Snort mailing list archives
RE: Inline and stream 4
From: "Pieter Vanmeerbeek" <pieter.vanmeerbeek () able be>
Date: Thu, 20 Apr 2006 16:43:38 +0200
What do you mean by the 'bridge interface'? I suppose you mean the LAN interface as we do not use bridging. Or can I dump somewhere else to see more info? I started the ssh connection to a pc on the secure lan from the console on the server. I ran a tcpdump on the secure lan interface of the server, but saw nothing, not even the initial sync packet, I did saw this packet in the snort logging (extra debugging). Disabling snort shows the packets (3way handshake in the dump). As even the first packet is not send through the secure lan device towards the pc on the lan, but it is showing up in snort, I don't think any packet is 'bypassing' the queue statement? Or am I misinterpreting the -v debugging logging of snort? In other words, it is the ssh connection on the server which Is retransmitting the sync packet. Kind regards, Pieter -----Original Message----- From: Will Metcalf [mailto:william.metcalf () gmail com] Sent: donderdag 20 april 2006 16:05 To: Pieter Vanmeerbeek Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] Inline and stream 4 Are you seeing a TWH handshake when you try to initiate your connections? Or are you just seeing one side of the conversation? Fire up tcpdump and tell it to listen on your bridge interface. Which side of the conversation is retransmitting data? Add a -j LOG rule to the end of your FORWARD chain, is the traffic that you are expecting to show up in snort bypassing your QUEUE rules? Regards, Will On 4/20/06, Pieter Vanmeerbeek <pieter.vanmeerbeek () able be> wrote:
We have a whole range of iptables rules. In fact it is a system were every rule resides in a chain. This way we can always jump to one specific rule. Whenever a rule accepts a packet it is send to special chains _INP_ACCEPT
or
_FWD_ACCEPT or _OUT_ACCEPT chain dependant of the table. Only when the incoming device is lo the packet is directly accepted as this is a local communication. (pkts bytes target prot opt in out source destination 57536 8916K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 ) In these special chains a jump to the _IPS chain is made, in which the actual jump to QUEUE is made, this is the _IPS chain: Chain _IPS (2 references) pkts bytes target prot opt in out source destination 224K 187M QUEUE all -- * * 0.0.0.0/0 0.0.0.0/0 condition ips_runs This is a conditional jump which is controlled by the /proc/net/ipt_condition/ips_run flag. As far as I can tell the packets are send correctly to snort. I checked
this
by starting an ssh session from the server to something in the lan, snort shows the packet with the sync bit on when started with the -v option. When an ACCEPT jump is placed in the _IPS chain before the queue statement or when the ips_run flags is set to 0 the ssh session works again. Kind regards, Pieter -----Original Message----- From: Will Metcalf [mailto:william.metcalf () gmail com] Sent: donderdag 20 april 2006 15:12 To: Pieter Vanmeerbeek Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] Inline and stream 4 can you send us a scrubbed version of your iptables rules? Regards, Will On 4/20/06, Pieter Vanmeerbeek <pieter.vanmeerbeek () able be> wrote:Hi, As indicated in my previous post we were only sending incoming trafficfromthe Internet and DMZ devices through snort. Following your advise I tried to route all traffic through snort, this
is
our setup INT -- Server with snort -- LAN I created a jump to QUEUE in iptables in the output, forward and input table, in other words all combination . However from the moment a jump in the output table is set, it isn'tpossibleto make connections, I tested this with an ssh session from the LAN totheserver and a session from the server to the LAN. I debugged the last one, running snort with the -v option shows me that packets are sent to snort as they are logged, however dumping on thesecurelan device of the server shows no packets. Disabling the jump to the
QUEUE
statement solves the problem. For some reason a ping to the lan and to
the
server seem to work, so I don't think everything is blocked. I can't seem to find the problem as no alerts are shown. I tried
removing
all rules and even all preproccessors from the snort.conf file but stillthesame problem. I set the home_net variable to the secure lan IP address
and
