Snort mailing list archives
(no subject)
From: Bob Apthorpe <apthorpe+snort () cynistar net>
Date: Tue, 28 Oct 2003 15:52:57 -0600 (CST)
Hi, I think there's a problem with MySQL database logging in Snort 2.0.2 for Win32, specifically when the interface is set in the sensor table. It appears that you can't set the interface name and the implied name of the interface is '\' (a single literal unescaped backslash) which causes MySQL to choke. See James Howarth's post on 3 September for a similar occurence: http://lists.virus.org/snort-users-0309/msg00035.html In my case, I configured logging with output database: log, mysql, user=snort, password=[redacted], dbname=snort20, host=localhost and I ran snort.exe -c C:\Snort\etc\snort.conf -l C:\logs\snort -i 4 -T -v stdout gives me: ===== Initializing Preprocessors! Initializing Plug-ins! database: compiled support for ( mysql odbc ) database: configured to use mysql database: user = snort database: password is set database: database name = snort20 database: host = localhost database: sensor name = ADRASTEA:\ ===== and stderr yields: ===== Running in IDS mode Log directory = C:\logs\snort Initializing Network Interface \ --== Initializing Snort ==-- Initializing Output Plugins! Decoding Ethernet on interface \ Parsing Rules file C:\Snort\etc\snort.conf +++++++++++++++++++++++++++++++++++++++++++++++++++ Initializing rule chains... No arguments to frag2 directive, setting defaults to: Fragment timeout: 60 seconds Fragment memory cap: 4194304 bytes Fragment min_ttl: 0 Fragment ttl_limit: 5 Fragment Problems: 0 Self preservation threshold: 500 Self preservation period: 90 Suspend threshold: 1000 Suspend period: 30 Stream4 config: Stateful inspection: ACTIVE Session statistics: INACTIVE Session timeout: 30 seconds Session memory cap: 8388608 bytes State alerts: INACTIVE Evasion alerts: INACTIVE Scan alerts: ACTIVE Log Flushed Streams: INACTIVE MinTTL: 1 TTL Limit: 5 Async Link: 0 State Protection: 0 Self preservation threshold: 50 Self preservation period: 90 Suspend threshold: 200 Suspend period: 30 Stream4_reassemble config: Server reassembly: INACTIVE Client reassembly: ACTIVE Reassembler alerts: ACTIVE Zero out flushed packets: INACTIVE flush_data_diff_size: 500 Ports: 21 23 25 53 80 110 111 143 513 1433 Emergency Ports: 21 23 25 53 80 110 111 143 513 1433 http_decode arguments: Unicode decoding IIS alternate Unicode decoding IIS double encoding vuln Flip backslash to slash Include additional whitespace separators Ports to decode http on: 80 rpc_decode arguments: Ports to decode RPC on: 111 32771 alert_fragments: INACTIVE alert_large_fragments: ACTIVE alert_incomplete: ACTIVE alert_multiple_requests: ACTIVE telnet_decode arguments: Ports to decode telnet on: 21 23 25 119 Node unique name is: ADRASTEA:\ database: mysql_error: You have an error in your SQL syntax near '\' AND detail = '1' AND encoding = '0' AND filter IS NULL' at line 1 database: mysql_error: You have an error in your SQL syntax near '\','1','0', '0')' at line 1 SQL=INSERT INTO sensor (hostname, interface, detail, encoding, last_cid) VALUES ('ADRASTEA:\','\','1','0', '0') database: mysql_error: You have an error in your SQL syntax near '\' AND detail = '1' AND encoding = '0' AND filter IS NULL' at line 1 database: Problem obtaining SENSOR ID (sid) from snort20->sensor ERROR: When this plugin starts, a SELECT query is run to find the sensor id for the currently running sensor. If the sensor id is not found, the plugin will run an INSERT query to insert the proper data and generate a new sensor id. Then a SELECT query is run to get the newly allocated sensor id. If that fails then this error message is generated. Some possible causes for this error are: * the user does not have proper INSERT or SELECT privileges * the sensor table does not exist If you are _absolutely_ certain that you have the proper privileges set and that your database structure is built properly please let me know if you continue to get this error. You can contact me at (roman () danyliw com). Fatal Error, Quitting.. ===== (FWIW, the table snort20.sensor exists and the snort user has full permissions on the snort20 database.) If Snort is actually sending the query INSERT INTO sensor (hostname, interface, detail, encoding, last_cid) \ VALUES ('ADRASTEA:\','\','1','0', '0') without escaping the \ in 'ADRASTEA:\' or '\', I strongly suspect that's what's causing the problem that both James and I are seeing. I can change sensor_name to anything I want in snort.conf and I can specify the interface when invoking Snort; neither of those have any affect on the value passed to sensor.interface. What's really odd is that db logging worked fine on Win32 before upgrading from Snort 1.9(?) to 2.0.2. The previous version of Snort set sensor_name to ADRASTEA:DevicePacket_{EF7842F4-A0D6-49BE-B93A-D0110C4C467F} and interface to DevicePacket_{EF7842F4-A0D6-49BE-B93A-D0110C4C467F} . `snort.exe -W` gives: Interface Device Description ------------------------------------------- 1 \Device\Packet_NdisWanIp (NdisWan Adapter) 2 \Device\Packet_NdisWanBh (NdisWan Adapter) 3 \Device\Packet_NdisWanAtalk (NdisWan Adapter) 4 \Device\Packet_{EF7842F4-A0D6-49BE-B93A-D0110C4C467F} (3Com EtherLink PCI) so I've got no idea why interface 4 is being read as \. And yes, I've created a new db, ran all the db creation scripts, checked permissions, and tried to verify as much of this as I could manually (tried sending data to two different MySQL instances, one on Win32 and one on Linux, both giving the same error.) I can't make that INSERT statement work on a command line and all signs point to either bad escaping or bad interface name determination. Other wrinkles - I upgraded WinPCAP to v3; realized my mistake, uninstalled it and reinstalled v2.3. Who knows if there's any lingering crud left over from that fiasco (though wouldn't `snort -W` have coughed up a lung on the device list if WinPCAP was broken?) Any hints? I don't think I've missed anything obvious but I wouldn't be surprised if I had. :/ Thanks much, -- Bob Apthorpe ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- (no subject) Kristian Schling (Oct 08)
- Re: (no subject) Ralf Spenneberg (Oct 09)
- <Possible follow-ups>
- (no subject) Dave . Hartley (Oct 15)
- (no subject) Cluett, Russell (Oct 22)
- (no subject) Bob Apthorpe (Oct 28)
- (no subject) Kaplan, Andrew H. (Nov 04)
- Re: (no subject) Olaf Schreck (Nov 04)
- RE: (no subject) Kaplan, Andrew H. (Nov 05)
- RE: (no subject) Kaplan, Andrew H. (Nov 05)
- (no subject) CGhercoias (Dec 01)
- Message not available
- Re: (no subject) Matt Kettler (Dec 01)
- Message not available
- Re: (no subject) Jim Brown (Dec 01)
- (no subject) wfz (Dec 05)
- (no subject) Andrew Sergeyev (Dec 12)
- (no subject) Russell Fulton (Dec 12)