Re: new SIP preproc on snort v2.9.1 never firing?

[rmkml <rmkml () yahoo fr>]

Thx Alex,
I have missed updating preprocessor.rules file: fixed.
Regards
Rmkml


On Wed, 7 Sep 2011, Alex Kirk wrote:

> Yes, with the default snort.conf:
> akirk@sf:~/snort-2.9.1.1$ ./src/snort -c etc/snort.2910.conf -q -A cmg -N --daq dump --daq-var load-mode=read-file -Q 
> -r ~/pcaps/empty_call_id.pcap
> 03/31-15:37:31.923920  [**] [140:4:1] (spp_sip) Empty call-Id [**] [Classification: Potentially Bad Traffic] [Priority: 2] 
> {UDP} 10.1.2.3:5060 -> 10.9.8.7:5060
> 03/31-15:37:31.923920 02:01:02:03:04:05 -> 02:09:08:07:06:05 type:0x800 len:0x1A7
> 10.1.2.3:5060 -> 10.9.8.7:5060 UDP TTL:64 TOS:0x0 ID:1 IpLen:20 DgmLen:409
> Len: 381
> 49 4E 56 49 54 45 20 73 69 70 3A 34 33 32 31 40  INVITE sip:4321@
> 31 39 32 2E 31 36 38 2E 31 2E 38 37 3B 75 73 65  192.168.1.87;use
> 72 3D 70 68 6F 6E 65 20 53 49 50 2F 32 2E 30 0D  r=phone SIP/2.0.
> 0A 56 69 61 3A 20 53 49 50 2F 32 2E 30 2F 55 44  .Via: SIP/2.0/UD
> 50 20 31 39 32 2E 31 36 38 2E 31 2E 34 38 3A 35  P 192.168.1.48:5
> 30 36 30 3B 62 72 61 6E 63 68 3D 7A 39 68 47 34  060;branch=z9hG4
> 62 4B 2D 6A 37 67 74 72 6A 67 77 65 34 30 39 3B  bK-j7gtrjgwe409;
> 72 70 6F 72 74 0D 0A 46 72 6F 6D 3A 20 31 31 31  rport..From: 111
> 20 3C 73 69 70 3A 31 31 31 40 31 39 32 2E 31 36   <sip:111@192.16
> 38 2E 31 2E 33 36 3E 3B 74 61 67 3D 34 6D 6B 36  8.1.36>;tag=4mk6
> 7A 73 34 34 72 35 0D 0A 54 6F 3A 20 3C 73 69 70  zs44r5..To: <sip
> 3A 34 33 32 31 40 31 39 32 2E 31 36 38 2E 31 2E  :4321@192.168.1.
> 38 37 3B 75 73 65 72 3D 70 68 6F 6E 65 3E 0D 0A  87;user=phone>..
> 43 61 6C 6C 2D 49 44 3A 0D 0A 43 53 65 71 3A 20  Call-ID:..CSeq:
> 31 20 49 4E 56 49 54 45 0D 0A 4D 61 78 2D 46 6F  1 INVITE..Max-Fo
> 72 77 61 72 64 73 3A 20 37 30 0D 0A 43 6F 6E 74  rwards: 70..Cont
> 61 63 74 3A 20 3C 73 69 70 3A 31 31 31 40 31 39  act: <sip:111@19
> 32 2E 31 36 38 2E 31 2E 34 38 3A 35 30 36 30 3B  2.168.1.48:5060;
> 6C 69 6E 65 3D 62 72 31 6D 76 76 64 66 3E 0D 0A  line=br1mvvdf>..
> 41 63 63 65 70 74 3A 20 61 70 70 6C 69 63 61 74  Accept: applicat
> 69 6F 6E 2F 73 64 70 0D 0A 43 6F 6E 74 65 6E 74  ion/sdp..Content
> 2D 54 79 70 65 3A 20 61 70 70 6C 69 63 61 74 69  -Type: applicati
> 6F 6E 2F 73 64 70 0D 0A 43 6F 6E 74 65 6E 74 2D  on/sdp..Content-
> 4C 65 6E 67 74 68 3A 20 30 0D 0A 0D 0A           Length: 0....
>
> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
>
> You're probably not getting alerts because you don't have appropriate traffic flowing through your network.
>
> On Wed, Sep 7, 2011 at 9:26 AM, rmkml <rmkml () yahoo fr> wrote:
>       Hi Alex,
>       Already decommented this line:
>        include $PREPROC_RULE_PATH/preprocessor.rules
>
> Im curious if you have already SIP preproc fired?
> Regards
> Rmkml
>
> http://twitter.com/rmkml
>
>
> On Wed, 7 Sep 2011, Alex Kirk wrote:
>
>       include $PREPROC_RULE_PATH/preprocessor.rules is your friend, it's commented out by default.
>
>       On Wed, Sep 7, 2011 at 4:26 AM, rmkml <rmkml () yahoo fr> wrote:
>            Hi Alex,
>            How to enable this please?
>            It's not enabled on snort.conf default?
>            But SIP preproc stats (snort verbose mode) work:
>             ...
>             SIP Preprocessor Statistics
>             Total sessions: 28
>             Preprocessor events: 31
>             Total  dialogs: 47
>             Requests: 195
>                     invite:   39
>                     cancel:   11
>                        ack:   22
>                        bye:   9
>             ...
>            Regards
>            Rmkml
>
>
>
>       On Tue, 6 Sep 2011, Alex Kirk wrote:
>
>            Do you have the preprocessor rules enabled?
>
>            On Tue, Sep 6, 2011 at 5:32 PM, rmkml <rmkml () yahoo fr> wrote:
>                 Hi,
>                 Im continue testing last snort v2.9.1, but new SIP preproc never firing.
>                 Anyone have alert with SIP preproc ? (GID 140)
>
>                 Im tested with default snort.conf:
>                  ...
>                  PortVar 'SIP_PORTS' defined :  [ 5060:5061 5600 ]
>                  ...
>                  Loading dynamic preprocessor library 
> dynamic-preprocessors/build/usr/local/lib/snort_dynamicpreprocessor//libsf_sip_preproc.so... done
>                  ...
>                  SIP config:
>                   Max number of sessions: 10000 (Default)
>                   Status: ENABLED
>                   Ignore media channel: DISABLED
>                   Max URI length: 512
>                   Max Call ID length: 80
>                   Max Request name length: 20 (Default)
>                   Max From length: 256 (Default)
>                   Max To length: 256 (Default)
>                   Max Via length: 1024 (Default)
>                   Max Contact length: 512
>                   Max Content length: 1024 (Default)
>                   Ports:
>                         5060    5061    5600
>                   Methods:
>                    invite cancel ack bye register options refer subscribe update join info message notify benotify do 
> qauth sprack publish service unsubscribe prack
>                 ...
>                   o"  )~   Version 2.9.1 IPv6 GRE (Build 71)
>                 ...
>                            Preprocessor Object: SF_SIP (IPV6)  Version 1.1  <Build 1>
>                 ...
>
>                 Im reduced sip length but sip preproc never firing again.
>
>                 Im read doc/README.sip and of course enabled udp on stream5 (default snort.conf).
>                 Tested with nessus,nmap,many scanner, replay traffic, sipp...
>                 Regards
>                 Rmkml
>
>                 http://twitter.com/rmkml
------------------------------------------------------------------------------
Using storage to extend the benefits of virtualization and iSCSI
Virtualization increases hardware utilization and delivers a new level of
agility. Learn what those decisions are and how to modernize your storage 
and backup environments for virtualization.
http://www.accelacomm.com/jaw/sfnl/114/51434361/

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!