Home page logo
/

snort logo Snort mailing list archives

Re: Snort only partially alerting
From: Joel Esler <jesler () sourcefire com>
Date: Fri, 21 Jun 2013 11:03:59 -0400

Can you send me the pcap off list?

On Jun 21, 2013, at 11:01 AM, Frank Calone <fc10011001 () gmail com> wrote:

1)   In my continuing efforts to figure out why Snort misses nearly all of the exe downloads I performed a TCPDUMP on 
the same interface to ensure the traffic is there that I am expecting to have Snort alert on.  Here is the latest.  I 
had TCPDUMP already installed on our Centos system and so I enabled packet capture with the following command:
 
tcpdump -i p1p1 -N -w tcpdump.jun20.v3.pcap src 15.8.5.18 or dst 15.8.5.18
 
2)   I started snort as follows:
 
/usr/sbin/snort -A fast -d   -i  p1p1 -u snort -g snort -c /etc/snort/snort1.conf -l /var/log/snort2 -G 1
 
3)   I then downloaded putty.exe from  www.chiark.greenend.org.uk.
 
4)   I then aborted both TCPDUMP and SNORT.  I checked the alert file in /var/log/snort2   to see if an alert showed 
up.  No hits.
 
5)   I ran the tcpdump.jun20.v3.pcap file thru snort as follows:
 
snort -dvr  tcpdump.jun20.v3.pcap > testtcpd.jun20.v3
 
6)   I reviewed the file (testtcpd.jun20.v3) and found this entry showing the network tap indeed is working fine as 
the Snort "content" string search value (This program cannot be run in DOS mode) is plainly visible:
 
06/20-13:47:35.769947 46.43.34.31:80 -> 15.8.5.18:56416 TCP TTL:50 TOS:0x0 ID:61603 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x3940EBD2  Ack: 0x51CD46B3  Win: 0x42  TcpLen: 20
48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F 4B 0D  HTTP/1.1 200 OK.
0A 44 61 74 65 3A 20 54 68 75 2C 20 32 30 20 4A  .Date: Thu, 20 J
75 6E 20 32 30 31 33 20 31 37 3A 34 37 3A 33 35  un 2013 17:47:35
20 47 4D 54 0D 0A 53 65 72 76 65 72 3A 20 41 70   GMT..Server: Ap
61 63 68 65 0D 0A 4C 61 73 74 2D 4D 6F 64 69 66  ache..Last-Modif
69 65 64 3A 20 53 61 74 2C 20 31 30 20 44 65 63  ied: Sat, 10 Dec
20 32 30 31 31 20 31 33 3A 33 38 3A 33 37 20 47   2011 13:38:37 G
4D 54 0D 0A 45 54 61 67 3A 20 22 31 36 34 30 34  MT..ETag: "16404
30 37 2D 37 36 30 30 30 2D 34 62 33 62 64 30 34  07-76000-4b3bd04
63 34 33 31 34 30 22 0D 0A 41 63 63 65 70 74 2D  c43140"..Accept-
52 61 6E 67 65 73 3A 20 62 79 74 65 73 0D 0A 43  Ranges: bytes..C 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 34  
ontent-Length: 4
38 33 33 32 38 0D 0A 4B 65 65 70 2D 41 6C 69 76  83328..Keep-Aliv
65 3A 20 74 69 6D 65 6F 75 74 3D 31 35 2C 20 6D  e: timeout=15, m
61 78 3D 39 39 0D 0A 43 6F 6E 6E 65 63 74 69 6F  ax=99..Connectio 6E 3A 20 4B 65 65 70 2D 41 6C 69 76 65 0D 0A 43  n: 
Keep-Alive..C 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 61 70 70  ontent-Type: app 6C 69 63 61 74 69 6F 6E 2F 78 2D 6D 
73 64 6F 73  lication/x-msdos 2D 70 72 6F 67 72 61 6D 0D 0A 0D 0A 4D 5A 90 00  -program....MZ..
03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00  ................
00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00  .... ()            
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00 00 00 00 00 00 00 00 00 01 00 00 0E 1F BA 0E  ................
00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70  ....!..L.!This p
72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65  rogram cannot be
20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F 64 65   run in DOS mode
2E 0D 0D 0A 24 00 00 00 00 00 00 00 6D 1F 98 6B  ....$.......m..k
29 7E F6 38 29 7E F6 38 29 7E F6 38 3A 76 9F 38  )~.8)~.8)~.8:v.8 2B 7E F6 38 2C 72 96 38 2B 7E F6 38 2C 72 F9 38  
+~.8,r.8+~.8,r.8
32 7E F6 38 3A 76 AB 38 2B 7E F6 38 D3 5D EF 38  2~.8:v.8+~.8.].8 2D 7E F6 38 AA 76 AB 38 38 7E F6 38 29 7E F7 38  
-~.8.v.88~.8)~.8
04 7F F6 38 2C 72 A9 38 95 7E F6 38 C5 75 A8 38  ...8,r.8.~.8.u.8
28 7E F6 38 2C 72 AC 38 28 7E F6 38 52 69 63 68  (~.8,r.8(~.8Rich
29 7E F6 38 00 00 00 00 00 00 00 00 00 00 00 00  )~.8............
 
