Home page logo
/

snort logo Snort mailing list archives

Re: Snort in IPS mode
From: turki <turki_00 () yahoo com>
Date: Tue, 17 May 2011 14:40:59 -0700 (PDT)

I apologize for the late response as the VM instance failed and i had to rebuild it (welcome to the cloud !)

attached the make3.out and install.out

./configure
Build AFPacket DAQ module.. : yes
Build Dump DAQ module...... : yes
Build IPFW DAQ module...... : yes
Build IPQ DAQ module....... : no
Build NFQ DAQ module....... : yes
Build PCAP DAQ module...... : yes

snort --daq-dir /usr/local/lib daq --daq-list
Available DAQ modules:
nfq(v4): live inline multi
pcap(v3): readback live multi unpriv
ipfw(v2): live inline multi unpriv
dump(v1): readback live inline multi unpriv
afpacket(v4): live inline multi unpriv



--- On Tue, 5/17/11, Russ Combs <rcombs () sourcefire com> wrote:

From: Russ Combs <rcombs () sourcefire com>
Subject: Re: [Snort-users] Snort in IPS mode
To: "turki" <turki_00 () yahoo com>
Cc: "Will Metcalf" <william.metcalf () gmail com>, snort-users () lists sourceforge net, "Jason Brvenik" <jbrvenik () 
sourcefire com>
Received: Tuesday, May 17, 2011, 4:07 PM



On Tue, May 17, 2011 at 3:02 PM, turki <turki_00 () yahoo com> wrote:

./configure --disable-ipq-module

Build AFPacket DAQ module.. : yes
Build Dump DAQ module...... : yes

Build IPFW DAQ module...... : yes
Build IPQ DAQ module....... : no
Build NFQ DAQ module....... : yes
Build PCAP DAQ module...... : yes

snort --daq-dir /usr/local/lib/daq --daq-list

Available DAQ modules:
pcap(v3): readback live multi unpriv
ipfw(v2): live inline multi unpriv
dump(v1): readback live inline multi unpriv
afpacket(v4): live inline multi unpriv

make2.out (after disabling ipq) is attached

Can you send the output of make install &> install.out?



--- On Tue, 5/17/11, Russ Combs <rcombs () sourcefire com> wrote:


From: Russ Combs <rcombs () sourcefire com>

Subject: Re: [Snort-users] Snort in IPS mode
To: "turki"
 <turki_00 () yahoo com>
Cc: "Will Metcalf" <william.metcalf () gmail com>, snort-users () lists sourceforge net, "Jason Brvenik" <jbrvenik () 
sourcefire com>

Received: Tuesday, May 17, 2011, 3:43 PM



On Tue, May 17, 2011 at 2:24 PM, turki <turki_00 () yahoo com> wrote:



make.out attached
Try to reconfigure your DAQ with --disable-ipq-module.  The make is stopping there with 



 "cannot find -lipq".





--- On Tue, 5/17/11, Russ Combs <rcombs () sourcefire com> wrote:



From: Russ Combs <rcombs () sourcefire com>


Subject: Re: [Snort-users] Snort in IPS mode
To: "turki" <turki_00 () yahoo com>
Cc: "Will Metcalf" <william.metcalf () gmail com>, snort-users () lists sourceforge net, "Jason Brvenik" <jbrvenik () 
sourcefire com>


Received: Tuesday, May 17, 2011, 3:18 PM



On Tue, May 17, 2011 at 2:09 PM, turki <turki_00 () yahoo com> wrote:



Producing the same daq list:

./snort --daq-dir /usr/local/lib/daq --daq-list


Available DAQ modules:
pcap(v3): readback live multi unpriv
ipfw(v2): live inline multi unpriv
dump(v1): readback live inline multi unpriv
afpacket(v4): live inline multi unpriv


ls /usr/local/lib/daq



daq_afpacket.la  daq_dump.la  daq_ipfw.la  daq_pcap.la



daq_afpacket.so  daq_dump.so  daq_ipfw.so  daq_pcap.so

daq_nfq.so and daq_nfq.la is not there?!
How come when the configuration of daq telling me




Build NFQ DAQ module....... : yes

Is there anything I need to export in the path? 

Can you send the make output of the DAQ source?

