2.4.5-clamonly.diff. I looked at http://www.bleedingthreats.net/cgi-bin/viewcvs.cgi/snort-clamav/?root=Snort-Clamav and I don't see it there anymore. Would somebody point me to the right place or email it to me? Thanks, Bill -- Bill Warren Network Systems Administrator Optivel, Inc. 317.275.2305 office 317.523.8468 cell www.optivel.com |
|
From: Nick R. <ni...@ro...> - 2006-10-24 03:11:05
|
Folks, I've submitted the update patch [below] to the FreeBSD team to upgrade the ports version to snort_inline-2.4.5. I cc'd this list so everyone knows where it is at. It's long overdue and I apologize. Cheers! > >>Submitter-Id: current-users >>Originator: Nick Rogness >>Organization: >>Confidential: no >>Synopsis: Port update to security/snort_inline >>Severity: non-critical >>Priority: low >>Category: ports >>Class: maintainer-update >>Release: FreeBSD 5.4-STABLE i386 >>Environment: > System: FreeBSD skywalker.rogness.net 5.4-STABLE FreeBSD 5.4-STABLE #0: > Mon Jul 11 21:54:56 MDT 2005 > ni...@sk...:/usr/src/sys/i386/compile/SKYWALKER i386 > > >>Description: > Update port security/snort_inline to version 2.4.5 > >>How-To-Repeat: > Attached Unified diff under Fix >>Fix: > > > diff -ruN snort_inline.old/Makefile snort_inline/Makefile > --- snort_inline.old/Makefile Fri May 12 22:15:15 2006 > +++ snort_inline/Makefile Mon Oct 23 20:16:34 2006 > @@ -2,23 +2,19 @@ > # Date created: 4 March 2005 > # Whom: ni...@ro... > # > -# $FreeBSD: ports/security/snort_inline/Makefile,v 1.4 2006/05/13 > 04:15:15 edwin Exp $ > +# $FreeBSD: ports/security/snort_inline/Makefile,v 1.3 2005/11/14 > 17:07:04 sem Exp $ > # > > PORTNAME= snort_inline > -PORTVERSION= 2.3.0 > -PORTREVISION= 1 > +PORTVERSION= 2.4.5 > CATEGORIES= security > MASTER_SITES= http://freebsd.rogness.net/ports/snort_inline/ > -DISTNAME= snort_inline-2.3.0-RC1 > > MAINTAINER= ni...@ro... > COMMENT= An inline IPS system based on snort using ipfw > > LIB_DEPENDS= pcre.0:${PORTSDIR}/devel/pcre > > -WRKSRC= ${WRKDIR}/snort_inline-2.3.0-RC1 > - > USE_GPG= yes > SIG_SUFFIX= .asc > GNU_CONFIGURE= yes > @@ -26,9 +22,7 @@ > CONFIGURE_TARGET= --build=${MACHINE_ARCH}-portbld-freebsd${OSREL} > CONFIGURE_ARGS+= --enable-inline --enable-ipfw > > -BUILD_DEPENDS+= libnet*<=1.1.0,1:${PORTSDIR}/net/libnet10 > -CONFIGURE_ARGS+= --with-libnet-includes=${LOCALBASE}/include \ > - --with-libnet-libraries=${LOCALBASE}/lib > +LIB_DEPENDS+= dnet:${PORTSDIR}/net/libdnet > > .if defined(WITH_MYSQL) > USE_MYSQL= yes > @@ -55,14 +49,20 @@ > CONFIGURE_ARGS+= --with-postgresql=no > .endif > > -MAN8= snort.8 > +MAN8= snort.8 snort_inline.8 > DOCS= ChangeLog doc/AUTHORS doc/BUGS doc/CREDITS doc/faq* doc/NEWS \ > doc/README* doc/TODO doc/USAGE doc/*.pdf > > +RULE_PATH= ${DATADIR}/rules > + > USE_RC_SUBR= snort.sh > > post-patch: > ${REINPLACE_CMD} "s,%%PREFIX%%,${PREFIX}," ${WRKSRC}/src/snort.c > + ${REINPLACE_CMD} "s,/etc/snort_inline/drop-rules,${RULE_PATH}," > ${WRKSRC}/etc/snort_inline.conf > + ${REINPLACE_CMD} > "s,$RULE_PATH/classification.config,${DATADIR}/classification.config," > ${WRKSRC}/etc/snort_inline.conf > + ${REINPLACE_CMD} > "s,$RULE_PATH/reference.config,${DATADIR}/reference.config," > ${WRKSRC}/etc/snort_inline.conf > + ${REINPLACE_CMD} -e > "s/^unicode.map/\/usr\/local\/share\/snort_inline\/unicode.map/" > ${WRKSRC}/etc/snort_inline.conf > > pre-configure: > @${ECHO} "" > @@ -72,7 +72,7 @@ > > post-install: > @${MKDIR} ${DATADIR} > - ${INSTALL_DATA} ${WRKSRC}/rules/*.rules ${DATADIR} > + @${MKDIR} ${RULE_PATH} > ${INSTALL_DATA} ${WRKSRC}/etc/classification.config \ > ${DATADIR}/classification.config-sample > [ -f ${DATADIR}/classification.config ] || \ > @@ -82,7 +82,13 @@ > ${DATADIR}/reference.config-sample > [ -f ${DATADIR}/reference.config ] || \ > ${CP} ${DATADIR}/reference.config-sample ${DATADIR}/reference.config > -.for f in snort.conf snort_inline.conf unicode.map threshold.conf > + ${INSTALL_DATA} ${WRKSRC}/etc/threshold.conf \ > + ${DATADIR}/threshold.conf-sample > + [ -f ${DATADIR}/threshold.conf ] || \ > + ${CP} ${DATADIR}/threshold.conf-sample ${DATADIR}/threshold.conf > + ${INSTALL_DATA} ${WRKSRC}/etc/unicode.map \ > + ${DATADIR}/unicode.map > +.for f in snort.conf snort_inline.conf > ${INSTALL_DATA} ${WRKSRC}/etc/${f} ${PREFIX}/etc/${f}-sample > [ -f ${PREFIX}/etc/${f} ] || \ > ${INSTALL_DATA} ${WRKSRC}/etc/${f} ${PREFIX}/etc/${f} > diff -ruN snort_inline.old/distinfo snort_inline/distinfo > --- snort_inline.old/distinfo