snort-inline-users — The goal of this list is to help users debug/use snort_inline

[Snort-inline-users] newbie, 2.2.0a, no packets out of snort

[Dmitry M. <dm...@be...>]

Hello!

I'm starting snort_inline with default config (i.e. from tar.gz), then I 
want to check ftp:


iptables -A INPUT -p tcp --dport 21 -j QUEUE

I see that snort_inline get packets:

Received error message 2
11/25-13:14:56.021059 192.168.22.229:33905 -> 192.168.22.229:21
TCP TTL:64 TOS:0x0 ID:34862 IpLen:20 DgmLen:60 DF
******S* Seq: 0xD48E7C41  Ack: 0x0  Win: 0x7FFF  TcpLen: 40
TCP Options (5) => MSS: 16396 SackOK TS: 17843826 0 NOP WS: 0

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

But there is no ftp :-(

OK, another try:

iptables -A OUTPUT -p tcp --sport 21 -j QUEUE

Received error message 2
11/25-13:16:19.400758 192.168.22.229:21 -> 192.168.22.229:33906
TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:60 DF
***A**S* Seq: 0xDAE944AD  Ack: 0xDB74D628  Win: 0x7FFF  TcpLen: 40
TCP Options (5) => MSS: 16396 SackOK TS: 17927226 17924071 NOP WS: 0

No difference.


I tried this on Suse 8.1/x86 with kernel 2.4 and Mandrake 9.2/AMD64 with 
kernel 2.6- the same result.

Any ideas?

Re: [Snort-inline-users] snort-inline 2.2.0a issue after upgrading from 2.1.1

[James A. P. <ja...@pc...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

William Metcalf wrote:
| Disable stream4 and stream4_reassemble and try again. We currently don't
| drop on alerts generated from the http_inspect preproc so if you add the
| no_alerts line you should be fine.

I finally got around to testing this onsite and it works now!

Thanks.  Now to get a better grasp on the variables so that False Positive rule
hits get eliminated. :)

|
| Regards,
|
| Will
| Inactive hide details for "James A. Pattie"
| <ja...@pc...>"James A. Pattie" <ja...@pc...>
|
|
|                         *"James A. Pattie" <ja...@pc...>*
|                         Sent by:
|                         sno...@li...
|
|                         11/18/2004 05:56 PM
|
| 	
|
| To
| 	Web Bug from
|
imap://ja...@ma...:993/fetch%3EUID%3E/INBOX/mail/snort-inline-users%3E641?header=quotebody&part=1.4&filename=ecblank.gif
| sno...@li...
|
| cc
| 	Web Bug from
|
imap://ja...@ma...:993/fetch%3EUID%3E/INBOX/mail/snort-inline-users%3E641?header=quotebody&part=1.4&filename=ecblank.gif
|
| Subject
| 	Web Bug from
|
imap://ja...@ma...:993/fetch%3EUID%3E/INBOX/mail/snort-inline-users%3E641?header=quotebody&part=1.4&filename=ecblank.gif
| Re: [Snort-inline-users] snort-inline 2.2.0a issue after upgrading from
| 2.1.1
|
| Web Bug from
|
imap://ja...@ma...:993/fetch%3EUID%3E/INBOX/mail/snort-inline-users%3E641?header=quotebody&part=1.4&filename=ecblank.gif

