Snort mailing list archives
Re: http_header not working
From: NIDS TEAM <nidsteam () gmail com>
Date: Mon, 29 Sep 2014 13:52:20 +0200
So I just compiled Snort with --enable-sourcefire. Snort runs with the following rule: alert tcp any any <> any any (msg:"TEST HOST alert"; content:"google"; http_uri; gid:1; sid:99999; rev:2;) I then do one single request to www.google.com/mail The following request is visible with Snort (I do not copy all the SYN/ACK packets): =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 09/29-09:03:51.706262 213.156.231.85:38364 -> 173.194.32.210:80 TCP TTL:64 TOS:0x0 ID:60575 IpLen:20 DgmLen:170 DF ***AP*** Seq: 0xE1581B62 Ack: 0x746B8DA Win: 0x73 TcpLen: 32 TCP Options (3) => NOP NOP TS: 1809643521 4126477955 47 45 54 20 2F 6D 61 69 6C 20 48 54 54 50 2F 31 GET /mail HTTP/1 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 .1..User-Agent: 57 67 65 74 2F 31 2E 31 33 2E 34 20 28 6C 69 6E Wget/1.13.4 (lin 75 78 2D 67 6E 75 29 0D 0A 41 63 63 65 70 74 3A ux-gnu)..Accept: 20 2A 2F 2A 0D 0A 48 6F 73 74 3A 20 77 77 77 2E */*..Host: www. 67 6F 6F 67 6C 65 2E 63 6F 6D 0D 0A 43 6F 6E 6E google.com..Conn 65 63 74 69 6F 6E 3A 20 4B 65 65 70 2D 41 6C 69 ection: Keep-Ali 76 65 0D 0A 0D 0A ve.... =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ The Preprocessor Profile Statistics shows: 3 httpinspect 0 2 2 4 2.11 0.60 0.60 =============================================================================== HTTP Inspect - encodings (Note: stream-reassembled packets included): POST methods: 0 GET methods: 0 HTTP Request Headers extracted: 0 HTTP Request Cookies extracted: 0 Post parameters extracted: 0 HTTP response Headers extracted: 0 HTTP Response Cookies extracted: 0 Unicode: 0 Double unicode: 0 Non-ASCII representable: 0 Directory traversals: 0 Extra slashes ("//"): 0 Self-referencing paths ("./"): 0 HTTP Response Gzip packets extracted: 0 Gzip Compressed Data Processed: n/a Gzip Decompressed Data Processed: n/a Total packets processed: 2 It looks like the http_inspect preprocessor doesn't do anything here, besides passing the packet. The http_inspect configuration is identical to: http://labs.snort.org/snort/2962/snort.conf On Fri, Sep 26, 2014 at 5:50 PM, Joel Esler (jesler) <jesler () cisco com> wrote:
I suggest you compile with —enable-sourcefire. That turns on all the things we usually troubleshoot with.On Sep 26, 2014, at 11:46 AM, NIDS TEAM <nidsteam () gmail com> wrote: No, but is there any dependency? These are the compile flags: ./configure \ --quiet \ --prefix=/opt/snort \ --enable-static=no \ --with-libpcap-includes=/opt/snort/include \ --with-libpcap-libraries=/opt/snort/lib \ --with-dnet-includes=/opt/snort/include \ --with-dnet-libraries=/opt/snort/lib \ --with-daq-includes=/opt/snort/include \ --with-daq-libraries=/opt/snort/lib \ --enable-reload \ --enable-reload-error-restart \ --enable-normalizer
------------------------------------------------------------------------------ Slashdot TV. Videos for Nerds. Stuff that Matters. http://pubads.g.doubleclick.net/gampad/clk?id=160591471&iu=/4140/ostg.clktrk
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- http_header not working NIDS TEAM (Sep 26)
- Re: http_header not working Shirkdog (Sep 26)
- Re: http_header not working NIDS TEAM (Sep 26)
- Re: http_header not working Stephen Gantz (Sep 26)
- Re: http_header not working NIDS TEAM (Sep 26)
- Re: http_header not working Joel Esler (jesler) (Sep 26)
- Re: http_header not working NIDS TEAM (Sep 26)
- Re: http_header not working Joel Esler (jesler) (Sep 26)
- Re: http_header not working NIDS TEAM (Sep 26)
- Re: http_header not working Joel Esler (jesler) (Sep 26)
- Re: http_header not working NIDS TEAM (Sep 29)
- Re: http_header not working waldo kitty (Sep 29)
- Re: http_header not working NIDS TEAM (Sep 26)
- Re: http_header not working Shirkdog (Sep 26)
- Re: http_header not working NIDS TEAM (Sep 29)