Mon Jan 23 18:03:27 2006 > +++ snort_inline/distinfo Wed Jun 7 18:12:19 2006 > @@ -1,3 +1,3 @@ > -MD5 (snort_inline-2.3.0-RC1.tar.gz) = d577c101a78c97b0f18a1e01b0252419 > -SHA256 (snort_inline-2.3.0-RC1.tar.gz) = > 46027eeb583dd2efa1ca724948a84fd79d320a0f04df4befde27688c4f7995dc > -SIZE (snort_inline-2.3.0-RC1.tar.gz) = 2742898 > +MD5 (snort_inline-2.4.5.tar.gz) = 6fbc46cb339cd9f7b9699104b9a99b1a > +SHA256 (snort_inline-2.4.5.tar.gz) = > c417dd23d06d468f0fc5d2cc4f9d1022db5b02a9a77d702f8e24261f0a433651 > +SIZE (snort_inline-2.4.5.tar.gz) = 3019957 > diff -ruN snort_inline.old/files/snort.sh.in > snort_inline/files/snort.sh.in > --- snort_inline.old/files/snort.sh.in Mon Feb 20 13:47:40 2006 > +++ snort_inline/files/snort.sh.in Wed Jun 7 18:09:58 2006 > @@ -4,7 +4,7 @@ > # PROVIDE: snort > # REQUIRE: DAEMON > # BEFORE: LOGIN > -# KEYWORD: shutdown > +# KEYWORD: FreeBSD shutdown > > # Add the following lines to /etc/rc.conf to enable snort: > # snort_enable (bool): Set to YES to enable snort > @@ -22,7 +22,7 @@ > name="snort" > rcvar=`set_rcvar` > > -command="%%PREFIX%%/bin/snort" > +command="%%PREFIX%%/bin/snort_inline" > > load_rc_config $name > > diff -ruN snort_inline.old/pkg-plist snort_inline/pkg-plist > --- snort_inline.old/pkg-plist Sat May 28 05:06:39 2005 > +++ snort_inline/pkg-plist Mon Oct 23 20:45:39 2006 > @@ -5,11 +5,11 @@ > @unexec if [ -f %D/etc/snort_inline.conf ] && cmp -s > %D/etc/snort_inline.conf %D/etc/snort_inline.conf-sample; then rm -f > %D/etc/snort_inline.conf; fi > etc/snort_inline.conf-sample > @exec [ -f %B/snort_inline.conf ] || cp %B/%f %B/snort_inline.conf > -@unexec if [ -f %D/etc/unicode.map ] && cmp -s %D/etc/unicode.map > %D/etc/unicode.map-sample; then rm -f %D/etc/unicode.map; fi > -etc/unicode.map-sample > +@unexec if [ -f %B/unicode.map ] && cmp -s %B/unicode.map > %B/unicode.map-sample; then rm -f %B/etc/unicode.map; fi > +%%DATADIR%%/unicode.map > @exec [ -f %B/unicode.map ] || cp %B/%f %B/unicode.map > -@unexec if [ -f %D/etc/threshold.conf ] && cmp -s %D/etc/threshold.conf > %D/etc/threshold.conf-sample; then rm -f %D/etc/threshold.conf; fi > -etc/threshold.conf-sample > +@unexec if [ -f %B/threshold.conf ] && cmp -s %B/threshold.conf > %B/threshold.conf-sample; then rm -f %B/threshold.conf; fi > +%%DATADIR%%/threshold.conf-sample > @exec [ -f %B/threshold.conf ] || cp %B/%f %B/threshold.conf > %%PORTDOCS%%%%DOCSDIR%%/AUTHORS > %%PORTDOCS%%%%DOCSDIR%%/BUGS > @@ -36,63 +36,20 @@ > %%PORTDOCS%%%%DOCSDIR%%/README.http_inspect > %%PORTDOCS%%%%DOCSDIR%%/README.thresholding > %%PORTDOCS%%%%DOCSDIR%%/README.wireless > +%%PORTDOCS%%%%DOCSDIR%%/README.NFQUEUE > +%%PORTDOCS%%%%DOCSDIR%%/README.clamav > +%%PORTDOCS%%%%DOCSDIR%%/README.frag3 > %%PORTDOCS%%%%DOCSDIR%%/TODO > %%PORTDOCS%%%%DOCSDIR%%/USAGE > %%PORTDOCS%%%%DOCSDIR%%/snort_manual.pdf > %%PORTDOCS%%%%DOCSDIR%%/snort_schema_v106.pdf > %%PORTDOCS%%@dirrm %%DOCSDIR%% > -%%DATADIR%%/attack-responses.rules > -%%DATADIR%%/backdoor.rules > -%%DATADIR%%/bad-traffic.rules > -%%DATADIR%%/chat.rules > @unexec if [ -f %B/classification.config ] && cmp -s > %B/classification.config %B/classification.config-sample; then rm -f > %B/classification.config; fi > %%DATADIR%%/classification.config-sample > @exec [ -f %B/classification.config ] || cp %B/%f > %B/classification.config > -%%DATADIR%%/ddos.rules > -%%DATADIR%%/deleted.rules > -%%DATADIR%%/dns.rules > -%%DATADIR%%/dos.rules > -%%DATADIR%%/experimental.rules > -%%DATADIR%%/exploit.rules > -%%DATADIR%%/finger.rules > -%%DATADIR%%/ftp.rules > -%%DATADIR%%/icmp-info.rules > -%%DATADIR%%/icmp.rules > -%%DATADIR%%/imap.rules > -%%DATADIR%%/info.rules > -%%DATADIR%%/local.rules > -%%DATADIR%%/misc.rules > -%%DATADIR%%/multimedia.rules > -%%DATADIR%%/mysql.rules > -%%DATADIR%%/netbios.rules > -%%DATADIR%%/nntp.rules > -%%DATADIR%%/oracle.rules > -%%DATADIR%%/other-ids.rules > -%%DATADIR%%/p2p.rules > -%%DATADIR%%/policy.rules > -%%DATADIR%%/pop2.rules > -%%DATADIR%%/pop3.rules > -%%DATADIR%%/porn.rules > +%%DATADIR%%/classification.config > @unexec if [ -f %B/reference.config ] && cmp -s %B/reference.config > %B/reference.config-sample; then rm -f %B/reference.config; fi > %%DATADIR%%/reference.config-sample > @exec [ -f %B/reference.config ] || cp %B/%f %B/reference.config > -%%DATADIR%%/rpc.rules > -%%DATADIR%%/rservices.rules > -%%DATADIR%%/scan.rules > -%%DATADIR%%/shellcode.rules > -%%DATADIR%%/smtp.rules > -%%DATADIR%%/snmp.rules > -%%DATADIR%%/sql.rules > -%%DATADIR%%/telnet.rules > -%%DATADIR%%/tftp.rules > -%%DATADIR%%/virus.rules > -%%DATADIR%%/web-attacks.rules > -%%DATADIR%%/web-cgi.rules > -%%DATADIR%%/web-client.rules > -%%DATADIR%%/web-coldfusion.rules > -%%DATADIR%%/web-frontpage.rules > -%%DATADIR%%/web-iis.rules > -%%DATADIR%%/web-misc.rules > -%%DATADIR%%/web-php.rules > -%%DATADIR%%/x11.rules > +@dirrmtry %%DATADIR%%/rules > @dirrm %%DATADIR%% > > > Nick Rogness <ni...@ro...> |