| Web Bug from
|
imap://ja...@ma...:993/fetch%3EUID%3E/INBOX/mail/snort-inline-users%3E641?header=quotebody&part=1.4&filename=ecblank.gif
|
|
| William Metcalf wrote:
| | Try using the state tracking mechanisms we built into 2.2.0a. We
| | accomplished by using marks in iptables and arguments to stream4.
| | Something like:
| |
| | /usr/local/sbin/iptables -t mangle -A FORWARD -p tcp --syn -m state
| | --state NEW -j MARK --set-mark 1
| | /usr/local/sbin/iptables -t mangle -A FORWARD -p tcp -m state --state
| | ESTABLISHED -j MARK --set-mark 2
| | /usr/local/sbin/iptables -I FORWARD -m mark --mark 1 -j QUEUE
| | /usr/local/sbin/iptables -I FORWARD -m mark --mark 2 -j QUEUE
| | /usr/local/sbin/iptables -I FORWARD -p udp -j QUEUE
| | /usr/local/sbin/iptables -I FORWARD -p icmp -j QUEUE
| |
| | And then modify the stream4 line to read:
| |
| | preprocessor stream4: disable_evasion_alerts, iptablesnewmark,
| | iptablesestmark, forceiptstate
| | preprocessor stream4_reassemble: both
|
| I was hoping to not have to use the new iptables stuff since I'm
| currently using
| my PCXFirewall code (http://pcxfirewall.sf.net/) and my firewall frontend
| doesn't support specifying custom marks yet.
|
| Shouldn't the old way still work fine?  If so, was the old stream4,
| stream4_reassemble preprocessor entries correct for 2.2.0a?
|
| |
| | In addition I don't see anything in your conf regarding http_inspect, if
| | you are going to be matching rules that have uricontent in them you are
| | going to need the following.
| |
| | preprocessor http_inspect: global \
| | iis_unicode_map unicode.map 1252
| |
| | preprocessor http_inspect_server: server default \
| | profile all ports { 80 8080 8180 } oversize_dir_length 500 \
| | no_alerts
|
| I had added that in from the newer config file and after updating to the 2.2
| series rules I started seeing a bunch of http drops in regards to unknown
| protocol and DOUBLE ENCODE (or something similiar - from memory) hits,
| which I
| had not seen using the 2.1.1 codebase.

- --
James A. Pattie
ja...@pc...

Linux -- SysAdmin / Programmer
Xperience, Inc.
http://www.pcxperience.com/
http://www.xperienceinc.com/
http://www.pcxperience.org/

GPG Key Available at http://www.pcxperience.com/gpgkeys/james.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBr64ftUXjwPIRLVERAgv5AJ4xM4hh162k/tVFQnwsVr8sMBq6WgCguxnv
hEJuRgiLVIk7wEWf7WU+FAA=
=LXlh
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.

[Snort-inline-users] snort-inline + reverse proxy

[Dino D. <dra...@gf...>]

Hi folks,

I am trying to install reverse proxy on our firewall so that https =
requests will be forwarded as http requests to local web server (in DMZ) =
and analized by snort-inline which is installed on the same machine as =
reverse proxy.

Reverse proxy work OK,I can access both ports 80 and 443 from Internet.=20

iptables -t mangle -A INPUT -p TCP -m state --state NEW -j MARK =
--set-mark 2
iptables -t mangle -A INPUT -p TCP -m state --state ESTABLISHED -j MARK =
--set-mark 7

iptables -A INPUT -m mark --mark 2 -j QUEUE
iptables -A INPUT -m mark --mark 7 -j QUEUE

But when I send http requests to snort-inline,web server is inaccessible =
from outside.

#iptables -t mangle -A OUTPUT -p TCP -m state --state NEW -j MARK =
--set-mark 3
#iptables -t mangle -A OUTPUT -p TCP -m state --state ESTABLISHED -j =
MARK --set-mark 9

#iptables -A OUTPUT -p TCP -m mark --mark 3 -j QUEUE
#iptables -A OUTPUT -p TCP -m mark --mark 9 -j QUEUE

I have tried almost everything but I just can`t make it work.....

stream4 and stream4_reassemble are configured as:

preprocessor stream4: iptablesnewmark 1-5,iptablesestmark =
6-10,forceipstate

preprocessor stream4_reassemble: both

What am I doing wrong?
Thanks!

~~~
Dino Dragovic
Faculty of Civil Engineering
dra...@gf...
www.gfos.hr

[Snort-inline-users] snort_inline + iptables on the same machine

[<lo...@vi...>]

Hi
I don't understand very well how snort_inline works...compared to snort:
If I have it on the same machine with iptables who is catching the packets
first?
Where are they logged?
How do I configure drop->sdrop->reject parameters?
Can I configure ACID to show me the dropped packages?
Regards
Andrea

[Snort-inline-users] example rules

[Phinizy W. H. <phi...@ba...>]

Anyone have examples they can pass along of snort-inline running on
FreeBSD-particularly the use of divert, I would like to see some example
rule sets.

=20

Thanks,

=20

W. Harison Phinizy

Systems Administrator
Bandai America
 <mailto:phi...@ba...> phi...@ba...

=20

AW: AW: AW: [Snort-inline-users] stateless vs. stateful

[Jochen V. <jv...@it...>]

ok.

once again. slowly for the slow coach.

when do i need frag2, stream4, stream4_reassembly
if i use iptables in bridging mode or in routing mode
and how did they work exactly. 

thanks for help.
i must it understand exactly or i cant sleep in the next days ;)

greets
jo




>Client ----SYN-----------------> Server 
>Client <---SYN/ACK-------------- Server
>Client -ACK(GET ../etc/passwd)-> Server
>i think for this i need nothing
>Client -ACK(GET ../etc/passwd)-> Server
>i think for this i need stream4 to protect from stick attacks.
>will the packets be ignored or dropped?

stick attacks don't exactly look like this, but stream4 will drop out of
state connection attempts i.e. stick/snot.

>Client ----SYN----------> Server 
>Client <---SYN/ACK------- Server
>Client ----ACK/GET ../)-> Server
>Client ----ACK(etc/)----> Server
>Client ----ACK(passwd)--> Server
>i think for this i need frag2


>are this thoughts correct?
>do i need stream4 to detect attacks over 2 packets?
>what is with iptables because defrag and stream in front?

errr ummmm once again a fragmented attack doesn't exactly look like this,
but if you are tracking state with iptables or using NAT, then iptables is
doing fragment reassembly for you.  In which case you don't need frag2.

Regards,

Will


Jochen Vogel <jv...@it...>


Jochen Vogel <jv...@it...> 
Sent by: sno...@li... 
11/22/2004 06:52 AM

To
'Victor Julien' <vi...@nk...>


cc
sno...@li...


Subject
AW: AW: [Snort-inline-users] stateless vs. stateful



example:

Client ----SYN-----------------> Server 
Client <---SYN/ACK-------------- Server
Client -ACK(GET ../etc/passwd)-> Server
i think for this i need nothing


Client -ACK(GET ../etc/passwd)-> Server
i think for this i need stream4 to protect from stick attacks.
will the packets be ignored or dropped?


Client ----SYN----------> Server 
Client <---SYN/ACK------- Server
Client ----ACK/GET ../)-> Server
Client ----ACK(etc/)----> Server
Client ----ACK(passwd)--> Server
i think for this i need frag2


are this thoughts correct?
do i need stream4 to detect attacks over 2 packets?
what is with iptables because defrag and stream in front?

thanks for help
jo

> > if i use stateless the connection sequence is not checked.
> > what do i loose if i disable stream4?
> 
> You could miss (a lot) of attacks. If an attack fits in one 
> packet you will be 
> fine, however if it doesn't you will probably miss it. 
> Stream4 also protects 
> you against snot/stick attacks.
> 
> Regards,
> Victor
> 


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-inline-users mailing list
Sno...@li...
https://lists.sourceforge.net/lists/listinfo/snort-inline-users

[Snort-inline-users] Detecting streaming audio

[Stuart L. <st...@ga...>]

Hello Snorters ;-)

 

Is it possible to detect and block streaming audio?

I tried blocking these sites as I find the users connecting to them, but
they seem to run on port 80 these days, so it is very difficult to continue
blocking sites, the list will grow large.

I was hoping there is a signature to detect streaming audio, and drop it
dead in its tracks.

 

Thanks in advance

Stuart

AW: AW: [Snort-inline-users] stateless vs. stateful

[Jochen V. <jv...@it...>]

example:

Client ----SYN-----------------> Server 
Client <---SYN/ACK-------------- Server
Client -ACK(GET ../etc/passwd)-> Server
i think for this i need nothing


Client -ACK(GET ../etc/passwd)-> Server
i think for this i need stream4 to protect from stick attacks.
will the packets be ignored or dropped?


Client ----SYN----------> Server 
