snort-inline-users — The goal of this list is to help users debug/use snort_inline

[Snort-inline-users] Snort-Inline on Freebsd

[<DAN...@ao...>]

Hello,

       I am trying to find out if it is possible to run snort-inline on a 
freebsd box?
And if so how would you configure ipfw to forward traffic to snort-inline?

I have looked on some other mailing lists which seem to mention that it is 
possible, but not how to go about doing it.

Thanks

Danny

[Snort-inline-users] Re: attack redirection

[Ray S. <me...@hi...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Forescout ( http://www.forescout.com/index.html) sells a product that works
with commercial firewall and IPS vendors.  It detects all kinds of scans and
returns dummy server information. Then any traffic to these dummy servers can
be filtered. You can replace the dummy server addresses with your
honeypot(s).

I agree this would be a great feature to snort and I have copied the
snort-inline list.

Best regards

ray


On Friday 16 May 2003 02:48 pm, Jon Baer wrote:
> It would be nice to have an intelligent version of Snort to be able to do
> this :-)  Im also interested in an answer, if you get it please pass along.
> Thanks.
>
> - Jon
>
> ----- Original Message -----
> From: "Andrew Elmore" <and...@cy...>
> To: <sec...@se...>
> Sent: Friday, May 16, 2003 7:38 AM
> Subject: attack redirection
>
>
> Hey guys,
>        I'm looking for some program to redirect an attack on my web server
> to a honeypot. Maybe triggered by number of hits in a given time or by
> certain requests. Does such a thing exist? Where can I get it? Or would I
> have to write some kind of script?
> Thanks for your help.
>
> Andy
>
>
> ---------------------------------------------------------------------------
> Thinking About Security Training? You Can't Afford Not To!
>
> Vigilar's industry leading curriculum includes:  Security +, Check Point,
> Hacking & Assessment, Cisco Security, Wireless Security & more! Register
> Now!
> --UP TO 30% off classes in select cities--
> http://www.securityfocus.com/Vigilar-security-basics
> ---------------------------------------------------------------------------
>-
>
>
>
> ---------------------------------------------------------------------------
> Thinking About Security Training? You Can't Afford Not To!
>
> Vigilar's industry leading curriculum includes:  Security +, Check Point,
> Hacking & Assessment, Cisco Security, Wireless Security & more! Register
> Now! --UP TO 30% off classes in select cities--
> http://www.securityfocus.com/Vigilar-security-basics
> ---------------------------------------------------------------------------
>-
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+x9DGzejBliQ3SdsRAtjzAKDugolpgwe8l44CH0tfnE3YURjS/QCfQEyl
Kdg7j0zoQ6Z0Z3WhNWezH5M=
=UOcy
-----END PGP SIGNATURE-----

Re: [Snort-inline-users] First snort inline config - req suggestions on hardware, version of software

[Lance S. <la...@ho...>]

On Tue, 13 May 2003 rob...@di... wrote:

> I am in the process of setting up a demo honeynet, and am installing and 
> using the snort_inline/GenII configuration for the first time.
> 
> I was wondering if anyone would share the hardware configuration of their 
> gateway PC with me - just how much processor power and memory is required to 
> front end a small (max 4 honeypots) honeynet?

Minimal.  You can easily get away with an old Pentium and 64 MB of
RAM. Remember, Honeynets in general only collect malicious or
unauthorized traffic, so you should see no more then 5 MB of traffic
a day (unless you are compromised, then the captured activity
definitely increases).  The biggest challenge will be getting your 
system to work with several NICs.  Also, any Linux distribution should 
work fine.

If anyone has different findings, I would definitely be interested
in their experiences.

lance

[Snort-inline-users] First snort inline config - req suggestions on hardware, version of software

[<rob...@di...>]

Hello -- 

I am in the process of setting up a demo honeynet, and am installing and 
using the snort_inline/GenII configuration for the first time.

I was wondering if anyone would share the hardware configuration of their 
gateway PC with me - just how much processor power and memory is required to 
front end a small (max 4 honeypots) honeynet?

As well, most of the documentation I've found cites people as using Redhat 
Linux 7.3.  Has anyone used versions 8 or 9 - any "gotchas" to report?

Any and all responses will be appreciated.  I will summarize what I receive 
and post back to the list.

Cheers, Robb

Re: [Snort-inline-users] command line options

[Rob M. <rv...@ca...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



On Tue, 6 May 2003, danh wrote:

> Hi people,
> 
> I am using snort_inline 2.0.0 and it all appears to be functioning
> normally (I  have iptables set up with the "-j QUEUE" target for all
> incoming traffic on port 80, without snort_inline running I get no
> connections, with it running my web server sees the requests) but after
> extensive testing I can confirm that it is letting through sequences
> that "normal" snort will alert on.

Can you give some examples of the sequences that are getting through?  
What rules are you using?  As far as the 
behavior with the QUEUE and no snort_inline running, it is ip_queue's 
default behavior to drop packets if no process (snort_inline in our case) 
is not listening to the queue.

Also, please download the latest snort_inline-2.0.0-1.

> There are a few things that I have noticed that may have a bearing.
> 
> When I used to run normal snort, I started it with the "-i ppp0" command
> line option, as that is my external interface. I also had the line "var
> HOME_NET [10.0.0.0/8,$ppp0_ADDRESS]" in my conf file. This does not
> appear to work for snort_inline. I get an error about undefined variables.

snort_inline does not get its packets from an interface therefore, the -i 
flag will not do much good.  Instead, snort_inline gets its packet from 
the firewall.  So if you want to control where snort_inline gets its 
packets, you have to divert them with the use of -j QUEUE.  For example, 
if I want all of my inbound packets to tcp port 80 on my ppp0 interface to 
go through snort_inline, I would use the following iptables rule:

iptables -A INPUT -i ppp0 -p tcp --dport 80 -m state --state 
NEW,RELATED,ESTABLISHED -j QUEUE

Use connection tracking (state) because it makes iptables reassemble all 
fragments before it passes them on.   

