Re: TCP-Flags are wrong in Preprocessor

Matthias Wübbeling <[email protected]> Thu, 22 Jun 2017 17:21:15 +0200
Newsgroups	gmane.comp.security.ids.snort.devel
Message-ID	<[email protected]>
Victor,

That did the trick.

Thank you very much.
- Matthias

On 22.06.2017 13:48, Victor Roemer via Snort-devel wrote:
> In your call to |_dpd.addPreproc|, try using |PRIORITY_NETWORK|.
> 
> On 6/21/17 3:36 PM, Matthias Wübbeling wrote:
> 
>> Hi all,
>>
>> I am working on a preprocessor that evaluates TCP flags. I experience
>> some strange values for the flags provided in (SFSnortPacket*)
>> pkt->tcp_header->flags.
>>
>> I am using snort-2.9.9.0 and for the tests, I used the following pcap:
>> http://panda.gtisc.gatech.edu/malrec/pcap/ca59a9cd-3b81-4763-95c6-42292cf42798.pcap
>>
>>
>> The preprocessor evaluates the flags in the following way:
>>
>>    if( p->tcp_header->flags & TCPHEADER_CWR ){
>>      _dpd.logMsg(" CWR");
>>    }
>>    if( p->tcp_header->flags & TCPHEADER_ECE ){
>>      _dpd.logMsg(" ECE");
>>    }
>>    if( p->tcp_header->flags & TCPHEADER_URG ){
>>      _dpd.logMsg(" URG");
>>    }
>>    if( p->tcp_header->flags & TCPHEADER_ACK ){
>>      _dpd.logMsg(" ACK");
>>    }
>>    if( p->tcp_header->flags & TCPHEADER_PUSH ){
>>      _dpd.logMsg(" PSH");
>>    }
>>    if( p->tcp_header->flags & TCPHEADER_RST ){
>>      _dpd.logMsg(" RST");
>>    }
>>    if( p->tcp_header->flags & TCPHEADER_SYN ){
>>      _dpd.logMsg(" SYN");
>>    }
>>    if( p->tcp_header->flags & TCPHEADER_FIN ){
>>      _dpd.logMsg(" FIN");
>>    }
>>
>> Using the above pcap, the output for the first TCP packet is:
>>
>> ACK PSH
>>
>> Examining the first TCP packet in wireshark shows the flags as follows:
>>
>> 0x002 (SYN)
>>
>>
>> Same problem with the checksum value, which is 0xb3d4 in the PP and
>> 0x415d in wireshark.
>>
>>
>> What am I missing? Can anyone help me?
>>
>> Kind regards
>> - Matthias
>>
>>
>>
>> _______________________________________________
>> Snort-devel mailing list
>> [email protected]
>> https://lists.snort.org/mailman/listinfo/snort-devel
>>
>> Please visit http://blog.snort.org for the latest news about Snort!
> 
> 
> 
> 
> 
> _______________________________________________
> Snort-devel mailing list
> [email protected]
> https://lists.snort.org/mailman/listinfo/snort-devel
> 
> Please visit http://blog.snort.org for the latest news about Snort!
>

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!
signature.asc (application/pgp-signature, 488 B)