Client <---SYN/ACK------- Server
Client ----ACK/GET ../)-> Server
Client ----ACK(etc/)----> Server
Client ----ACK(passwd)--> Server
i think for this i need frag2


are this thoughts correct?
do i need stream4 to detect attacks over 2 packets?
what is with iptables because defrag and stream in front?

thanks for help
jo

> > if i use stateless the connection sequence is not checked.
> > what do i loose if i disable stream4?
> 
> You could miss (a lot) of attacks. If an attack fits in one 
> packet you will be 
> fine, however if it doesn't you will probably miss it. 
> Stream4 also protects 
> you against snot/stick attacks.
> 
> Regards,
> Victor
> 

Re: [Snort-inline-users] stateless vs. stateful

[Victor J. <vi...@nk...>]

On Monday 22 November 2004 11:04, Maziar Moezzi wrote:
> Hi Guys,
>
>
>    Being a newbie to Snort and Snort-inline and trying to implement a
> similar LINUX box.... I have a quick Question:
>
>    * How would I enable Stream4 in the pre-proccesor.....to make it ?
> greatly appreciated...

Enable it in your snort_inline.conf by uncommenting the line

preprocessor stream4

and optionally

preprocessor stream4_reassemble


>
> Since as I read from previous email.....
> When stream4 is enabled, packets that do not belong to an existing
> connection and do not initialise a connection are simplyd. So without
> stream4 enabled, there is no way for Snort-inline to identify this
> issue....

Not as far as i know...

Regards,
Victor


>
> Thanks,
>
> Maz
>
>
>
> ===============================================================
> Hi Jochen,
>
> On Monday 22 November 2004 09:13, Jochen Vogel wrote:
> > hi,
> >
> > -works snort_inline stateful or stateless?
>
> It depends: if you enable the stream4 preprocessor it is stateful.
>
> > -what are doing the stateful and stateless doing exactly in an IPS?
>
> When stream4 is enabled, packets that do not belong to an existing
> connection
> and do not initialise a connection are dropped. Without stream4, there
> is no
> way for Snort-inline to know this.
>
> > -what are the differences?
>
> If you enable stream4_reassembly as well multiple packets in a stream
> are
> scanned for threads, thereby preventing missing an attack that is split
> up
> over two packets.
>
> > -how is the behaviour in an high availabilty environment?
>
> As far as i know bad. There is no mechanism that allows two
> snort_inline boxes
> to exchange their state-table.
>
> Thinking out loud: however, using iptables failover (ct_sync if i'm
> correct)
> and iptstate option for stream4 it _could_ work... maybe... no
> reassembly i
> think... ideas anyone?
>
> Regards,
> Victor
>
> > thx for infos
> > jo

Re: AW: [Snort-inline-users] stateless vs. stateful

[Victor J. <vi...@nk...>]

On Monday 22 November 2004 10:01, you wrote:
> hi victor,
>
> is it correct that stateful checks the connection sequence
> SYN->SYN/ACK->ACK->ACK...........

If i recall correctly, yes.

> if i have a HA enviroment it is possible that only came an ACK without
> a SYN befor because of asymmetric routing the packet is dropped or
> i have an state sync?

It would be dropped.

> if i use stateless the connection sequence is not checked.
> what do i loose if i disable stream4?

You could miss (a lot) of attacks. If an attack fits in one packet you will be 
fine, however if it doesn't you will probably miss it. Stream4 also protects 
you against snot/stick attacks.

Regards,
Victor

AW: [Snort-inline-users] stateless vs. stateful

[Jochen V. <jv...@it...>]

hi victor,

is it correct that stateful checks the connection sequence
SYN->SYN/ACK->ACK->ACK...........

if i have a HA enviroment it is possible that only came an ACK without 
a SYN befor because of asymmetric routing the packet is dropped or
i have an state sync?

if i use stateless the connection sequence is not checked.
what do i loose if i disable stream4?

make stream4 sense in combination with iptables??

what is with attack signatures over two packets??

thanks for the fast help
jo

AW: [Snort-inline-users] stateless vs. stateful

[Jochen V. <jv...@it...>]

hi victor,

is it correct that stateful checks the connection sequence
SYN->SYN/ACK->ACK->ACK...........

if i have a HA enviroment it is possible that only came an ACK without 
a SYN befor because of asymmetric routing the packet is dropped or
i have an state sync?

if i use stateless the connection sequence is not checked.
what do i loose if i disable stream4?

thanks for the fast help
jo

Re: [Snort-inline-users] stateless vs. stateful

[Victor J. <vi...@nk...>]

Hi Jochen,