|
From: Nick R. <ni...@ro...> - 2006-10-24 03:04:37
|
>Submitter-Id: current-users >Originator: Nick Rogness >Organization: >Confidential: no >Synopsis: Port update to security/snort_inline >Severity: non-critical >Priority: low >Category: ports >Class: maintainer-update >Release: FreeBSD 5.4-STABLE i386 >Environment: System: FreeBSD skywalker.rogness.net 5.4-STABLE FreeBSD 5.4-STABLE #0: Mon Jul 11 21:54:56 MDT 2005 ni...@sk...:/usr/src/sys/i386/compile/SKYWALKER i386 >Description: Update port security/snort_inline to version 2.4.5 >How-To-Repeat: Attached Unified diff under Fix >Fix: diff -ruN snort_inline.old/Makefile snort_inline/Makefile --- snort_inline.old/Makefile Fri May 12 22:15:15 2006 +++ snort_inline/Makefile Mon Oct 23 20:16:34 2006 @@ -2,23 +2,19 @@ # Date created: 4 March 2005 # Whom: ni...@ro... # -# $FreeBSD: ports/security/snort_inline/Makefile,v 1.4 2006/05/13 04:15:15 edwin Exp $ +# $FreeBSD: ports/security/snort_inline/Makefile,v 1.3 2005/11/14 17:07:04 sem Exp $ # PORTNAME= snort_inline -PORTVERSION= 2.3.0 -PORTREVISION= 1 +PORTVERSION= 2.4.5 CATEGORIES= security MASTER_SITES= http://freebsd.rogness.net/ports/snort_inline/ -DISTNAME= snort_inline-2.3.0-RC1 MAINTAINER= ni...@ro... COMMENT= An inline IPS system based on snort using ipfw LIB_DEPENDS= pcre.0:${PORTSDIR}/devel/pcre -WRKSRC= ${WRKDIR}/snort_inline-2.3.0-RC1 - USE_GPG= yes SIG_SUFFIX= .asc GNU_CONFIGURE= yes @@ -26,9 +22,7 @@ CONFIGURE_TARGET= --build=${MACHINE_ARCH}-portbld-freebsd${OSREL} CONFIGURE_ARGS+= --enable-inline --enable-ipfw -BUILD_DEPENDS+= libnet*<=1.1.0,1:${PORTSDIR}/net/libnet10 -CONFIGURE_ARGS+= --with-libnet-includes=${LOCALBASE}/include \ - --with-libnet-libraries=${LOCALBASE}/lib +LIB_DEPENDS+= dnet:${PORTSDIR}/net/libdnet .if defined(WITH_MYSQL) USE_MYSQL= yes @@ -55,14 +49,20 @@ CONFIGURE_ARGS+= --with-postgresql=no .endif -MAN8= snort.8 +MAN8= snort.8 snort_inline.8 DOCS= ChangeLog doc/AUTHORS doc/BUGS doc/CREDITS doc/faq* doc/NEWS \ doc/README* doc/TODO doc/USAGE doc/*.pdf +RULE_PATH= ${DATADIR}/rules + USE_RC_SUBR= snort.sh post-patch: ${REINPLACE_CMD} "s,%%PREFIX%%,${PREFIX}," ${WRKSRC}/src/snort.c + ${REINPLACE_CMD} "s,/etc/snort_inline/drop-rules,${RULE_PATH}," ${WRKSRC}/etc/snort_inline.conf + ${REINPLACE_CMD} "s,$RULE_PATH/classification.config,${DATADIR}/classification.config," ${WRKSRC}/etc/snort_inline.conf + ${REINPLACE_CMD} "s,$RULE_PATH/reference.config,${DATADIR}/reference.config," ${WRKSRC}/etc/snort_inline.conf + ${REINPLACE_CMD} -e "s/^unicode.map/\/usr\/local\/share\/snort_inline\/unicode.map/" ${WRKSRC}/etc/snort_inline.conf pre-configure: @${ECHO} "" @@ -72,7 +72,7 @@ post-install: @${MKDIR} ${DATADIR} - ${INSTALL_DATA} ${WRKSRC}/rules/*.rules ${DATADIR} + @${MKDIR} ${RULE_PATH} ${INSTALL_DATA} ${WRKSRC}/etc/classification.config \ ${DATADIR}/classification.config-sample [ -f ${DATADIR}/classification.config ] || \ @@ -82,7 +82,13 @@ ${DATADIR}/reference.config-sample [ -f ${DATADIR}/reference.config ] || \ ${CP} ${DATADIR}/reference.config-sample ${DATADIR}/reference.config -.for f in snort.conf snort_inline.conf unicode.map threshold.conf + ${INSTALL_DATA} ${WRKSRC}/etc/threshold.conf \ + ${DATADIR}/threshold.conf-sample + [ -f ${DATADIR}/threshold.conf ] || \ + ${CP} ${DATADIR}/threshold.conf-sample ${DATADIR}/threshold.conf + ${INSTALL_DATA} ${WRKSRC}/etc/unicode.map \ + ${DATADIR}/unicode.map +.for f in snort.conf snort_inline.conf ${INSTALL_DATA} ${WRKSRC}/etc/${f} ${PREFIX}/etc/${f}-sample [ -f ${PREFIX}/etc/${f} ] || \ ${INSTALL_DATA} ${WRKSRC}/etc/${f} ${PREFIX}/etc/${f} diff -ruN snort_inline.old/distinfo snort_inline/distinfo --- snort_inline.old/distinfo Mon Jan 23 18:03:27 2006 +++ snort_inline/distinfo Wed Jun 7 18:12:19 2006 @@ -1,3 +1,3 @@ -MD5 (snort_inline-2.3.0-RC1.tar.gz) = d577c101a78c97b0f18a1e01b0252419 -SHA256 (snort_inline-2.3.0-RC1.tar.gz) = 46027eeb583dd2efa1ca724948a84fd79d320a0f04df4befde27688c4f7995dc -SIZE (snort_inline-2.3.0-RC1.tar.gz) = 2742898 +MD5 (snort_inline-2.4.5.tar.gz) = 6fbc46cb339cd9f7b9699104b9a99b1a +SHA256 (snort_inline-2.4.5.tar.gz) = c417dd23d06d468f0fc5d2cc4f9d1022db5b02a9a77d702f8e24261f0a433651 +SIZE (snort_inline-2.4.5.tar.gz) = 3019957 diff -ruN snort_inline.old/files/snort.sh.in snort_inline/files/snort.sh.in --- snort_inline.old/files/snort.sh.in Mon Feb 20 13:47:40 2006 +++ snort_inline/files/snort.sh.in Wed Jun 7 18:09:58 2006 @@ -4,7 +4,7 @@ # PROVIDE: snort # REQUIRE: DAEMON # BEFORE: LOGIN -# KEYWORD: shutdown +# KEYWORD: FreeBSD shutdown # Add the following lines to /etc/rc.conf to enable snort: # snort_enable (bool): Set to YES to enable snort @@ -22,7 +22,7 @@ name="snort" rcvar=`set_rcvar` -command="%%PREFIX%%/bin/snort" +command="%%PREFIX%%/bin/snort_inline" load_rc_config $name diff -ruN snort_inline.old/pkg-plist snort_inline/pkg-plist --- snort_inline.old/pkg-plist Sat May 28 05:06:39 2005 +++ snort_inline/pkg-plist Mon Oct 23 20:45:39 2006 @@ -5,11 +5,11 @@ @unexec if [ -f %D/etc/snort_inline.conf ] && cmp -s %D/etc/snort_inline.conf %D/etc/snort_inline.conf-sample; then rm -f %D/etc/snort_inline.conf; fi etc/snort_inline.conf-sample @exec [ -f %B/snort_inline.conf ] || cp %B/%f %B/snort_inline.conf -@unexec if [ -f %D/etc/unicode.map ] && cmp -s %D/etc/unicode.map %D/etc/unicode.map-sample; then rm -f %D/etc/unicode.map; fi -etc/unicode.map-sample +@unexec if [ -f %B/unicode.map ] && cmp -s %B/unicode.map %B/unicode.map-sample; then rm -f %B/etc/unicode.map; fi +%%DATADIR%%/unicode.map @exec [ -f %B/unicode.map ] || cp %B/%f %B/unicode.map -@unexec if [ -f %D/etc/threshold.conf ] && cmp -s %D/etc/threshold.conf %D/etc/threshold.conf-sample; then rm -f %D/etc/threshold.conf; fi -etc/threshold.conf-sample +@unexec if [ -f %B/threshold.conf ] && cmp -s %B/threshold.conf %B/threshold.conf-sample; then rm -f %B/threshold.conf; fi +%%DATADIR%%/threshold.conf-sample @exec [ -f %B/threshold.conf ] || cp %B/%f %B/threshold.conf %%PORTDOCS%%%%DOCSDIR%%/AUTHORS %%PORTDOCS%%%%DOCSDIR%%/BUGS @@ -36,63 +36,20 @@ %%PORTDOCS%%%%DOCSDIR%%/README.http_inspect %%PORTDOCS%%%%DOCSDIR%%/README.thresholding %%PORTDOCS%%%%DOCSDIR%%/README.wireless +%%PORTDOCS%%%%DOCSDIR%%/README.NFQUEUE +%%PORTDOCS%%%%DOCSDIR%%/README.clamav +%%PORTDOCS%%%%DOCSDIR%%/README.frag3 %%PORTDOCS%%%%DOCSDIR%%/TODO %%PORTDOCS%%%%DOCSDIR%%/USAGE %%PORTDOCS%%%%DOCSDIR%%/snort_manual.pdf %%PORTDOCS%%%%DOCSDIR%%/snort_schema_v106.pdf %%PORTDOCS%%@dirrm %%DOCSDIR%% -%%DATADIR%%/attack-responses.rules -%%DATADIR%%/backdoor.rules -%%DATADIR%%/bad-traffic.rules -%%DATADIR%%/chat.rules @unexec if [ -f %B/classification.config ] && cmp -s %B/classification.config %B/classification.config-sample; then rm -f %B/classification.config; fi %%DATADIR%%/classification.config-sample @exec [ -f %B/classification.config ] || cp %B/%f %B/classification.config -%%DATADIR%%/ddos.rules -%%DATADIR%%/deleted.rules -%%DATADIR%%/dns.rules -%%DATADIR%%/dos.rules -%%DATADIR%%/experimental.rules -%%DATADIR%%/exploit.rules -%%DATADIR%%/finger.rules -%%DATADIR%%/ftp.rules -%%DATADIR%%/icmp-info.rules -%%DATADIR%%/icmp.rules -%%DATADIR%%/imap.rules -%%DATADIR%%/info.rules -%%DATADIR%%/local.rules -%%DATADIR%%/misc.rules -%%DATADIR%%/multimedia.rules -%%DATADIR%%/mysql.rules -%%DATADIR%%/netbios.rules -%%DATADIR%%/nntp.rules -%%DATADIR%%/oracle.rules -%%DATADIR%%/other-ids.rules -%%DATADIR%%/p2p.rules -%%DATADIR%%/policy.rules -%%DATADIR%%/pop2.rules -%%DATADIR%%/pop3.rules -%%DATADIR%%/porn.rules +%%DATADIR%%/classification.config @unexec if [ -f %B/reference.config ] && cmp -s %B/reference.config %B/reference.config-sample; then rm -f %B/reference.config; fi %%DATADIR%%/reference.config-sample @exec [ -f %B/reference.config ] || cp %B/%f %B/reference.config -%%DATADIR%%/rpc.rules -%%DATADIR%%/rservices.rules -%%DATADIR%%/scan.rules -%%DATADIR%%/shellcode.rules -%%DATADIR%%/smtp.rules -%%DATADIR%%/snmp.rules -%%DATADIR%%/sql.rules -%%DATADIR%%/telnet.rules -%%DATADIR%%/tftp.rules -%%DATADIR%%/virus.rules -%%DATADIR%%/web-attacks.rules -%%DATADIR%%/web-cgi.rules -%%DATADIR%%/web-client.rules -%%DATADIR%%/web-coldfusion.rules -%%DATADIR%%/web-frontpage.rules -%%DATADIR%%/web-iis.rules -%%DATADIR%%/web-misc.rules -%%DATADIR%%/web-php.rules -%%DATADIR%%/x11.rules +@dirrmtry %%DATADIR%%/rules @dirrm %%DATADIR%% |
|
From: Pravin <shi...@gm...> - 2006-10-09 13:50:19
|
