Snort && MySQL && ACID

["Samuel Trommel" <gtrommel () kabelfoon nl>]

Hello Everybody,

 

I got some problems with the logging. It seems that is only logging attacks
(such as exploits) Port scans or just connections at one of the Emergency
Ports: 21 23 25 53 80 110 111 143 513 1433 gives me nothing in the ACID
interface.

 

I'm running a nessus deamon, for the people who don't know what nesss does:
it portscan the selected ip and after that it tries to do several exploits
from his database (you can daily update this one) Snort logs nothing of the
portscan but when the 

Xploits are going to do there work acid logs a lot of attacks. 

 

Your help will be appreciated.

 

Greet,

 

Samuel

 

Some useful output:

 

/usr/local/bin/snort -u snort -g snort -c /etc/snort/snort.conf -i tun0 -T

Running in IDS mode

Log directory = /var/log/snort

 

Initializing Network Interface tun0

 

        --== Initializing Snort ==--

Initializing Output Plugins!

Decoding LoopBack on interface tun0

Initializing Preprocessors!

Initializing Plug-ins!

Parsing Rules file /etc/snort/snort.conf

 

+++++++++++++++++++++++++++++++++++++++++++++++++++

Initializing rule chains...

,-----------[Flow Config]----------------------

| Stats Interval:  0

| Hash Method:     2

| Memcap:          10485760

| Rows  :          4099

| Overhead Bytes:  16400(%0.16)

`----------------------------------------------

No arguments to frag2 directive, setting defaults to:

    Fragment timeout: 60 seconds

    Fragment memory cap: 4194304 bytes

    Fragment min_ttl:   0

    Fragment ttl_limit: 5

    Fragment Problems: 0

    Self preservation threshold: 500

    Self preservation period: 90

    Suspend threshold: 1000

    Suspend period: 30

Stream4 config:

    Stateful inspection: ACTIVE

    Session statistics: INACTIVE

    Session timeout: 30 seconds

    Session memory cap: 8388608 bytes

    State alerts: INACTIVE

    Evasion alerts: INACTIVE

    Scan alerts: INACTIVE

    Log Flushed Streams: INACTIVE

    MinTTL: 1

    TTL Limit: 5

    Async Link: 0

    State Protection: 0

    Self preservation threshold: 50

    Self preservation period: 90

    Suspend threshold: 200

    Suspend period: 30

Stream4_reassemble config:

    Server reassembly: INACTIVE

    Client reassembly: ACTIVE

    Reassembler alerts: ACTIVE

    Zero out flushed packets: INACTIVE

    flush_data_diff_size: 500

    Ports: 21 23 25 53 80 110 111 143 513 1433

    Emergency Ports: 21 23 25 53 80 110 111 143 513 1433

HttpInspect Config:

    GLOBAL CONFIG

      Max Pipeline Requests:    0

      Inspection Type:          STATELESS

      Detect Proxy Usage:       NO

      IIS Unicode Map Filename:
/usr/home/sources/snort-2.2.0RC1/etc/unicode.map

      IIS Unicode Map Codepage: 1252

    DEFAULT SERVER CONFIG:

      Ports: 80 8080 8180

      Flow Depth: 300

      Max Chunk Length: 500000

      Inspect Pipeline Requests: YES

      URI Discovery Strict Mode: NO

      Allow Proxy Usage: NO

      Disable Alerting: NO

      Oversize Dir Length: 500

      Only inspect URI: NO

      Ascii: YES alert: NO

      Double Decoding: YES alert: YES

      %U Encoding: YES alert: YES

      Bare Byte: YES alert: YES

      Base36: OFF

      UTF 8: OFF

      IIS Unicode: YES alert: YES

      Multiple Slash: YES alert: NO

      IIS Backslash: YES alert: NO

      Directory Traversal: YES alert: NO

      Web Root Traversal: YES alert: YES

      Apache WhiteSpace: YES alert: YES

      IIS Delimiter: YES alert: YES

      IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG

      Non-RFC Compliant Characters: NONE

rpc_decode arguments:

    Ports to decode RPC on: 111 32771

    alert_fragments: INACTIVE

    alert_large_fragments: ACTIVE

    alert_incomplete: ACTIVE

    alert_multiple_requests: ACTIVE

telnet_decode arguments:

    Ports to decode telnet on: 21 23 25 119

database: compiled support for ( mysql )

database: configured to use mysql

database:          user = snort

database: password is set

database: database name = snort

database:          host = localhost

database:   sensor name = <ip>

database:     sensor id = 2

database: inconsistent cid information for sid=2

          Recovering by rolling forward the cid=3

database: schema version = 106

database: using the "log" facility

1801 Snort rules read...

1801 Option Chains linked into 174 Chain Headers

0 Dynamic rules

+++++++++++++++++++++++++++++++++++++++++++++++++++

 

Warning: flowbits key 'realplayer.playlist' is checked but not ever set.

 

+-----------------------[thresholding-config]-------------------------------
---

| memory-cap : 1048576 bytes

+-----------------------[thresholding-global]-------------------------------
---

| none

+-----------------------[thresholding-local]--------------------------------
---

| gen-id=1      sig-id=2494      type=Both       tracking=dst count=20
seconds=60

| gen-id=1      sig-id=2523      type=Both       tracking=dst count=10
seconds=10

| gen-id=1      sig-id=2495      type=Both       tracking=dst count=20
seconds=60

| gen-id=1      sig-id=2496      type=Both       tracking=dst count=20
seconds=60

| gen-id=1      sig-id=2275       type=Threshold tracking=dst count=5
seconds=60

+-----------------------[suppression]---------------------------------------
---

----------------------------------------------------------------------------
---

Rule application order: ->activation->dynamic->alert->pass->log

 

        --== Initialization Complete ==--

 

-*> Snort! <*-

Version 2.2.0RC1 (Build 28)

By Martin Roesch (roesch () sourcefire com, www.snort.org)

 

Snort sucessfully loaded all rules and checked all rule chains!

Final Flow Statistics

,----[ FLOWCACHE STATS ]----------

Memcap: 10485760 Overhead Bytes 16400 used(%0.156403)/blocks (16400/1)
Overhead blocks: 1 Could Hold: (0)

IPV4 count: 0 frees: 0 low_time: 0, high_time: 0, diff: 0h:00:00s

    finds: 0 reversed: 0(%0.000000)

    find_sucess: 0 find_fail: 0 percent_success: (%0.000000) new_flows: 0

database: Closing connection to database ""

Snort exiting 

 

 

 

 

So like I said it only logs xploits probes:

 

<knip>

[**] [1:2003:6] MS-SQL Worm propagation attempt [**]

[Classification: Misc Attack] [Priority: 2]

08/15-14:51:40.081165 <ip>:2398 -> <ip>:1434

UDP TTL:47 TOS:0x0 ID:45539 IpLen:20 DgmLen:404

Len: 376

[Xref => http://vil.nai.com/vil/content/v_99992.htm][Xref =>
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2002-0649][Xref =>
http://www.securityfocus.com/bid/5311][Xref =>
http://www.securityfocus.com/bid/5310]

 

[**] [1:2004:5] MS-SQL Worm propagation attempt OUTBOUND [**]

[Classification: Misc Attack] [Priority: 2]

08/15-14:51:40.081165 <ip>:2398 -> <ip>:1434

UDP TTL:47 TOS:0x0 ID:45539 IpLen:20 DgmLen:404

Len: 376

[Xref => http://vil.nai.com/vil/content/v_99992.htm][Xref =>
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2002-0649][Xref =>
http://www.securityfocus.com/bid/5311][Xref =>
http://www.securityfocus.com/bid/5310]

 

[**] [1:2050:5] MS-SQL version overflow attempt [**]

[Classification: Misc activity] [Priority: 3]

08/15-14:51:40.081165 <ip>:2398 -> <ip>:1434

UDP TTL:47 TOS:0x0 ID:45539 IpLen:20 DgmLen:404

Len: 376

[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10674][Xref =>
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2002-0649][Xref =>
http://www.securityfocus.com/bid/5310]

<knip>