On Monday 22 November 2004 09:13, Jochen Vogel wrote:
> hi,
>
> -works snort_inline stateful or stateless?

It depends: if you enable the stream4 preprocessor it is stateful.

> -what are doing the stateful and stateless doing exactly in an IPS?

When stream4 is enabled, packets that do not belong to an existing connection 
and do not initialise a connection are dropped. Without stream4, there is no 
way for Snort-inline to know this.

> -what are the differences?

If you enable stream4_reassembly as well multiple packets in a stream are 
scanned for threads, thereby preventing missing an attack that is split up 
over two packets.

> -how is the behaviour in an high availabilty environment?

As far as i know bad. There is no mechanism that allows two snort_inline boxes 
to exchange their state-table.

Thinking out loud: however, using iptables failover (ct_sync if i'm correct) 
and iptstate option for stream4 it _could_ work... maybe... no reassembly i 
think... ideas anyone?

Regards,
Victor

>
> thx for infos
> jo
>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://productguide.itmanagersjournal.com/
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users

[Snort-inline-users] stateless vs. stateful

[Jochen V. <jv...@it...>]

hi,

-works snort_inline stateful or stateless?
-what are doing the stateful and stateless doing exactly in an IPS?
-what are the differences?
-how is the behaviour in an high availabilty environment?

thx for infos
jo 

Re: [Snort-inline-users] Non-Bridged Firewall

[Chris D. <ch...@ch...>]

William Metcalf wrote:
> Chris,
> 
> Bridges, we don't need no stinking bridges ;-). Take a look at Rob 
> McMillens rc.firewall script as an example of how to run in NAT mode. 
> Link included, sorry about the bad joke I'm feeling very odd today.
> 
> http://www.honeynet.org/tools/dcontrol/rc.firewall
> 

I'm going to have to do some more digging in how snort-inline works. 
All of my firewalls are "inline" to the network, but they are layer 3 
instead of layer 2 devices.  I currently use FWBuilder to build the 
IPTables rules, SnortCenter and Acid for frontends to Snort, and 
Guardian to make the firewall adaptive.  All of this on Debian Sarge. 
It would be wonderful if their was a Debian package for Snort-Inline.  I 
  am running my own compiled sources of iptables and my own custom kernels.

The only thing that I liked about the NetScreen firewalls, was their 
ability to stop the attack before it exited the device.  Now that I 
found out about Snort-Inline, I can have the same protection the 
NetScreen offers but better.

Now I have a few questions.  Since documentation seems a bit sparce at 
this point.

1) Can Snort-Inline act as a replacement for Snort?  I'm thinking that 
this is the case because it appears the the Snort distribution is 
patched for Inline support.  If not, do I need to run Snort and 
Snort-Inline?

2) It appears that I'm going to have to add additional iptables rules to 
my firewall config that fwbuilder builds.  It this the case, or will 
Snort-Inline just insert itself in the netfilter traversal of packets 
once I have the necessary compiled modules in netfilter?

3)  It would seem to me that the Snort and Netfilter communities would 
be banging down your doors to get this code mainstream as default 
installs for all Linux firewalls.  Is the interest there yet?  It took 
me some digging to find out this software even existed.

I think that's all I have for now.  I'm sure I'm going to have more 
questions later.  :)


	Chris

Re: [Snort-inline-users] Non-Bridged Firewall

[Nick R. <ni...@ro...>]

On Fri, 19 Nov 2004, Chris Dos wrote:

> Finding snort-inline was like a dream come true.  Well, the dream lasted 
> until I bought the Snort 2.1 book and saw some remarks that it's only 
> for bridges.  I have several non-bridged firewalls that I would like to 
> use Snort-Inline on.  Can version 2.2a work on non-bridged firewalls?

 	I'm not sure the context is correct here.  I think what is meant
 	is that snort-inline is meant for inline firewalls, meaning all
 	monitored traffic must traverse the snort-inline firewall.

 	Snort by itself, doesn't have to be inline to capture packets.
 	Meaning traffic doesn't have to traverse the machine running snort
 	in order to alert on it, it only has to be present on a network.

 	I haven't read the 2.1 book so I couldn't really tell you what the
 	real meaning is.

Nick Rogness <ni...@ro...>
-
   How many people here have telekenetic powers? Raise my hand.
   				-Emo Philips

[Snort-inline-users] Non-Bridged Firewall

