Re: Snort 3 netmap cant access gateway on FREEBSD
[email protected] Sat, 03 Nov 2018 10:53:04 +0300
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <[email protected]> |
hi snort output added email attachment 02.11.2018, 18:51, "Masud Hasan (mashasan)" <[email protected]>: Hi, Would you kindly provide Snort shutdown stats to find what shows during exit. On Nov 1, 2018, at 5:35 AM, [email protected] wrote: hello; We removed lro/gro and enable promiscuous mode and running snort em1:em2 inline mode with daq netmap then All traffic breaking down to Gateway example; ping, ssh, internet connection cant access (em1 connected computer(192.168.1.12)) ----> 192.168.1.1 (gateway) and cant access (em2 connected different computer(192.168.2.45)) ---> 192.168.2.1 (gateway) we have problem but I cant find :S FreeBSD Version : FreeBSD snort.test 11.2-RELEASE-p4 Snort Version : Version 3.0.0 (Build 247) FreeBSD 31.10.2018, 18:53, "Masud Hasan (mashasan)" <[email protected] >: Please turn promiscuous mode on and LRO/GRO off for both of the interface-pair (em1 and em2) as root. Before running snort, please make sure you can reach any machine on the LAN where em2 is connected. After running snort with em1:em2 inlined, you should be able to reach that LAN from the LAN where em1 is connected. You can also enable debug adding "--daq-var debug" to the snort command and adding rc_debug="YES" in the rc.conf file. If netmap does not work, do other daq mode works? Here is an example for Ubuntu: http://sublimerobots.com/2016/02/snort-ips-inline-mode-on-ubuntu/ Also, are you on latest FreeBSD with updated netmap, since I find some online forums discussing issues with older netmap builds. Thanks, Masud On Oct 31, 2018, at 5:58 AM, [email protected] wrote: Hello; We are reagain install snort netmap mode. because ipfw mode not yet supported multithreading rc.conf ----> network configuration ifconfig_em0="DHCP" ---->internet uplink subnet -> (192.168.254.1/24) dhcp lease ifconfig_em1="inet 192.168.1.1 netmask 255.255.255.0" ifconfig_em2="inet 192.168.2.1 netmask 255.255.255.0" I was start command this : ifconfig em1 promisc up /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua --daq-dir /usr/local/lib/daq --daq netmap -i em1 -A alert_full -Q See a Error : netmap DAQ configured to inline. Commencing packet processing ++ [0] em1 Can't initialize DAQ netmap (-1) - netmap_daq_initialize: Invalid interface specification: 'em1'! -- [0] em1 -------------------------------------------------- Packet Statistics -------------------------------------------------- Module Statistics -------------------------------------------------- Summary Statistics -------------------------------------------------- timing runtime: 00:00:00 seconds: 0.1822 packets: 0 pkts/sec: 0 o")~ Snort exiting AND reagain diffrerent start multiple interface command this ifconfig em1 promisc up /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua --daq-dir /usr/local/lib/daq --daq netmap -i em1:em2 -A alert_full -Q I was see this success start message : port rule counts tcp udp icmp ip any 472 0 1 0 total 472 0 1 0 -------------------------------------------------- netmap DAQ configured to inline. Commencing packet processing ++ [0] em1:em2 [em2] nr_tx_slots: 1024 nr_rx_slots: 1024 nr_tx_rings: 1 [TX Ring 0] buf_ofs = 7299072 num_slots = 1024 nr_buf_size = 2048 flags = 0x0 nr_rx_rings: 1 [RX Ring 0] buf_ofs = 7372800 num_slots = 1024 nr_buf_size = 2048 flags = 0x0 memsize: 343019520 index: 1 BUT I cant access gateway ip address 64 bytes from 192.168.1.1: icmp_seq=6157 ttl=64 time=0.264 ms 64 