Re: Snort+flexresp

[Roelof JT Jonkman <roel () SiliconDefense com>]

Sonika,

This is a somwhat common problem. I'll try my best to explain this somewhat.
(Marty and other have explained this well in the past)

Whenever you see the alert gets generated, snort has to fabricate two  
packets with the RST flag set, one for the server, and one for the client.
The crucial piece is that the sequence number matches that of the connection.
If the sequence number is off, it simply gets discarded. It obviously takes
some time to fabricate these packets. In the mean time the server is also 
working on a response to the client. The gotcha is when you do this
on a LAN, the delays are so low, that the server is likely to get back to
the client before snort/flexresp is able to generate the RST packets, and
the connection will have advanced beyond the sequence number that the
RST packets have, and swat, they get ignored. However on a WAN connection
where the delays are more than ~2ms, the RST packets will still have
a sequence number that matches the current sequence number of the connection,
and hence will convince both ends that the connection has ended.

This is sort of a terse background behind flexible response, and why
it works in some (WAN) cases, and not in others (LAN) This is
by no means complete, rather it reflects upon my understanding
of it.

Hope this helps.

Roel Jonkman
Security Engineer
http://www.SiliconDefense.com


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users