snort-inline-users

[Snort-inline-users] strange timeout - telnet/ssh/etc

[<ka...@ez...>]

Hi,

Having a strange issue with telnet and ssh issues that I
can't figure out. With snort_inline 2.1.x (2 and 3) I have
it set with two simple rules in the FORWARD chain of QUEUE
and ACCEPT. The only packets dropped are a few that are
worm/virus related.  

The problem is this -- ssh and/or telnet sessions time out.
You can make the connection, but if you leave it sit for
about 30 seconds, it goes dead. If you try to reconnect -
that works too, but in 30 seconds or so, same thing. 

Help?
Thanks
Kat

Re: [Snort-inline-users] strange timeout - telnet/ssh/etc

[Mike W. <mwi...@lu...>]

There is a problem when using stream4 preprocessor and snort_inline. You could 
disable the stream4 preprocessor to get rid of the timeout problems. There 
was a patch released on this list that corrected the problem but I can't seem 
to find it at the moment. 

Regards,

- Mike

On Monday 08 November 2004 14:24, ka...@ez... wrote:
> Hi,
>
> Having a strange issue with telnet and ssh issues that I
> can't figure out. With snort_inline 2.1.x (2 and 3) I have
> it set with two simple rules in the FORWARD chain of QUEUE
> and ACCEPT. The only packets dropped are a few that are
> worm/virus related.
>
> The problem is this -- ssh and/or telnet sessions time out.
> You can make the connection, but if you leave it sit for
> about 30 seconds, it goes dead. If you try to reconnect -
> that works too, but in 30 seconds or so, same thing.
>
> Help?
> Thanks
> Kat
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by:
> Sybase ASE Linux Express Edition - download now for FREE
> LinuxWorld Reader's Choice Award Winner for best database on Linux.
> http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users

-- 
Mike Wisener, GCIA
Senior Information Security Analyst
LURHQ -- http://www.lurhq.com
mwi...@lu...

This E-mail and any of its contents may contain LURHQ proprietary information, 
which is privileged, confidential, or subject to copyright belonging to 
LURHQ. This E-mail is intended solely for the use of the individual or entity 
to which it is addressed. If you are not the intended recipient of this 
E-mail, you are hereby notified that any dissemination, distribution, 
copying, or action taken in relation to the contents of and attachments to 
this E-mail is strictly prohibited and may be unlawful. If you have received 
this E-mail in error, notify the sender immediately and permanently delete 
the original and any copy of this E-mail.

Re: [Snort-inline-users] strange timeout - telnet/ssh/etc

[Victor J. <vi...@nk...>]

On Monday 08 November 2004 20:24, ka...@ez... wrote:
> Hi,
>
> Having a strange issue with telnet and ssh issues that I
> can't figure out. With snort_inline 2.1.x (2 and 3) I have
> it set with two simple rules in the FORWARD chain of QUEUE
> and ACCEPT. The only packets dropped are a few that are
> worm/virus related.
>
> The problem is this -- ssh and/or telnet sessions time out.
> You can make the connection, but if you leave it sit for
> about 30 seconds, it goes dead. If you try to reconnect -
> that works too, but in 30 seconds or so, same thing.

Your problem probably is the stream4 timeout. You can set it to a higher 
value, or use the IptState option. It was especially designed for this...

Regards,
Victor

> Help?
> Thanks
> Kat
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by:
> Sybase ASE Linux Express Edition - download now for FREE
> LinuxWorld Reader's Choice Award Winner for best database on Linux.
> http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users