[Chris D. <ch...@ch...>]

Finding snort-inline was like a dream come true.  Well, the dream lasted 
until I bought the Snort 2.1 book and saw some remarks that it's only 
for bridges.  I have several non-bridged firewalls that I would like to 
use Snort-Inline on.  Can version 2.2a work on non-bridged firewalls?

	Chris

Re: [Snort-inline-users] snort-inline 2.2.0a issue after upgrading from 2.1.1

[James A. P. <ja...@pc...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

William Metcalf wrote:
| Try using the state tracking mechanisms we built into 2.2.0a. We
| accomplished by using marks in iptables and arguments to stream4.
| Something like:
|
| /usr/local/sbin/iptables -t mangle -A FORWARD -p tcp --syn -m state
| --state NEW -j MARK --set-mark 1
| /usr/local/sbin/iptables -t mangle -A FORWARD -p tcp -m state --state
| ESTABLISHED -j MARK --set-mark 2
| /usr/local/sbin/iptables -I FORWARD -m mark --mark 1 -j QUEUE
| /usr/local/sbin/iptables -I FORWARD -m mark --mark 2 -j QUEUE
| /usr/local/sbin/iptables -I FORWARD -p udp -j QUEUE
| /usr/local/sbin/iptables -I FORWARD -p icmp -j QUEUE
|
| And then modify the stream4 line to read:
|
| preprocessor stream4: disable_evasion_alerts, iptablesnewmark,
| iptablesestmark, forceiptstate
| preprocessor stream4_reassemble: both

I was hoping to not have to use the new iptables stuff since I'm currently using
my PCXFirewall code (http://pcxfirewall.sf.net/) and my firewall frontend
doesn't support specifying custom marks yet.

Shouldn't the old way still work fine?  If so, was the old stream4,
stream4_reassemble preprocessor entries correct for 2.2.0a?

|
| In addition I don't see anything in your conf regarding http_inspect, if
| you are going to be matching rules that have uricontent in them you are
| going to need the following.
|
| preprocessor http_inspect: global \
| iis_unicode_map unicode.map 1252
|
| preprocessor http_inspect_server: server default \
| profile all ports { 80 8080 8180 } oversize_dir_length 500 \
| no_alerts

I had added that in from the newer config file and after updating to the 2.2
series rules I started seeing a bunch of http drops in regards to unknown
protocol and DOUBLE ENCODE (or something similiar - from memory) hits, which I
had not seen using the 2.1.1 codebase.

- --
James A. Pattie
ja...@pc...

Linux -- SysAdmin / Programmer
Xperience, Inc.
http://www.pcxperience.org/

GPG Key Available at http://www.pcxperience.com/gpgkeys/james.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBnTa/tUXjwPIRLVERAgxeAKCXjSpQctilmBR0oF0pJPBMwiNkBQCgz0qf
ZehD8hDHcRi2s2dQI5SUV64=
=LrVK
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.

Re: [Snort-inline-users] snort-inline 2.2.0a issue after upgrading from 2.1.1

[William M. <Wil...@kc...>]

Try using the state tracking mechanisms we built into 2.2.0a.  We
accomplished by using marks in iptables and arguments to stream4.
Something like:

        /usr/local/sbin/iptables -t mangle -A FORWARD -p tcp --syn -m state
--state NEW -j MARK --set-mark 1
        /usr/local/sbin/iptables -t mangle -A FORWARD -p tcp -m state
--state ESTABLISHED -j MARK --set-mark 2
        /usr/local/sbin/iptables -I FORWARD -m mark --mark 1 -j QUEUE
        /usr/local/sbin/iptables -I FORWARD -m mark --mark 2 -j QUEUE
        /usr/local/sbin/iptables -I FORWARD -p udp -j QUEUE
        /usr/local/sbin/iptables -I FORWARD -p icmp -j QUEUE

And then modify the stream4 line to read:

preprocessor stream4: disable_evasion_alerts, iptablesnewmark,
iptablesestmark, forceiptstate
preprocessor stream4_reassemble: both

In addition I don't see anything in your conf regarding http_inspect, if
you are going to be matching rules that have uricontent in them you are
going to need the following.

preprocessor http_inspect: global \
    iis_unicode_map unicode.map 1252

preprocessor http_inspect_server: server default \
    profile all ports { 80 8080 8180 } oversize_dir_length 500 \
    no_alerts

Regards,

Will

[Snort-inline-users] snort-inline 2.2.0a issue after upgrading from 2.1.1

[James A. P. <ja...@pc...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi guys,

	I just updated a Debian testing box that was running snort-inline 2.1.1 (I
debianized it using the snort 2.0.0 packages as a template) to snort-inline
2.2.0a and have been having issues with traffic not flowing.

	Nothing else changed, in regards to the kernel, etc. but one of my internal
linux boxes can no longer get out to the next.  The minute I take the bridge out
of the mix, then it works again.  Rolling back to snort-inline 2.1.1 also works.