7)   Here is the output when I aborted the Snort process (run in foreground)
 
Packet I/O Totals:
   Received:      1278250
   Analyzed:      1278244 (100.000%)
    Dropped:            0 (  0.000%)
   Filtered:            0 (  0.000%)
Outstanding:            6 (  0.000%)
   Injected:            0
===============================================================================
Breakdown by protocol (includes rebuilt packets):
        Eth:      1281819 (100.000%)
       VLAN:            0 (  0.000%)
        IP4:      1281734 ( 99.993%)
       Frag:           58 (  0.005%)
       ICMP:          901 (  0.070%)
        UDP:        35748 (  2.789%)
        TCP:       922437 ( 71.963%)
        IP6:           32 (  0.002%)
    IP6 Ext:           32 (  0.002%)
   IP6 Opts:            0 (  0.000%)
      Frag6:            0 (  0.000%)
      ICMP6:           32 (  0.002%)
       UDP6:            0 (  0.000%)
       TCP6:            0 (  0.000%)
     Teredo:            8 (  0.001%)
    ICMP-IP:            0 (  0.000%)
    IP4/IP4:            0 (  0.000%)
    IP4/IP6:           24 (  0.002%)
    IP6/IP4:            0 (  0.000%)
    IP6/IP6:            0 (  0.000%)
        GRE:            0 (  0.000%)
    GRE Eth:            0 (  0.000%)
   GRE VLAN:            0 (  0.000%)
    GRE IP4:            0 (  0.000%)
    GRE IP6:            0 (  0.000%)
GRE IP6 Ext:            0 (  0.000%)
   GRE PPTP:            0 (  0.000%)
    GRE ARP:            0 (  0.000%)
    GRE IPX:            0 (  0.000%)
   GRE Loop:            0 (  0.000%)
       MPLS:            0 (  0.000%)
        ARP:           18 (  0.001%)
        IPX:            0 (  0.000%)
   Eth Loop:            0 (  0.000%)
   Eth Disc:            0 (  0.000%)
   IP4 Disc:       322566 ( 25.165%)
   IP6 Disc:            0 (  0.000%)
   TCP Disc:            0 (  0.000%)
   UDP Disc:            0 (  0.000%)
  ICMP Disc:            0 (  0.000%)
All Discard:       322566 ( 25.165%)
      Other:           67 (  0.005%)
Bad Chk Sum:          326 (  0.025%)
    Bad TTL:            0 (  0.000%)
     S5 G 1:         2314 (  0.181%)
     S5 G 2:         1261 (  0.098%)
      Total:      1281819
===============================================================================
Action Stats:
     Alerts:            0 (  0.000%)
     Logged:            0 (  0.000%)
     Passed:            0 (  0.000%)
Limits:
      Match:            0
      Queue:            0
        Log:            0
      Event:            0
      Alert:            0
Verdicts:
      Allow:      1189531 ( 93.059%)
      Block:            0 (  0.000%)
    Replace:            0 (  0.000%)
  Whitelist:        88713 (  6.940%)
  Blacklist:            0 (  0.000%)
     Ignore:            0 (  0.000%)
===============================================================================
Frag3 statistics:
        Total Fragments: 58
      Frags Reassembled: 0
               Discards: 0
          Memory Faults: 0
               Timeouts: 0
               Overlaps: 0
              Anomalies: 0
                 Alerts: 0
                  Drops: 0
     FragTrackers Added: 58
    FragTrackers Dumped: 58
FragTrackers Auto Freed: 0
    Frag Nodes Inserted: 58
     Frag Nodes Deleted: 58
===============================================================================
Stream5 statistics:
            Total sessions: 24790
              TCP sessions: 19331
              UDP sessions: 5459
             ICMP sessions: 0
               IP sessions: 0
                TCP Prunes: 0
                UDP Prunes: 0
               ICMP Prunes: 0
                 IP Prunes: 0
TCP StreamTrackers Created: 19522
TCP StreamTrackers Deleted: 19522
              TCP Timeouts: 0
              TCP Overlaps: 39
       TCP Segments Queued: 115887
     TCP Segments Released: 115887
       TCP Rebuilt Packets: 39102
         TCP Segments Used: 95388
              TCP Discards: 262728
                  TCP Gaps: 6707
      UDP Sessions Created: 5459
      UDP Sessions Deleted: 5459
              UDP Timeouts: 0
              UDP Discards: 0
                    Events: 133590
           Internal Events: 0
           TCP Port Filter
                   Dropped: 0
                 Inspected: 0
                   Tracked: 918536
           UDP Port Filter
                   Dropped: 0
                 Inspected: 24930
                   Tracked: 5459
===============================================================================
HTTP Inspect - encodings (Note: stream-reassembled packets included):
    POST methods:                         172
    GET methods:                          12647
    HTTP Request Headers extracted:       12858
    HTTP Request Cookies extracted:       6798
    Post parameters extracted:            171
    HTTP response Headers extracted:      9755
    HTTP Response Cookies extracted:      1380
    Unicode:                              247
    Double unicode:                       0
    Non-ASCII representable:              15
    Directory traversals:                 0
    Extra slashes ("//"):                 2237
    Self-referencing paths ("./"):        0
    HTTP Response Gzip packets extracted: 1457
    Gzip Compressed Data Processed:       3087532.00
    Gzip Decompressed Data Processed:     9451498.00
    Total packets processed:              377200
===============================================================================
SMTP Preprocessor Statistics
  Total sessions                                    : 28
  Max concurrent sessions                           : 3
  Base64 attachments decoded                        : 2
  Total Base64 decoded bytes                        : 1676
  Quoted-Printable attachments decoded              : 3
  Total Quoted decoded bytes                        : 1133
  UU attachments decoded                            : 0
  Total UU decoded bytes                            : 0
  Non-Encoded MIME attachments extracted            : 10
  Total Non-Encoded MIME bytes extracted            : 2066
===============================================================================
dcerpc2 Preprocessor Statistics
  Total sessions: 300
  Total sessions autodetected: 124
  Total sessions aborted: 164
 