Hi, We have tested snort-inline in experimental setup and I find it quite satisfactory. Now we are deploying snort-inline on real life LAN of 25 to 30 machines. I was little worried about the load it can take and the delay it may introduce because of inline mode. The hardware on which on which we are planning to setup the box initially is an average only. Can I get any documentation which will give me some idea about load it can take, and delay it may introduce in the process? Do I need to do special configuration to gain the performance? Regards, Pravin Shinde |
|
From: Pravin <shi...@gm...> - 2006-10-09 08:11:10
|
Thanx Adam, I compiled snort with "-fno-strict-aliasing" option, and it is working fine now. On 10/6/06, Adam Keeton <ak...@so...> wrote: > Run Snort with "-k none", if you start getting TCP packets, then the > checksums are failing. > > FC 5 comes with GCC 4.x.x. In GCC 4.x.x, (and, potentially, late > versions of the 3 series), optimizations were re-worked. Snort compiles > with optimization level 2, which now assumes strict aliasing by > default. The resulting optimizations break the TCP checksumming code. > The solution is to compile Snort with "-fno-strict-aliasing". > > If you check out the latest Snort from CVS, or download the beta, the > configure script will take care of it for you. If you want to stick is beta that you are refering is "snort_inline-2.4.5a" ? because, I downloaded it, but it didnt worked. > with your current version, set the CFLAGS variable to > -fno-strict-aliasing and rerun configure, then and do a fresh compile > (be sure to make clean first). This method worked, I added "-fno-strict-aliasing" to CFLAGS and now its working fine. Thank you very much > > Thanks, > Adam > > > Hi, > > I have a problem that snort-inline is allowing UDP and ICMP packets > > but dropping TCP packets. > > I Fedora core - 5 on my box. > > > > I refered the http://linuxgazette.net/117/savage.html tutorial for > > this installation and configuration purpose. > > I run snort-inline using following command. > > snort_inline -c /etc/snort_inline/snort_inline.conf -Q -N -l > > /var/log/snort_inline/ \ > > -t /var/log/snort_inline/ -v > > > > after starting snort-inline ICMP and UDP packets are able to get > > through but > > TCP packets are getting dropped > > > > I used simple IPTABLES rules to queue up the packets to user space. > > iptables -I INPUT -p tcp --dport 80 -j QUEUE > > iptables -I INPUT -p udp --dport 20000 -j QUEUE > > iptables -I INPUT -p icmp -j QUEUE > > > > I checked logs files and all of them are empty. > > > > I also tried to go through the source code. > > I found following lines which are responsible for packet droping or > > packet allowing. > > > > inline.c : 948. status = ipq_set_verdict(ipqh, m->packet_id, > > NF_DROP, 0, NULL); > > > > inline.c :1025 status = ipq_set_verdict(ipqh, m->packet_id, > > NF_ACCEPT, 0, NULL); > > > > inline.c :1047 status = ipq_set_verdict(ipqh, m->packet_id, > > NF_ACCEPT, > > m->data_len, > > m->payload ); > > I added some printf after them for debugging purpose, > > and find out that ICMP and UDP packets were being accepted by second > > ipq_set_verdict function call (inline.c:1025) but TCP packets were > > getting droped by first ipq_set_verdict > > function call (inline.c:948). > > > > My guess is that there is something wrong in configuration file, > > As per me, the default rules are not supposed to drop any packets. > > The only change that I have done in config file is to change > > "var RULE_PATH /etc/snort_inline/drop_rules" > > to > > "var RULE_PATH /etc/snort_inline/rules " > > > > I am attaching my snort_inline.conf file with this mail. > > can someone please help me to find out what I am missing ? > > > > ------------------------------------------------------------------------ > > > > ------------------------------------------------------------------------- > > Take Surveys. Earn Cash. Influence the Future of IT > > Join SourceForge.net's Techsay panel and you'll get the chance to share your > > opinions on IT & business topics through brief surveys -- and earn cash > > http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV > > ------------------------------------------------------------------------ > > > > _______________________________________________ > > Snort-inline-users mailing list > > Sno...@li... > > https://lists.sourceforge.net/lists/listinfo/snort-inline-users > > > > -- Pravin Shinde |
|
From: Pravin <shi...@gm...> - 2006-10-09 04:28:23
|