	I'm attaching the snort-inline.conf file I was using under 2.1.1 (which I was
still using after upgrading to 2.2.0a before grabbing the file from the 2.2.0a
tarball and trying it) to see if anyone can see any issues.

	Using tcpdump, I can see the traffic hit the bridge and appear to go out, but I
never get any return.  The firewall on the other side of the bridge doesn't see
the traffic, so snort-inline is dropping it but not logging it.

	The weird thing is that all the other machines in the network (Win2k, WinXP or
Linux) are all working fine.  It's just the one central linux proxy that is
having issues.

	Even weirder is ssh traffic being dnat'ed into the internal linux box, through
the bridge works fine!

	I'm not using ALL in the SNORT_HOME_NET variable and have updated my rules
using oinkmaster to be the 2.2 series latest, keeping my rule deletions, etc.

	Any hints are appreciated.

- --
James A. Pattie
ja...@pc...

Linux -- SysAdmin / Programmer
Xperience, Inc.
http://www.pcxperience.org/

GPG Key Available at http://www.pcxperience.com/gpgkeys/james.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBnSZ/tUXjwPIRLVERArdZAJ4r7rmhQXbvf7IwkI9UQk8ClXL05QCg0WIM
KUNglQKmw0YN/Zep2XB+XGA=
=5vPN
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.

Re: [Snort-inline-users] Snort_inline as non-promiscuous replacement for snort?

[Daniel S. <com...@st...>]

> Why don't you just tell snort not to put your card in promiscuous mode?

Thank you very much, that did it :-)

Damn it, I was looking very a complicated way to solve the problem and there was a simple solution to it ;-)


Daniel

PS: Nonetheless I will try out snort_inline, as it seems to be an interesting way to enhance a firewall with an IDS. But before that I will "play around" with its father/mother snort.

Re: [Snort-inline-users] Snort_inline as non-promiscuous replacement for snort?

[Justin A. <JA...@ua...>]

On Wed, 2004-11-17 at 17:07, Daniel Struck wrote:
> Hello,
> 
> 
> I want to perform snort analysis of my trafic on a laptop. But as soon as I put my wireless card in promiscuous mode my transfer rate is reduced ten times.
> 
> So I thought maybe I could use snort_inline as it doesn't require the card to be in promiscous mode.
> 
> Is it adviced to use snort_inline as a replacement for snort?
> 
> 
> Greetings,
> 
> Daniel Struck


Why don't you just tell snort not to put your card in promiscuous mode?

-- 
-- Justin Azoff
-- Network Performance Analyst

[Snort-inline-users] Snort_inline as non-promiscuous replacement for snort?

[Daniel S. <com...@st...>]

Hello,


I want to perform snort analysis of my trafic on a laptop. But as soon as I put my wireless card in promiscuous mode my transfer rate is reduced ten times.

So I thought maybe I could use snort_inline as it doesn't require the card to be in promiscous mode.

Is it adviced to use snort_inline as a replacement for snort?


Greetings,

Daniel Struck

Re: [Snort-inline-users] Checksum calculation and 2.6 kernel

[Joey M. <ix...@cf...>]

Thank you for the heads-up Will.

Are there any security related side-effects from doing this?

I actually think my Samba server was exhibiting this issue. Intermittentl=
y
it would start dropping packets without logging anything. My web server
(also running 2.6) seems to be doing fine, however.

> List,
>
> Not sure why this is happening yet, but it appears as if running a 2.6
> kernel and filtering on local traffic in the INPUT/OUTPUT chains,
> snort_inline/snort doesn't properly calculate the checksum of the
> INBOUND/OUTBOUND packets and they are dropped.  If you are
> experiencing this problem please change the following line in your
> snort_inline.conf file.
>
> config checksum_mode: all
> config checksum_mode: none
>
> Regards,
>
> Will
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by: InterSystems CACHE
> FREE OODBMS DOWNLOAD - A multidimensional database that combines
> robust object and relational technologies, making it a perfect match
> for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>

[Snort-inline-users] Checksum calculation and 2.6 kernel

[Will M. <wil...@gm...>]

List,

Not sure why this is happening yet, but it appears as if running a 2.6
kernel and filtering on local traffic in the INPUT/OUTPUT chains,
snort_inline/snort doesn't properly calculate the checksum of the
INBOUND/OUTBOUND packets and they are dropped.  If you are
experiencing this problem please change the following line in your
snort_inline.conf file.

config checksum_mode: all
config checksum_mode: none

Regards,

Will