Re: Unexpected results with reputation preprocessor

["Joel Esler (jesler)" <jesler () cisco com>]

That’s interesting.  No firewalls in place or anything?

Clearly the packet took place, as it is logged there, ID numbers, ACKs are correct, flags are there, etc.


On Mar 19, 2014, at 6:50 PM, Dave Corsello <snort-users () wintertreemedia com> wrote:

> I'm assuming that the reputation preprocessor is preventing the traffic
> from hitting my mail server.  This is supported by: 1)  entries for
> inbound and outbound connections from and to the offending address
> stopped appearing in my maillog when I added the address to my Snort
> reputation blacklist; and 2) my mail server only refuses connections
> temporarily under "too many errors" conditions, and there are no such
> entries in my maillog for the offending address.  I haven't enabled
> flexresp.  My config options were --enable-sourcefire and --enable-reload.
>
>
> On 3/19/2014 6:18 PM, Joel Esler (jesler) wrote:
> > A Syn packet (expected) and an ACK RST.  Either your mail server is refusing the connection, or you have something 
> > like flex response turned on which is resetting the connection?
> >
> >
> > On Mar 19, 2014, at 5:35 PM, Dave Corsello <snort-users () wintertreemedia com> wrote:
> >
> > > I log to unified2 and fast alerts.  Here's an example from alert.fast:
> > >
> > > 03/19-15:05:07.463849  [Drop] [**] [136:1:1] (spp_reputation) packets
> > > blacklisted [**] [Classification: Potentially Bad Traffic] [Priority: 2]
> > > {TCP} 184.22.119.205:26174 -> x.x.x.x:25
> > > 03/19-15:05:07.463849 184.22.119.205:26174 -> x.x.x.x:25
> > > TCP TTL:53 TOS:0x0 ID:24430 IpLen:20 DgmLen:48 DF
> > > ******S* Seq: 0x74ADFBAC  Ack: 0x0  Win: 0x3908  TcpLen: 28
> > > TCP Options (3) => MSS: 1460 NOP WS: 8
> > > =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
> > >
> > >
> > > 03/19-15:05:07.464089  [Drop] [**] [136:1:1] (spp_reputation) packets
> > > blacklisted [**] [Classification: Potentially Bad Traffic] [Priority: 2]
> > > {TCP} x.x.x.x:25 -> 184.22.119.205:26174
> > > 03/19-15:05:07.464089 x.x.x.x:25 -> 184.22.119.205:26174
> > > TCP TTL:202 TOS:0x0 ID:13060 IpLen:20 DgmLen:40
> > > ***A*R** Seq: 0x0  Ack: 0x74ADFBAD  Win: 0x0  TcpLen: 20
> > > =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
> > >
> > > x.x.x.x represents the private address of my mail server.  I was wrong
> > > when I said that the timestamps are identical--they appear to be the
> > > same in BASE, in which seconds are the smallest increment.  There are no
> > > corresponding records in my maillog.
> > >
> > > On 3/19/2014 4:12 PM, James Lay wrote:
> > > > Are you logging to unified?  Would be interesting to see the output of 
> > > > that offlist perhaps if it's sensitive.
> > > >
> > > > James
> > >
> > > ------------------------------------------------------------------------------
> > > Learn Graph Databases - Download FREE O'Reilly Book
> > > "Graph Databases" is the definitive new guide to graph databases and their
> > > applications. Written by three acclaimed leaders in the field,
> > > this first edition is now available. Download your free book today!
> > > http://p.sf.net/sfu/13534_NeoTech
> > > _______________________________________________
> > > Snort-users mailing list
> > > Snort-users () lists sourceforge net
> > > Go to this URL to change user options or unsubscribe:
> > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > Snort-users list archive:
> > > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> > >
> > > Please visit http://blog.snort.org to stay current on all the latest Snort news!


------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!