bytes from 192.168.1.1: icmp_seq=6158 ttl=64 time=0.233 ms 64 bytes from 192.168.1.1: icmp_seq=6159 ttl=64 time=0.325 ms 64 bytes from 192.168.1.1: icmp_seq=6160 ttl=64 time=0.394 ms 64 bytes from 192.168.1.1: icmp_seq=6161 ttl=64 time=0.354 ms 64 bytes from 192.168.1.1: icmp_seq=6162 ttl=64 time=0.326 ms 64 bytes from 192.168.1.1: icmp_seq=6163 ttl=64 time=0.332 ms 64 bytes from 192.168.1.1: icmp_seq=6164 ttl=64 time=0.221 ms 64 bytes from 192.168.1.1: icmp_seq=6165 ttl=64 time=0.339 ms 64 bytes from 192.168.1.1: icmp_seq=6166 ttl=64 time=0.343 ms 64 bytes from 192.168.1.1: icmp_seq=6167 ttl=64 time=0.398 ms 64 bytes from 192.168.1.1: icmp_seq=6168 ttl=64 time=0.435 ms 64 bytes from 192.168.1.1: icmp_seq=6169 ttl=64 time=0.410 ms 64 bytes from 192.168.1.1: icmp_seq=6170 ttl=64 time=0.410 ms 64 bytes from 192.168.1.1: icmp_seq=6171 ttl=64 time=0.383 ms 64 bytes from 192.168.1.1: icmp_seq=6172 ttl=64 time=0.380 ms 64 bytes from 192.168.1.1: icmp_seq=6173 ttl=64 time=0.313 ms 64 bytes from 192.168.1.1: icmp_seq=6174 ttl=64 time=0.369 ms ---> started snort inline netmap module Request timeout for icmp_seq 6175 Request timeout for icmp_seq 6176 Request timeout for icmp_seq 6177 Request timeout for icmp_seq 6178 Request timeout for icmp_seq 6179 Request timeout for icmp_seq 6180 Request timeout for icmp_seq 6181 Freebsd Versions : FreeBSD snort 11.2-RELEASE-p4 Snort Versions : ,,_ -*> Snort++ <*- o" )~ Version 3.0.0 (Build 247) FreeBSD '''' By Martin Roesch & The Snort Team http://snort.org/contact#team Copyright (C) 2014-2018 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using DAQ version 2.2.2 Using LuaJIT version 2.0.5 Using OpenSSL 1.0.2p 14 Aug 2018 Using libpcap version 1.9.0-PRE-GIT Using PCRE version 8.41 2017-07-05 Using ZLIB version 1.2.11 Using FlatBuffers 1.8.0 Using Hyperscan version 4.7.0 2018-10-03 Using LZMA version 5.2.3 I was read this link https://github.com/snort3/snort3/blob/master/doc/snort_manual.html ---> 20.13.8. Netmap Module The netmap project is a framework for very high speed packet I/O. It is available on both FreeBSD and Linux with varying amounts of preparatory setup required. Specific notes for each follow. ./snort --daq netmap -i <device> [--daq-var debug] If you want to run netmap in inline mode, you must craft the device string as one or more interface pairs, where each member of a pair is separated by a single colon and each pair is separated by a double colon like this: em1:em2 or this: em1:em2::em3:em4 Inline operation performs Layer 2 forwarding with no MAC filtering, akin to the AFPacket module’s behavior. All packets received on one interface in an inline pair will be forwarded out the other interface unless dropped by the reader and vice versa. Important The interfaces will need to be up and in promiscuous mode in order to function (ifconfig em1 up promisc). The DAQ module does not currently do either of these configuration steps for itself. 20.13.8.1. FreeBSD In FreeBSD 10.0, netmap has been integrated into the core OS. In order to use it, you must recompile your kernel with the line device netmap added to your kernel config. I searched google but I cant find enough subject for netmap with snort What is my problem ? Can u help me ? _______________________________________________ Snort-devel mailing list [email protected] https://lists.snort.org/mailman/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort! _______________________________________________ Snort-devel mailing list [email protected] https://lists.snort.org/mailman/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort!
