Snort mailing list archives
Re: snort and squid
From: "Helmut Schneider" <jumper99 () gmx de>
Date: Thu, 17 Jan 2008 16:17:41 +0100
From: "Paul Melson" <pmelson () gmail com>
I'm using snort 2.7 on two machines, one at a hub next to the router and the firewall and since yesterday a second sensor on my proxy (squid). All web-traffic must go through the proxy. The first sensor gives information about e.g. that one uses google desktop but does not say which client (of course, as source is the proxy). So I installed snort as a second sensor on the proxy but without success. The alerts the first sensors finds are not found on the second sensor (the squid protocol might differ from HTTP). Is there a way to configure snort to reveal which exact client "breaks" policies?Add 3128 to HTTP_PORTS in your snort.conf. All of your HTTP rules will be looking on port 80 and the traffic to thw proxy is on 3128.
Still no luck. I get tons of 'http_inspect', lots of 'icmp' stuff, but no single 'porn', 'Google Desktop', ... is caught (while on the external sensor it is; and I use the same configuration as on the external sensor and only changed EXTERNAL_NET). var HOME_NET [192.168.0.0/24,192.168.1.0/24,192.168.2.0/24] var EXTERNAL_NET any #var EXTERNAL_NET 192.168.1.70/32 [...] var HTTP_SERVERS $HOME_NET [...] var WWW_SERVERS $HOME_NET [...] var HTTP_PORTS 3128 [...] var RULE_PATH /usr/local/etc/snort/rules [...] [...] preprocessor http_inspect: global iis_unicode_map unicode.map 1252 preprocessor http_inspect_server: \ server default \ apache_whitespace no \ ascii no \ bare_byte no \ chunk_length 500000 \ flow_depth 1460 \ directory no \ double_decode no \ iis_backslash no \ iis_delimiter no \ iis_unicode no \ multi_slash no \ non_strict \ oversize_dir_length 500 \ ports { 80 2301 3128 8000 8080 8180 8888 } \ u_encode yes \ non_rfc_char { 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 } \ webroot no [...] include $RULE_PATH/policy.rules include $RULE_PATH/porn.rules [...] ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- snort and squid Helmut Schneider (Jan 17)
- Re: snort and squid Paul Melson (Jan 17)
- Re: snort and squid Helmut Schneider (Jan 17)
- Re: snort and squid Joel Esler (Jan 17)
- Re: snort and squid Helmut Schneider (Jan 18)
- Re: snort and squid Joel Esler (Jan 18)
- Re: snort and squid Helmut Schneider (Jan 18)
- Re: snort and squid Seth (Jan 18)
- Re: snort and squid Helmut Schneider (Jan 18)
- Re: snort and squid Helmut Schneider (Jan 18)
- Re: snort and squid Paul Melson (Jan 17)