> Also when I start up normal snort, during initialisation it reports 1331
> rules active etc.. However, snort_inline says 0 rules activated BUT it
> does appear to be applying rules (it caught a WEB-IIS cmd.exe attack).

hmm.  I don't get the same results.

[root@Jiggy src]# ./snort_inline -Qc 
/etc/snort_inline/snort_inline.new.conf
Reading from iptables
Running in IDS mode
Log directory = /var/log/snort
Initializing Inline mode

        --== Initializing Snort ==--
Initializing Output Plugins!
Setting the Packet Processor to decode packets from iptables
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file /etc/snort_inline/snort_inline.new.conf

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
http_decode arguments:
    Unicode decoding
    IIS alternate Unicode decoding
    IIS double encoding vuln
    Flip backslash to slash
    Include additional whitespace separators
    Ports to decode http on: 80
rpc_decode arguments:
    Ports to decode RPC on: 111 32771
    alert_fragments: INACTIVE
    alert_large_fragments: ACTIVE
    alert_incomplete: ACTIVE
    alert_multiple_requests: ACTIVE
telnet_decode arguments:
    Ports to decode telnet on: 21 23 25 119
Conversation Config:
   KeepStats: 0
   Conv Count: 32000
   Timeout   : 60
   Alert Odd?: 0
   Allowed IP Protocols:  All

1369 Snort rules read...
1369 Option Chains linked into 113 Chain Headers
0 Dynamic rules
+++++++++++++++++++++++++++++++++++++++++++++++++++

Rule application order: 
- ->activation->dynamic->drop->sdrop->reject->alert->pass->log

        --== Initialization Complete ==--

*******************
snort_inline-2.0.0-1
*******************
a modification of ...

- -*> Snort! <*-
Version 2.0.0 (Build 72)
By Martin Roesch (ro...@so..., www.snort.org)

> The reason I am using snort_inline is that I am trying to get a true
> count of web site hits, but I am getting so many "code red" attempts it
> is distorting the figures. So I was trying to drop the connections
> before they even get to the web server. I know that there are issues
> with detecting code red attacks (no established flag etc) but I can
> handle that.

Cool! and thanks for the feedback.

Rob

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8
Comment: Made with pgp4pine 1.76

iQA/AwUBPrg76/nAyY+9KLjdEQKg0QCgmB/HVkyY8MQ97KvvrHVuGbsqbrIAnipc
MOz0JB2jIP91svUjKZ9nnTis
=Jg53
-----END PGP SIGNATURE-----

[Snort-inline-users] command line options

[danh <da...@li...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi people,

I am using snort_inline 2.0.0 and it all appears to be functioning
normally (I  have iptables set up with the "-j QUEUE" target for all
incoming traffic on port 80, without snort_inline running I get no
connections, with it running my web server sees the requests) but after
extensive testing I can confirm that it is letting through sequences
that "normal" snort will alert on.

There are a few things that I have noticed that may have a bearing.

When I used to run normal snort, I started it with the "-i ppp0" command
line option, as that is my external interface. I also had the line "var
HOME_NET [10.0.0.0/8,$ppp0_ADDRESS]" in my conf file. This does not
appear to work for snort_inline. I get an error about undefined variables.

Also when I start up normal snort, during initialisation it reports 1331
rules active etc.. However, snort_inline says 0 rules activated BUT it
does appear to be applying rules (it caught a WEB-IIS cmd.exe attack).

The reason I am using snort_inline is that I am trying to get a true
count of web site hits, but I am getting so many "code red" attempts it
is distorting the figures. So I was trying to drop the connections
before they even get to the web server. I know that there are issues
with detecting code red attacks (no established flag etc) but I can
handle that.

Any advice would be cool.

Cheers

Dan Hennessey
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQE+t5hEUGFfCkMKT4ERAlJLAJ9M1ebZ5ne29yTDPNoev+W5oq70wwCgiZWu
U9xK7AWqL6S2LDExVrmXsoA=
=AJSh
-----END PGP SIGNATURE-----

Re: [Snort-inline-users] Question

[Fabian B. <fab...@we...>]

On Mon, May 05, 2003 at 08:15:37PM -0400, Rob McMillen wrote:
> Anyone using snort_inline?  Just wondering if anyone is having problems=
=20
> using it.

Im using it in my honeynet. Works fine,

	Fabian
--=20
BOFH excuse #309:
firewall needs cooling

[Snort-inline-users] Question

[Rob M. <rv...@ca...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Anyone using snort_inline?  Just wondering if anyone is having problems 
using it.

Thanks in advance,

Rob

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8
Comment: Made with pgp4pine 1.76

iQA/AwUBPrb+rPnAyY+9KLjdEQJVUgCgnA6M2yuwjjsJQey8ahNVPkGG3TcAnidU
oU80tIurbUe/1iMP07MWhUZ9
=agQu
-----END PGP SIGNATURE-----

[Snort-inline-users] snort_inline-2.0.0-1 released

[Rob M. <rv...@ca...>]

A new release is out.  Lance Spitzner identified a problem with the 
replace keyword.  It was replacing the content found with zeroes instead 
of the specified content.

The new release (snort_inline-2.0.0-1) is available at:

sno...@so...

Rob

[Snort-inline-users] subscribe

[Rob M. <rv...@ca...>]

subscribe