  Transports
    SMB
      Total sessions: 117
      Packet stats
        Packets: 218
        Ignored bytes: 2635
        Not NBSS Session Message: 2
        Not IPC packets (after tree connect): 1
        Maximum outstanding requests: 1
        SMB command requests/responses processed
          Negotiate (0x72) : 85/37
          Session Setup AndX (0x73) : 2/2
          Tree Connect AndX (0x75) : 1/1
    TCP
      Total sessions: 183
      Packet stats
        Packets: 2538
 
  DCE/RPC
    Connection oriented
      Packet stats
        PDUs: 2538
          Bind: 136
          Bind Ack: 136
          Alter context: 68
          Alter context response: 68
          Request: 1057
          Response: 992
          Auth3: 80
          Orphaned: 1
        Request fragments: 1
          Min fragment size: 0
          Max fragment size: 0
          Frag reassembled: 0
        Response fragments: 0
        Client PDU segmented reassembled: 0
        Server PDU segmented reassembled: 0 
===============================================================================
SSL Preprocessor:
   SSL packets decoded: 15811
          Client Hello: 2833
          Server Hello: 1528
           Certificate: 393
           Server Done: 5354
   Client Key Exchange: 1601
   Server Key Exchange: 117
         Change Cipher: 5428
              Finished: 0
    Client Application: 3061
    Server Application: 1645
                 Alert: 622
  Unrecognized records: 4780
  Completed handshakes: 0
        Bad handshakes: 0
      Sessions ignored: 1642
    Detection disabled: 301
===============================================================================
SIP Preprocessor Statistics
  Total sessions: 163
  SIP anomalies : 11
  Requests: 0
          invite:   0
          cancel:   0
             ack:   0
             bye:   0
        register:   0
         options:   0
           refer:   0
       subscribe:   0
          update:   0
            join:   0
            info:   0
         message:   0
          notify:   0
           prack:   0
  Responses: 0
             1xx:   0
             2xx:   0
             3xx:   0
             4xx:   0
             5xx:   0
             6xx:   0
             7xx:   0
             8xx:   0
             9xx:   0
Ignore sessions:   0
Ignore channels:   0
===============================================================================
Reputation Preprocessor Statistics
  Total Memory Allocated: 0
===============================================================================
Snort exiting
 