Hi, I find these links useful for installation purpose. http://linuxgazette.net/117/savage.html http://linuxgazette.net/118/savage.html On 10/9/06, Quantum Chaos <tq...@gm...> wrote: > Hi everbody, > > i need snort-inline docs, like installation, reporting etc. I didnt find any > docs from internet. > > regards, > Tr-Chaos > ------------------------------------------------------------------------- > Take Surveys. Earn Cash. Influence the Future of IT > Join SourceForge.net's Techsay panel and you'll get the chance to share your > opinions on IT & business topics through brief surveys -- and earn cash > http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV > > _______________________________________________ > Snort-inline-users mailing list > Sno...@li... > https://lists.sourceforge.net/lists/listinfo/snort-inline-users > > > -- Pravin Shinde |
|
From: Quantum C. <tq...@gm...> - 2006-10-08 23:15:46
|
Hi everbody, i need snort-inline docs, like installation, reporting etc. I didnt find any docs from internet. regards, Tr-Chaos |
|
From: Victor J. <vi...@nk...> - 2006-10-07 09:15:27
|
Hi Tareq, Tareq AlKhatib wrote: > Hi Victor > > Thanks for the link but I ve already seen it. I guess my question is > what should I do with this configuration. I can't seem to find a > configuration file to use the sample in. > You have to put it in your main Snort configuration file. The Snort archive contains an example configuration file in the etc directory called snort.conf. Put the clamav line under the stream4 preprocessor and above the http_inspect preprocessor. Check the Snort Manual for the options in the snort.conf file: http://snort.org/docs/snort_htmanuals/htmanual_260/ Regards, Victor > Thanks > > Tareq > > -----Original Message----- > From: Victor Julien [mailto:vi...@nk...] > Sent: Saturday, October 07, 2006 12:10 PM > To: Tareq AlKhatib > Cc: sno...@li... > Subject: Re: [Snort-inline-users] Snort-inline with ClamAv > > Tareq AlKhatib wrote: > >> Hi all, >> >> I am having problems setting up Snort-inline with ClamAv. I downloaded >> the tar ball from http://www.bleedingsnort.com/ and configured it to >> > use > >> inline and ClamAv (./configure --enable-inline --enable-clamav) and >> > make > >> (made?) and make install. So far everything seems to work without >> errors. >> >> The problem is I can't seem to find any of the usual configuration >> files, not even snort.conf. I know I must change a configuration file >> somewhere but I can't seem to find it. (Do I need to create it?) >> >> Can someone point me in the correct direction? >> >> > > I'm not sure I completely understand what you are looking for. I think > you ask for an example config for Snort + ClamAV. Please check this page > > for that: > http://www.bleedingsnort.com/staticpages/index.php?page=snort-clamav > > If you need the other configuration files, in the Snort source tarball > is a directory called etc/ it contains some example files. Rules can be > downloaded from snort.org and bleedingsnort.com... > > Hope this helps! > > Regards, > Victor > > > ------------------------------------------------------------------------- > Take Surveys. Earn Cash. Influence the Future of IT > Join SourceForge.net's Techsay panel and you'll get the chance to share your > opinions on IT & business topics through brief surveys -- and earn cash > http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV > _______________________________________________ > Snort-inline-users mailing list > Sno...@li... > https://lists.sourceforge.net/lists/listinfo/snort-inline-users > > |
|
From: Tareq A. <Tar...@al...> - 2006-10-07 09:03:41
|
Hi Victor Thanks for the link but I ve already seen it. I guess my question is what should I do with this configuration. I can't seem to find a configuration file to use the sample in. Thanks Tareq -----Original Message----- From: Victor Julien [mailto:vi...@nk...]=20 Sent: Saturday, October 07, 2006 12:10 PM To: Tareq AlKhatib Cc: sno...@li... Subject: Re: [Snort-inline-users] Snort-inline with ClamAv Tareq AlKhatib wrote: > Hi all, > > I am having problems setting up Snort-inline with ClamAv. I downloaded > the tar ball from http://www.bleedingsnort.com/ and configured it to use > inline and ClamAv (./configure --enable-inline --enable-clamav) and make > (made?) and make install. So far everything seems to work without > errors. > > The problem is I can't seem to find any of the usual configuration > files, not even snort.conf. I know I must change a configuration file > somewhere but I can't seem to find it. (Do I need to create it?) > > Can someone point me in the correct direction? > =20 I'm not sure I completely understand what you are looking for. I think=20 you ask for an example config for Snort + ClamAV. Please check this page for that:=20 http://www.bleedingsnort.com/staticpages/index.php?page=3Dsnort-clamav If you need the other configuration files, in the Snort source tarball=20 is a directory called etc/ it contains some example files. Rules can be=20 downloaded from snort.org and bleedingsnort.com... Hope this helps! Regards, Victor |