snort output.txt
(text/plain, 3.8 KB)
--------------------------------------------------
o")~ Snort++ 3.0.0-247
--------------------------------------------------
Loading /usr/local/snort/etc/snort/snort.lua:
ssh
pop
binder
stream_tcp
gtp_inspect
dce_http_proxy
stream_icmp
normalizer
ftp_server
stream_udp
search_engine
dce_smb
file_log
daq
ips
rpc_decode
modbus
latency
wizard
reputation
Processing blacklist file /usr/local/snort/etc/snort/../../intel/ip-blacklist
Reputation entries loaded: 1382, invalid: 0, re-defined: 0 (from file /usr/local/snort/etc/snort/../../intel/ip-blacklist)
Processing whitelist file /usr/local/snort/etc/snort/../../intel/ip-whitelist
Reputation entries loaded: 0, invalid: 0, re-defined: 0 (from file /usr/local/snort/etc/snort/../../intel/ip-whitelist)
appid
file_id
ftp_data
smtp
back_orifice
port_scan
dce_http_server
dce_tcp
telnet
ssl
sip
classifications
http2_inspect
http_inspect
stream_user
stream_ip
dnp3
ftp_client
stream
references
arp_spoof
dns
dce_udp
imap
stream_file
Finished /usr/local/snort/etc/snort/snort.lua.
Loading builtin:
Finished builtin.
Loading rules:
Loading /usr/local/snort/etc/snort/../../rules/local.rules:
Finished /usr/local/snort/etc/snort/../../rules/local.rules.
Finished rules.
--------------------------------------------------
rule counts
total rules loaded: 473
text rules: 2
builtin rules: 471
option chains: 473
chain headers: 2
--------------------------------------------------
port rule counts
tcp udp icmp ip
any 472 0 1 0
total 472 0 1 0
--------------------------------------------------
netmap DAQ configured to inline.
Commencing packet processing
++ [0] em1:em2
[em2]
nr_tx_slots: 1024
nr_rx_slots: 1024
nr_tx_rings: 1
[TX Ring 0]
buf_ofs = 7299072
num_slots = 1024
nr_buf_size = 2048
flags = 0x0
nr_rx_rings: 1
[RX Ring 0]
buf_ofs = 7372800
num_slots = 1024
nr_buf_size = 2048
flags = 0x0
memsize: 343019520
index: 1
[em1]
nr_tx_slots: 1024
nr_rx_slots: 1024
nr_tx_rings: 1
[TX Ring 0]
buf_ofs = 7151616
num_slots = 1024
nr_buf_size = 2048
flags = 0x0
nr_rx_rings: 1
[RX Ring 0]
buf_ofs = 7225344
num_slots = 1024
nr_buf_size = 2048
flags = 0x0
memsize: 343019520
index: 0
** caught int signal
== stopping
Netmap instance em2 (1) blocked 0 times on TX while forwarding.
Netmap instance em1 (0) blocked 0 times on TX while forwarding.
-- [0] em1:em2
--------------------------------------------------
Packet Statistics
--------------------------------------------------
daq
received: 16
analyzed: 16
allow: 16
idle: 13
rx_bytes: 960
--------------------------------------------------
codec
total: 16 (100.000%)
arp: 16 (100.000%)
eth: 16 (100.000%)
--------------------------------------------------
Module Statistics
--------------------------------------------------
detection
analyzed: 16
--------------------------------------------------
arp_spoof
packets: 16
--------------------------------------------------
latency
total_packets: 16
total_usecs: 145
max_usecs: 12
--------------------------------------------------
Summary Statistics
--------------------------------------------------
process
signals: 1
--------------------------------------------------
timing
runtime: 00:00:19
seconds: 19.989106
packets: 16
pkts/sec: 0
o")~ Snort exiting