Eg:

make clean



make &> make.out
 

e.g. 
LD_LIBRARY_PATH  or CPPFLAGS 

Russ, I read your previous post in Snort-users
 list:
http://www.networksecurityarchive.org/html/Snort-Users/2011-03/msg00687.html



and trying to understand what is going on


appreciate all kinds of help

--- On Tue, 5/17/11, Russ Combs <rcombs () sourcefire com> wrote:




From: Russ Combs <rcombs () sourcefire com>
Subject: Re: [Snort-users] Snort in IPS mode
To: "turki" <turki_00 () yahoo com>



Cc: "Will Metcalf" <william.metcalf () gmail com>, snort-users () lists sourceforge net, "Jason Brvenik" <jbrvenik () 
sourcefire com>



Received: Tuesday, May 17, 2011, 2:32 PM



On Tue, May 17, 2011 at 1:03 PM, turki <turki_00 () yahoo com> wrote:




Hi Will,

first, checking the configuration of daq
./configure

Build AFPacket DAQ module.. : yes
Build Dump DAQ module...... : yes




Build IPFW DAQ module...... : yes
Build IPQ DAQ module....... : no
Build NFQ DAQ module....... : no
Build PCAP DAQ module...... : yes

then, install the provided packages:
apt-get -y install libnetfilter-queue-dev libnetfilter-queue1 libnfnetlink-dev libnfnetlink0





Run the configuration of daq again:
./configure

Build AFPacket DAQ module.. : yes
Build Dump DAQ module...... : yes
Build IPFW DAQ module...... : yes
Build IPQ DAQ module....... : no
Build NFQ DAQ module....... : yes




Build PCAP DAQ module...... : yes

So clearly, NFQ DAQ module was not installed b4 installing the packages

When I run:
./configure
 --with-libpcap-includes=/usr/include/libnetfilter_queue --with-libpcap-libraries=/usr/lib

Build AFPacket DAQ module.. : yes
Build Dump DAQ module...... : yes
Build IPFW DAQ module...... : yes
Build IPQ DAQ module....... : yes




Build NFQ DAQ module....... : yes
Build PCAP DAQ module...... : yes


Now, when i run:
./snort --daq-list

Available DAQ modules:
pcap(v3): readback live multi unpriv
ipfw(v2): live inline multi unpriv




dump(v1): readback live inline multi unpriv
afpacket(v4): live inline multi unpriv


NFQ is not in the list ?!  help
It may have built only the shared library.  If you know the install directory, then run this:





./snort --daq-dir /usr/local/lib/daq --daq-list

where /usr/local/lib/daq is your daq so install directory. 







--- On Tue, 5/17/11, Will Metcalf <william.metcalf () gmail com> wrote:





From: Will Metcalf <william.metcalf () gmail com>




Subject: Re: [Snort-users] Snort in IPS mode
To: "turki" <turki_00 () yahoo com>
Cc:
 snort-users () lists sourceforge net, "Jason Brvenik" <jbrvenik () sourcefire com>




Received: Tuesday, May 17, 2011, 11:56 AM

I'm not running 11.4 but try this. Afterwards  you need to try and
rebuild daq and make sure it builds with nfq support.


sudo apt-get -y install libnetfilter-queue-dev libnetfilter-queue1
libnfnetlink-dev libnfnetlink0

Regards,

Will
On Tue, May 17, 2011 at 9:43 AM, turki <turki_00 () yahoo com> wrote:





Hi Jason,

as far as i understand from your (and Michael) comments, I did the following:

snort --daq nfq -Q -c snort.conf

I received the following error:
ERROR: Can't find nfq DAQ!




Fatal Error, Quitting..

- Is there any modification I need to do in the snort.conf file ?
- do i
 have to compile snort in inline mode first?
- do I have to set the iptables before i ran snort in inline mode?


My goal is to run Snort in inline mode with a single interface eth0






I appoligize if I am asking too many b
Is there any beginners tutorial regarding snort inline mode as I just jumped in into the snort IPS mode without any 
background.

Thank you,





daq-0.5
ubuntu 11.4
Snort 2.9.0.5



--- On Mon, 5/16/11, Will Metcalf <william.metcalf () gmail com> wrote:





From: Will Metcalf <william.metcalf () gmail com>
Subject: Re: [Snort-users] Snort in IPS mode
To: "turki" <turki_00 () yahoo com>




Cc: "Jason Brvenik" <jbrvenik () sourcefire com>, snort-users () lists sourceforge net




Received: Monday, May 16, 2011, 4:14 PM

You should be able to do this very easily with NFQ as Michael suggested.  See the README included with daq.  One 
thing to note afaik the example uses the FORWARD, if you are using on local host you need something like the 
following if you want to look at port 80 traffic bound for your webserver.





iptables -I INPUT -i lo -j ACCEPT
iptables -I INPUT -p tcp --dport 80 -j NFQUEUE
iptables -I OUTPUT -p tcp --sport 80 -j NFQUEUE


 Regards,

Will

On Mon, May 16, 2011 at 1:46 PM, turki <turki_00 () yahoo com> wrote:

Jason,





No, it didn't work :(

After creating an alias interface eth0:0

and running the command:

snort -Q --daq afpacket -i eth0:eth0:0 -c snort.conf

I got the error msg:





ERROR: Can't initialize DAQ afpacket (-1) - afpacket_daq_initialize: Couldn't create the bridge between eth0 and eth0!
Fatal Error, Quitting..