|
From: Victor J. <vi...@nk...> - 2006-10-07 08:06:36
|
Tareq AlKhatib wrote: > Hi all, > > I am having problems setting up Snort-inline with ClamAv. I downloaded > the tar ball from http://www.bleedingsnort.com/ and configured it to use > inline and ClamAv (./configure --enable-inline --enable-clamav) and make > (made?) and make install. So far everything seems to work without > errors. > > The problem is I can't seem to find any of the usual configuration > files, not even snort.conf. I know I must change a configuration file > somewhere but I can't seem to find it. (Do I need to create it?) > > Can someone point me in the correct direction? > I'm not sure I completely understand what you are looking for. I think you ask for an example config for Snort + ClamAV. Please check this page for that: http://www.bleedingsnort.com/staticpages/index.php?page=snort-clamav If you need the other configuration files, in the Snort source tarball is a directory called etc/ it contains some example files. Rules can be downloaded from snort.org and bleedingsnort.com... Hope this helps! Regards, Victor |
|
From: Tareq A. <Tar...@al...> - 2006-10-07 05:55:39
|
Hi all, I am having problems setting up Snort-inline with ClamAv. I downloaded the tar ball from http://www.bleedingsnort.com/ and configured it to use inline and ClamAv (./configure --enable-inline --enable-clamav) and make (made?) and make install. So far everything seems to work without errors. The problem is I can't seem to find any of the usual configuration files, not even snort.conf. I know I must change a configuration file somewhere but I can't seem to find it. (Do I need to create it?) Can someone point me in the correct direction? Thanks |
|
From: Adam K. <ak...@so...> - 2006-10-06 12:19:22
|
Run Snort with "-k none", if you start getting TCP packets, then the checksums are failing. FC 5 comes with GCC 4.x.x. In GCC 4.x.x, (and, potentially, late versions of the 3 series), optimizations were re-worked. Snort compiles with optimization level 2, which now assumes strict aliasing by default. The resulting optimizations break the TCP checksumming code. The solution is to compile Snort with "-fno-strict-aliasing". If you check out the latest Snort from CVS, or download the beta, the configure script will take care of it for you. If you want to stick with your current version, set the CFLAGS variable to -fno-strict-aliasing and rerun configure, then and do a fresh compile (be sure to make clean first). Thanks, Adam > Hi, > I have a problem that snort-inline is allowing UDP and ICMP packets > but dropping TCP packets. > I Fedora core - 5 on my box. > > I refered the http://linuxgazette.net/117/savage.html tutorial for > this installation and configuration purpose. > I run snort-inline using following command. > snort_inline -c /etc/snort_inline/snort_inline.conf -Q -N -l > /var/log/snort_inline/ \ > -t /var/log/snort_inline/ -v > > after starting snort-inline ICMP and UDP packets are able to get > through but > TCP packets are getting dropped > > I used simple IPTABLES rules to queue up the packets to user space. > iptables -I INPUT -p tcp --dport 80 -j QUEUE > iptables -I INPUT -p udp --dport 20000 -j QUEUE > iptables -I INPUT -p icmp -j QUEUE > > I checked logs files and all of them are empty. > > I also tried to go through the source code. > I found following lines which are responsible for packet droping or > packet allowing. > > inline.c : 948. status = ipq_set_verdict(ipqh, m->packet_id, > NF_DROP, 0, NULL); > > inline.c :1025 status = ipq_set_verdict(ipqh, m->packet_id, > NF_ACCEPT, 0, NULL); > > inline.c :1047 status = ipq_set_verdict(ipqh, m->packet_id, > NF_ACCEPT, > m->data_len, > m->payload ); > I added some printf after them for debugging purpose, > and