8)    Here is the rule that should have detected this.  I am only running 2 rules at this time.
 
alert tcp ![128.131.0.0/16] !20 -> $HOME_NET any (msg:"exe downloaded"; content:"This program cannot be run in DOS 
mode";  sid:1999998; rev:5;)
 
9) I tried running snort in the full packet logger mode (/usr/sbin/snort -dev -i p1p1 -l /var/log/snort -h 
x.x.x.x/16).  I immediately started getting the following warning messages:
 
(snort_decoder) WARNING: IP dgm len > captured len
 
I then ran the binary capture thru the snort playback (-dvr option).  Looking at the packets tied to my PC, I can see 
that almost all of them have a datagram length of 40.  Very few packets showed up with a real payload, certainly not 
enough to amount to the size of the file I downloaded during the testing.  I'm not sure if there is a config setting 
or something else going wrong here such that very few packets have any real data.  Here is a sample of what I am 
seeing (the last two are in order they appeared in the dump file):
 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
06/18-16:20:19.229724 15.8.5.18:62287 -> 212.13.197.229:80
TCP TTL:127 TOS:0x0 ID:7467 IpLen:20 DgmLen:40 DF
***A**** Seq: 0x3279955A  Ack: 0xEF27E0F7  Win: 0x4029  TcpLen: 20 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
 
06/18-16:20:25.306989 212.13.197.229:80 -> 15. 8.5.18:62287
TCP TTL:44 TOS:0x0 ID:43106 IpLen:20 DgmLen:40 DF
***A***F Seq: 0xEF27E0F7  Ack: 0x3279955B  Win: 0x5C  TcpLen: 20
 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
 
06/18-16:20:27.305825 212.13.197.229:80 -> 15.8.5.18:62285
TCP TTL:44 TOS:0x0 ID:3711 IpLen:20 DgmLen:40 DF
***A***F Seq: 0x53804DD1  Ack: 0x77F4A813  Win: 0x5C  TcpLen: 20
 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
 
06/18-16:20:27.306281 15.8.5.18:62285 -> 212.13.197.229:80
TCP TTL:127 TOS:0x0 ID:9849 IpLen:20 DgmLen:40 DF
***A**** Seq: 0x77F4A813  Ack: 0x53804DD2  Win: 0x4029  TcpLen: 20
 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
 
06/18-16:20:34.312205 212.13.197.229:80 -> 15.8.5.18:62286
TCP TTL:44 TOS:0x0 ID:50990 IpLen:20 DgmLen:40 DF
***A***F Seq: 0x3FC527C5  Ack: 0xCF59BF2B  Win: 0x83  TcpLen: 20
 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
 
I'm looking for suggestions on what is broken or what to try next to get this resolved.  Our server is Centos  
(2.6.32-358.6.2.el6.x86_64) with 4 GB memory.  I set the stream5 memcap to 1 GB (1073741824), maxtcp 393216 in the 
config file.  Perfmon shows 90% CPU avail and max memory used at any point of 250 MB.  Snort Build shows the 
following:
  ,,_     -*> Snort! <*-
  o"  )~   Version 2.9.4.5 GRE (Build 71)
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using libpcap version 1.0.0
           Using PCRE version: 7.8 2008-09-05
           Using ZLIB version: 1.2.3
 
Frank
------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:

Build for Windows Store.

http://p.sf.net/sfu/windows-dev2dev_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:

Build for Windows Store.

http://p.sf.net/sfu/windows-dev2dev
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]