Re: Steam5 configuration with Windows, and Linux

[James Lay <jlay () slave-tothe-box net>]

On 2015-11-19 12:26, Rafael Leiva-Ochoa wrote:
> Hi All,
>
>     I am trying to configure the Stream5 preprocessor to do reassembly
> for both Windows and Linux using the following configuration:
>
> # Target-Based stateful inspection/stream reassembly.  For more
> inforation, see README.stream5
>
> preprocessor stream5_global: track_tcp yes
>
> preprocessor stream5_tcp: bind_to 192.168.1.28/32 [1], policy windows
>
> preprocessor stream5_tcp: bind_to 192.168.1.30/32 [2], policy windows
>
> preprocessor stream5_tcp: policy linux
>
>    track_udp yes, \
>
>    track_icmp no, \
>
>    max_tcp 262144, \
>
>    max_udp 131072, \
>
>    max_active_responses 2, \
>
>    min_response_seconds 5
>
> detect_anomalies, require_3whs 180, \
>
>    overlap_limit 10, small_segments 0 bytes 150, timeout 180, \
>
>     ports client 21 22 23 25 42 53 70 79 109 110 111 113 119 135 136
> 137 139 143 \
>
>         161 445 513 514 587 593 691 1433 1521 1741 2100 3306 6070 6665
> 6666 6667 6668 6669 \
>
>         7000 8181 32770 32771 32772 32773 32774 32775 32776 32777
> 32778 32779, \
>
>     ports both 36 80 81 82 83 84 85 86 87 88 89 90 110 311 383 443 465
> 563 555 591 593 631 636 801 808 818 901 972 989 992 993 994 995 1158
> 1220 1414 1533 1741 1830 1942 2231 2301 2381 2578 2809 2980 3029 3037
> 3057 3128 3443 3702 4000 4343 4848 5000 5117 5250 5600 5814 6080 6173
> 6988 7907 7000 7001 7005 7071 7144 7145 7510 7802 7770 7777 7778 7779
> \
>
>         7801 7900 7901 7902 7903 7904 7905 7906 7908 7909 7910 7911
> 7912 7913 7914 7915 7916 \
>
>         7917 7918 7919 7920 8000 8001 8008 8014 8015 8020 8028 8040
> 8080 8081 8082 8085 8088 8090 8118 8123 8180 8181 8182 8222 8243 8280
> 8300 8333 8344 8400 8443 8500 8509 8787 8800 8888 8899 8983 9000 9002
> 9060 9080 9090 9091 9111 9290 9443 9447 9710 9788 9999 10000 11371
> 12601 13014 15489 19980 29991 33300 34412 34443 34444 40007 41080
> 44449 50000 50002 51423 53331 55252 55555 56712
>
> But, I only get this error when trying to run it.
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]: Frag3 global config:
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Max frags: 65536
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Fragment memory cap:
> 4194304 bytes
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]: Frag3 engine config:
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Bound Address: default
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Target-based policy:
> LINUX
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Fragment timeout: 180
> seconds
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Fragment min_ttl:   1
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Fragment Anomalies:
> Alert
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Overlap Limit:     10
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Min fragment Length:
>   100
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:       Max Expected
> Streams: 768
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]: Stream global config:
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Track TCP sessions:
> ACTIVE
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Max TCP sessions:
> 262144
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     TCP cache pruning
> timeout: 30 seconds
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     TCP cache nominal
> timeout: 3600 seconds
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Memcap (for reassembly
> packet storage): 8388608
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Track UDP sessions:
> ACTIVE
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Max UDP sessions:
> 131072
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     UDP cache pruning
> timeout: 30 seconds
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     UDP cache nominal
> timeout: 180 seconds
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Track ICMP sessions:
> INACTIVE
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Track IP sessions:
> INACTIVE
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Log info if session
> memory consumption exceeds 1048576
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Send up to 0 active
> responses
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Protocol Aware
> Flushing: ACTIVE
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:         Maximum Flush
> Point: 16000
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]: Stream TCP Policy config:
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Bound Addresses:
> 192.168.1.28
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Reassembly Policy:
> WINDOWS
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Timeout: 30 seconds
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Maximum number of
> bytes to queue per session: 1048576
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Maximum number of segs
> to queue per session: 2621
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Reassembly Ports:
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]: Stream TCP Policy config:
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Bound Addresses:
> 192.168.1.30
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Reassembly Policy:
> WINDOWS
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Timeout: 30 seconds
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Maximum number of
> bytes to queue per session: 1048576
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Maximum number of segs
> to queue per session: 2621
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Reassembly Ports:
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]: Stream TCP Policy config:
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Bound Address: default
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Reassembly Policy:
> LINUX
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Timeout: 30 seconds
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Maximum number of
> bytes to queue per session: 1048576
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Maximum number of segs
> to queue per session: 2621
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Reassembly Ports:
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]: Stream UDP Policy config:
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     Timeout: 180 seconds
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]: HttpInspect Config:
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:     GLOBAL CONFIG
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:       Detect Proxy Usage:
>      NO
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:       IIS Unicode Map
> Filename: /etc/snort/unicode.map
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:       IIS Unicode Map
> Codepage: 1252
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:       Memcap used for
> logging URI and Hostname: 150994944
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:       Max Gzip Memory:
> 838860
>
> Nov 19 11:24:25 snort-sensor1 snort[24078]:       Max Gzip Sessions:
> 1807
>
> Nov 19 11:24:25 snort-sensor1 rsyslogd-2177: imuxsock begins to drop
> messages from pid 24078 due to rate-limiting
> Any ideas on how to fix this?
>
> Thanks,
>
> Rafael

What's the issue?  The syslog entry?  Normal at startup with Snort if 
you have rsyslog rate-limiting on.  Comment out:

$RepeatedMsgReduction on

in your rsyslog.conf if you want to see all the messages.

James

------------------------------------------------------------------------------
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!