Thank you for the help





--- On Mon, 5/16/11, Jason Brvenik <jbrvenik () sourcefire com> wrote:

From: Jason Brvenik <jbrvenik () sourcefire com>




Subject: Re: [Snort-users] Snort in IPS mode
To: "turki" <turki_00 () yahoo com>
Cc: snort-users () lists sourceforge net, "Michael Altizer" <maltizer () sourcefire com>




Received: Monday, May 16, 2011, 3:29 PM

Just create an aliased interface to eth0

On May 16, 2011 2:15 PM, "turki" <turki_00 () yahoo com> wrote:




The reason behind my single interface approach is that I want to run Snort (inline mode) in Amazon cloud and I was
 stopped by the fact that they only allow 1 interface for every running virtual machine instance in EC2.

Thank you Michael for sharing your knowledge.



--- On Mon, 5/16/11, Michael Altizer <maltizer () sourcefire com> wrote:





From: Michael Altizer <maltizer () sourcefire com>
Subject: Re: [Snort-users] Snort in IPS mode



To: snort-users () lists sourceforge net

Received: Monday, May 16, 2011, 9:53 PM






This is not possible with
 the current AFPacket DAQ module since I
never really thought to do that, but it could be modified to do so
(check if an instance for that interface already exists when opening
each interface and reuse it instead of trying to reopen and




failing).  You may be able to do something like that with IPTables
and the NFQ DAQ module, but I couldn't say for sure.



On 05/16/2011 09:42 AM, turki wrote:








What if I only have
single interface card "eth0" ?

can I redirect/pair the traffic to itself (i know it is




kind of silly statement)

something like this:



snort -Q --daq afpacket -i eth0:eth0 -c snort.conf








 --- On Mon, 5/16/11, Michael Altizer <xiche () verizon net>
wrote:



From: Michael Altizer <xiche () verizon net>





Subject: Re: [Snort-users] Snort in IPS mode

To: snort-users () lists sourceforge net





Received: Monday, May 16, 2011, 6:27 AM



On 05/15/2011 08:09 PM, turki
wrote:




Hi,





I am new to snort, so i need help here.



I am trying to
 run snort in inline mode with
the following command:

snort -Q --daq afpacket -i eth0 -c
snort.conf



but snort initialization keeps failing with




error message:



afpacket DAQ configured to inline.

ERROR: Can't initialize DAQ afpacket (-1) -
afpacket_daq_initialize: Invalid interface




specification: 'eth0'!

Fatal Error, Quitting..






In order to have an inline deployment you need at




least one pair of interfaces for the traffic to flow
through.  To that end, you need to specify a second
interface for AFPacket to use to complete the bridge.








For example:

snort -Q --daq afpacket -i eth0:eth1 -c snort.conf



or (two inline pairs):



snort -Q --daq afpacket -i eth0:eth1::eth2:eth3 -c




snort.conf














-----Inline Attachment Follows-----





------------------------------------------------------------------------------
Achieve unprecedented app performance and reliability
What every C/C++ and Fortran developer should know.




Learn how Intel has extended the reach of its next-generation tools
to help boost performance applications - inlcuding clusters.
http://p.sf.net/sfu/intel-dev2devmay




-----Inline Attachment Follows-----

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net




Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users




Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

------------------------------------------------------------------------------




Achieve unprecedented
 app performance and reliability
What every C/C++ and Fortran developer should know.
Learn how Intel has extended the reach of its next-generation tools
to help boost performance applications - inlcuding clusters.




http://p.sf.net/sfu/intel-dev2devmay
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net




Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users



Snort-users list archive:

http://www.geocrawler.com/redir-sf.php3?list=snort-users


------------------------------------------------------------------------------




Achieve unprecedented app performance and reliability
What every C/C++ and Fortran developer should know.
Learn how Intel has extended the reach of its next-generation tools
to help boost performance applications - inlcuding clusters.




http://p.sf.net/sfu/intel-dev2devmay
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net




Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users



Snort-users list archive:

http://www.geocrawler.com/redir-sf.php3?list=snort-users




------------------------------------------------------------------------------


Achieve unprecedented app performance and reliability

What every C/C++ and Fortran developer should know.

Learn how Intel has extended the reach of its next-generation tools

to help boost performance applications - inlcuding clusters.

http://p.sf.net/sfu/intel-dev2devmay
_______________________________________________

Snort-users mailing list

Snort-users () lists sourceforge net

Go to this URL to change user options or unsubscribe:

https://lists.sourceforge.net/lists/listinfo/snort-users

Snort-users list archive:

http://www.geocrawler.com/redir-sf.php3?list=snort-users








Attachment: make3.out
Description:

Attachment: install.out
Description:

------------------------------------------------------------------------------
What Every C/C++ and Fortran developer Should Know!
Read this article and learn how Intel has extended the reach of its 
next-generation tools to help Windows* and Linux* C/C++ and Fortran 
developers boost performance applications - including clusters. 
http://p.sf.net/sfu/intel-dev2devmay
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]