internet IP address. I used the default snort.conf file with
http_inspect
disabled and the stream4 midstream_drop_alerts option on. All rules aresetto drop, but as the problem still exists without any rules in thesnort.confI don't think a problem exists there. Is there anything else I can disable/enable to see something more? I
even
tried a small program that reads its input from the QUEUE user land end which just passes its input on. Using this program everything seems towork.Kind regards, Pieter -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Pieter Vanmeerbeek Sent: donderdag 13 april 2006 12:20 To: snort-users () lists sourceforge net Subject: [Snort-users] Inline and stream 4 Hi I've got a question on a stream 4 configuration. This is our setup: All traffic from internet and dmz is routed to snort using iptables
QUEUE
statement. All traffic from our router itself and all traffic from the secure LAN is NOT routed to snort. We are using the upgradeable rule set with all rules set to drop to have an IPS system This worked fine, however sometimes connections were dropped without alerting. After some research I found out that it is the stream4 preprocessor who was doing this. Adding the midstream_drop_alertsparametersolves the problem however may expose us to snot & stick attacks. 2 questions about this: 1. I thought a snot & stick attack was designed to bury a hacking
attempt
between other useless attacks and therefore obscure the logging andpossiblerecognition. But in an IPS system the attack itself is logged and also blocked. So I do not understand why this is may be a problem? 2. Apparently the problem of question 1 is not an issue if theinline_stateparameter is set. However as we do not send all traffic through snort
this
will probably cause a lot of packages to be dropped? Even more general,
is
there a possible state problem when only traffic from internet/dmz isroutedto snort? In other words would some rules match due to a state problem? Kind regards, Pieter -- --------------------------------------------------- aXs GUARD Training Center more info at http://www.axsguard.com/indextraining.htm aXs GUARD has completed security and anti-virus checks on this e-mail (http://www.axsguard.com) --------------------------------------------------- Able NV: ond.nr 0457.938.087 RPR Mechelen ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scriptinglanguagethat extends applications into web and mobile media. Attend the livewebcastand join the prime developer group breaking into this new codingterritory!http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users -- --------------------------------------------------- aXs GUARD Training Center more info at http://www.axsguard.com/indextraining.htm aXs GUARD has completed security and anti-virus checks on this e-mail(http://www.axsguard.com)--------------------------------------------------- Able NV: ond.nr 0457.938.087 RPR Mechelen ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services,
security?
Get stuff done quickly with pre-integrated technology to make your jobeasierDownload IBM WebSphere Application Server v.1.0.1 based on Apache
Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users-- --------------------------------------------------- aXs GUARD Training Center more info at http://www.axsguard.com/indextraining.htm aXs GUARD has completed security and anti-virus checks on this e-mail
(http://www.axsguard.com)
--------------------------------------------------- Able NV: ond.nr 0457.938.087 RPR Mechelen ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
-- --------------------------------------------------- aXs GUARD Training Center more info at http://www.axsguard.com/indextraining.htm aXs GUARD has completed security and anti-virus checks on this e-mail (http://www.axsguard.com) --------------------------------------------------- Able NV: ond.nr 0457.938.087 RPR Mechelen ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Inline and stream 4 Pieter Vanmeerbeek (Apr 13)
- Re: Inline and stream 4 Will Metcalf (Apr 13)
- RE: Inline and stream 4 Pieter Vanmeerbeek (Apr 20)
- Re: Inline and stream 4 Will Metcalf (Apr 20)
- RE: Inline and stream 4 Pieter Vanmeerbeek (Apr 20)
- Re: Inline and stream 4 Will Metcalf (Apr 20)
- RE: Inline and stream 4 Pieter Vanmeerbeek (Apr 20)
- Re: Inline and stream 4 Will Metcalf (Apr 20)
- Re: Inline and stream 4 Will Metcalf (Apr 20)