Re: Snort OTV Inspection

Hi Albert,

Yes of course! Please see attached the pcap file. (note: Wireshark 2.0.4 won’t recognize properly the packets, you might need Wireshark 1.12)

[cid:[email protected]]

Thanks,

Matteo

Matteo Da Pozzo

Communication Valley
Via Robert Koch, 1/4
20152 - Milano - ITALY
phone: +39 02 535761
mobile: +39 345 4954311
[email protected]<mailto:[email protected]>
www.reply.it


[Communication Valley]

From: Al Lewis (allewi) [mailto:[email protected]]
Sent: martedì 26 luglio 2016 14:05
To: Da Pozzo Matteo <[email protected]>; [email protected]
Cc: Grazzani Marco <[email protected]>
Subject: Re: [Snort-devel] Snort OTV Inspection

Can you provide a pcap of the traffic please?

Thanks.

Albert Lewis
ENGINEER.SOFTWARE ENGINEERING
SOURCEfire, Inc. now part of Cisco
Email: [email protected]<mailto:[email protected]>

From: Da Pozzo Matteo <[email protected]<mailto:[email protected]>>
Date: Tuesday, July 26, 2016 at 7:36 AM
To: "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>>
Cc: Grazzani Marco <[email protected]<mailto:[email protected]>>
Subject: [Snort-devel] Snort OTV Inspection

Hi Snort Developer community,

It’s the first time for me that I try to write on this list so I hope it is the correct way to ask this question.

I would like to know if anyone tried to inspect the payload of a OTV encapsulated packet. I tried to analyze a ICMP ECHO and REPLY encapsulated in OTV with SNORT 2.9.8 (Build 335) and it seems to not recognize ICMP in OTV. Anyone have experience on this?

Thanks!

Below posted the test output:

snort --daq-dir /usr/local/sf/lib/daq -r ICMP.ECHO.and.REPLY.over.OTV.pcap.pcapng
Running in packet dump mode

        --== Initializing Snort ==--
Initializing Output Plugins!
pcap DAQ configured to read-file.
Acquiring network traffic from "ICMP.ECHO.and.REPLY.over.OTV.pcap.pcapng".

        --== Initialization Complete ==--

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.9.8 GRE (Build 335)
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/contact#team
           Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using libpcap version 1.1.1
           Using PCRE version: 7.4 2007-09-21
           Using ZLIB version: 1.2.5

Commencing packet processing (pid=22601)
WARNING: No preprocessors configured for policy 0.
08/17-21:27:36.262536 150.1.38.3 -> 150.1.78.7
GRE TTL:254 TOS:0x0 ID:2605 IpLen:20 DgmLen:1500 DF
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

WARNING: No preprocessors configured for policy 0.
08/17-21:27:36.263098 150.1.78.7 -> 150.1.38.3
GRE TTL:253 TOS:0x0 ID:2720 IpLen:20 DgmLen:1500 DF
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

===============================================================================
Run time for packet processing was 0.1477 seconds
Snort processed 2 packets.
Snort ran for 0 days 0 hours 0 minutes 0 seconds
   Pkts/sec:            2
===============================================================================
Memory usage summary:
  Total non-mmapped bytes (arena):       786432
  Bytes in mapped regions (hblkhd):      21590016
  Total allocated space (uordblks):      711648
  Total free space (fordblks):           74784
  Topmost releasable block (keepcost):   39616
===============================================================================
Packet I/O Totals:
   Received:            2
   Analyzed:            2 (100.000%)
    Dropped:            0 (  0.000%)
   Filtered:            0 (  0.000%)
Outstanding:            0 (  0.000%)
   Injected:            0
===============================================================================
Breakdown by protocol (includes rebuilt packets):
        Eth:            2 (100.000%)
       VLAN:            0 (  0.000%)
        IP4:            2 (100.000%)
       Frag:            0 (  0.000%)
       ICMP:            0 (  0.000%)
        UDP:            0 (  0.000%)
        TCP:            0 (  0.000%)
        IP6:            0 (  0.000%)
    IP6 Ext:            0 (  0.000%)
   IP6 Opts:            0 (  0.000%)
      Frag6:            0 (  0.000%)
      ICMP6:            0 (  0.000%)
       UDP6:            0 (  0.000%)
       TCP6:            0 (  0.000%)
     Teredo:            0 (  0.000%)
    ICMP-IP:            0 (  0.000%)
    IP4/IP4:            0 (  0.000%)
    IP4/IP6:            0 (  0.000%)
    IP6/IP4:            0 (  0.000%)
    IP6/IP6:            0 (  0.000%)
        GRE:            2 (100.000%)
    GRE Eth:            0 (  0.000%)
   GRE VLAN:            0 (  0.000%)
    GRE IP4:            0 (  0.000%)
    GRE IP6:            0 (  0.000%)
GRE IP6 Ext:            0 (  0.000%)
   GRE PPTP:            0 (  0.000%)
    GRE ARP:            0 (  0.000%)
    GRE IPX:            0 (  0.000%)
   GRE Loop:            0 (  0.000%)
       MPLS:            0 (  0.000%)
        ARP:            0 (  0.000%)
        IPX:            0 (  0.000%)
   Eth Loop:            0 (  0.000%)
   Eth Disc:            0 (  0.000%)
   IP4 Disc:            0 (  0.000%)
   IP6 Disc:            0 (  0.000%)
   TCP Disc:            0 (  0.000%)
   UDP Disc:            0 (  0.000%)
  ICMP Disc:            0 (  0.000%)
All Discard:            0 (  0.000%)
      Other:            2 (100.000%)
Bad Chk Sum:            0 (  0.000%)
    Bad TTL:            0 (  0.000%)
     S5 G 1:            0 (  0.000%)
     S5 G 2:            0 (  0.000%)
      Total:            2
===============================================================================
Snort exiting

Thanks,

Matteo

Matteo Da Pozzo

Communication Valley
Via Robert Koch, 1/4
20152 - Milano - ITALY
phone: +39 02 535761
mobile: +39 345 4954311
[email protected]<mailto:[email protected]>
www.reply.it


[Communication Valley]


________________________________

--
The information transmitted is intended for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer.

________________________________

--
The information transmitted is intended for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer.

------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are 
consuming the most bandwidth. Provides multi-vendor support for NetFlow, 
J-Flow, sFlow and other flows. Make informed decisions using capacity planning
reports.http://sdm.link/zohodev2dev

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!