find out that ICMP and UDP packets were being accepted by second > ipq_set_verdict function call (inline.c:1025) but TCP packets were > getting droped by first ipq_set_verdict > function call (inline.c:948). > > My guess is that there is something wrong in configuration file, > As per me, the default rules are not supposed to drop any packets. > The only change that I have done in config file is to change > "var RULE_PATH /etc/snort_inline/drop_rules" > to > "var RULE_PATH /etc/snort_inline/rules " > > I am attaching my snort_inline.conf file with this mail. > can someone please help me to find out what I am missing ? > > ------------------------------------------------------------------------ > > ------------------------------------------------------------------------- > Take Surveys. Earn Cash. Influence the Future of IT > Join SourceForge.net's Techsay panel and you'll get the chance to share your > opinions on IT & business topics through brief surveys -- and earn cash > http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV > ------------------------------------------------------------------------ > > _______________________________________________ > Snort-inline-users mailing list > Sno...@li... > https://lists.sourceforge.net/lists/listinfo/snort-inline-users > |
|
From: Pravin <shi...@gm...> - 2006-10-06 04:35:43
|
Hi, I have a problem that snort-inline is allowing UDP and ICMP packets but dropping TCP packets. I Fedora core - 5 on my box. I refered the http://linuxgazette.net/117/savage.html tutorial for this installation and configuration purpose. I run snort-inline using following command. snort_inline -c /etc/snort_inline/snort_inline.conf -Q -N -l /var/log/snort_inline/ \ -t /var/log/snort_inline/ -v after starting snort-inline ICMP and UDP packets are able to get through but TCP packets are getting dropped I used simple IPTABLES rules to queue up the packets to user space. iptables -I INPUT -p tcp --dport 80 -j QUEUE iptables -I INPUT -p udp --dport 20000 -j QUEUE iptables -I INPUT -p icmp -j QUEUE I checked logs files and all of them are empty. I also tried to go through the source code. I found following lines which are responsible for packet droping or packet allowing. inline.c : 948. status = ipq_set_verdict(ipqh, m->packet_id, NF_DROP, 0, NULL); inline.c :1025 status = ipq_set_verdict(ipqh, m->packet_id, NF_ACCEPT, 0, NULL); inline.c :1047 status = ipq_set_verdict(ipqh, m->packet_id, NF_ACCEPT, m->data_len, m->payload ); I added some printf after them for debugging purpose, and find out that ICMP and UDP packets were being accepted by second ipq_set_verdict function call (inline.c:1025) but TCP packets were getting droped by first ipq_set_verdict function call (inline.c:948). My guess is that there is something wrong in configuration file, As per me, the default rules are not supposed to drop any packets. The only change that I have done in config file is to change "var RULE_PATH /etc/snort_inline/drop_rules" to "var RULE_PATH /etc/snort_inline/rules " I am attaching my snort_inline.conf file with this mail. can someone please help me to find out what I am missing ? -- Pravin Shinde |
|
From: Will M. <wil...@gm...> - 2006-10-04 02:39:32
|
If you are tracking state with netfilter, it performs fragment reassembly for you. Regards, Will On 10/1/06, James G <har...@ho...> wrote: > > Hi all, > > My question is : Can Snort_inline Drop a fragmented attaque that has been > reassembled by Frag3? Or does it only g=E9nerate an alert on it? > > I mean, does Frag 3 forward the fragments before therest of the systeme > analyses the reassembled paquet?? > > Regards, > > > > ------------------------------ > MSN Hotmail sur i-mode=99 : envoyez et recevez des e-mails depuis votre > t=E9l=E9phone portable ! <http://g.msn.com/8HMBFR/2740??PS=3D47575> > ------------------------------------------------------------------------- > Take Surveys. Earn Cash. Influence the Future of IT > Join SourceForge.net's Techsay panel and you'll get the chance to share > your > opinions on IT & business topics through brief surveys -- and earn cash > http://www.techsay.com/default.php?page=3Djoin.php&p=3Dsourceforge&CID=3D= DEVDEV > > _______________________________________________ > Snort-inline-users mailing list > Sno...@li... > https://lists.sourceforge.net/lists/listinfo/snort-inline-users > > > |
133 messages has been excluded from this view by a project administrator.
