Snort 3 file statistics and logging
Y M via Snort-devel <[email protected]> Fri, 27 Sep 2019 17:54:47 +0000
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <MN2PR17MB3360795922101F5B051B201AA8810@MN2PR17MB3360.namprd17.prod.outlook.com> |
--===============2892525499264221549==
Content-Language: en-US
Content-Type: multipart/alternative;
boundary="_000_MN2PR17MB3360795922101F5B051B201AA8810MN2PR17MB3360namp_"
--_000_MN2PR17MB3360795922101F5B051B201AA8810MN2PR17MB3360namp_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Hello,
Two odd behaviors are observed regarding file inspector statistics in snort=
output and logging via file logger.
First, from the below file statistics, file type stats (files) reflect the =
detected files, which is correct. The file type stats (bytes) is reporting =
zero bytes for some files, although the files have completed the transfers =
and exist in the inspected pcap.
--------------------------------------------------
File Statistics
--------------------------------------------------
file type stats (files)
Type Download Upload
MSEXE( 21) 3 0
RTF( 23) 0 3
ZIP( 29) 1 1
PDF(287) 2 1
Total 6 5
--------------------------------------------------
file type stats (bytes)
Type Download Upload
MSEXE( 21) 2593303 0
RTF( 23) 0 0
ZIP( 29) 0 0
PDF(287) 465066 232533
Total 3058369 232533
--------------------------------------------------
Second, it appears that file logging for a PDF file policy does not create =
a line for detected PDF files. Different PDF files also don't get logged al=
though they are detected. Other file types/policies over the same protocols=
get logged as expected. Example file policy:
file_id =3D
{
file_rules =3D file_magic,
file_policy =3D
{
{ when =3D { file_type_id =3D 22 }, use =3D { verdict =3D 'log', en=
able_file_signature =3D true } },
{ when =3D { file_type_id =3D 29 }, use =3D { verdict =3D 'log', en=
able_file_signature =3D true } },
{ when =3D { sha256 =3D "omitted" }, use =3D { verdict =3D 'log' } =
}
}
}
file_log =3D
{
log_pkt_time =3D true,
log_sys_time =3D false
}
The expected log lines in file.log from the above policies:
1. Log PDF files when detected.
2. Log ZIP files when detected.
3. Log the file with the specified hash.
In the above example, everything gets logged except for PDF files.
Below are the file statistics.
--------------------------------------------------
File Statistics
--------------------------------------------------
file type stats (files)
Type Download Upload
MSEXE( 21) 1 0
PDF(287) 1 1
Total 2 1
--------------------------------------------------
file type stats (bytes)
Type Download Upload
MSEXE( 21) 1123608 0
PDF(287) 232533 232533
Total 1356141 232533
--------------------------------------------------
file signature stats
Type Download Upload
MSEXE( 21) 1 0
PDF(287) 1 1
Total 2 1
This used to work on earlier versions of Snort 3. Running Snort with --warn=
-all does not yield and warnings associated with the file inspector. The co=
mmand used to run Snort:
snort -c snort.lua -r test.pcap -l /var/log/snort --plugin-path /usr/local/=
snort/extra -k none
And Snort version is 3.0.0 (Build 261)
Thank you.
--_000_MN2PR17MB3360795922101F5B051B201AA8810MN2PR17MB3360namp_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<span style=3D"font-size: 11pt;">Hello,</span></div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<span style=3D"font-size: 11pt;"><br>
</span></div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<span style=3D"font-size: 11pt;">Two odd behaviors are observed regarding f=
ile inspector statistics in snort output and logging via file logger.</span=
></div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<span style=3D"font-size: 11pt;"><br>
</span></div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<span style=3D"font-size: 11pt;">First, from the below file statistics, fil=
e type stats (files) reflect the detected files, which is correct. The file=
type stats (bytes) is reporting zero bytes for some files, although the fi=
les have completed the transfers and
exist in the inspected pcap.</span></div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<span style=3D"font-size: 11pt;"><br>
</span></div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<span style=3D"font-size: 11pt;"><span style=3D"font-size: 10pt; font-famil=
y: Consolas, Courier, monospace;">-----------------------------------------=
---------</span><span><br>
</span>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;">File Statistics</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;">--------------------------------------------------</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;">file type stats (files)</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> Type &n=
bsp; Download Upload
</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> MSEXE( 21) &nb=
sp;3 0 =
</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> RTF( 23)  =
; 0 3 &=
nbsp;</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> ZIP( 29)  =
; 1 1 &=
nbsp;</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> PDF(287)  =
; 2 1 &=
nbsp;</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> Total =
6 5 &nb=
sp; </span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;">--------------------------------------------------</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;">file type stats (bytes)</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> Type &n=
bsp; Download Upload
</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> MSEXE( 21) &nb=
sp;2593303 0 </span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> RTF( 23)  =
; 0 0 &=
nbsp;</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> ZIP( 29)  =
; 0 0 &=
nbsp;</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> PDF(287)  =
; 465066 232533
</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> Total =
3058369 232533
</span><br>
</div>
<span style=3D"font-size: 10pt; font-family: Consolas, Courier, monospace;"=
>--------------------------------------------------</span><br>
</span></div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; color: rgb(0, 0,=
0);"><span style=3D"font-size: 14.6667px;">Second, i</span><span style=3D"=
color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif; font-size=
: 14.6667px;">t appears that file logging
for a PDF file policy does not create a line for detected PDF files. Diffe=
rent PDF files also don't get logged although they are detected.
<span style=3D"font-family: Calibri, Helvetica, sans-serif;">Other file typ=
es/policies over the same protocols get logged as expected</span>.</span><s=
pan style=3D"color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-ser=
if; font-size: 11pt;"> Example file
policy:</span></div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<span style=3D"font-size: 10pt; font-family: Consolas, Courier, monospace;"=
>file_id =3D</span><span><br>
</span>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;">{</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> file_rules =3D file_magic,</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> file_policy =3D</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> {</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> { when =3D { file_type_id =3D 22 }, use =
=3D { verdict =3D 'log', enable_file_signature =3D true } },</span></div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"><span style=3D"font-family: Consolas, Courier, monospace; background-=
color: rgb(255, 255, 255); display: inline !important"> =
{ when =3D { file_type_id =3D 29 }, use =3D { verdict
=3D 'log', enable_file_signature =3D true } },</span><br>
</span></div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> { when =3D { sha256 =3D "omitted&quo=
t; }, use =3D { verdict =3D 'log' } }</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> }</span><br>
</div>
<span style=3D"font-size: 10pt; font-family: Consolas, Courier, monospace;"=
>}</span><br>
</div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<span><br>
</span></div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<span><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monos=
pace;">file_log =3D</span><span><br>
</span>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;">{</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> log_pkt_time =3D true,</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> log_sys_time =3D false</span><br>
</div>
<span style=3D"font-size: 10pt; font-family: Consolas, Courier, monospace;"=
>}</span><br>
</span></div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<span><br>
</span></div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<span style=3D"font-size: 11pt;">The expected log lines in file.log from th=
e above policies:</span></div>
<div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;=
color: rgb(0, 0, 0);">
<ol>
<li><span style=3D"font-size: 11pt;">Log PDF files when detected.</span></l=
i><li><span style=3D"font-size: 11pt;">Log ZIP files when detected.</span><=
/li><li><span style=3D"font-size: 11pt;">Log the file with the specified ha=
sh.</span></li></ol>
<div><span style=3D"font-size: 11pt;">In the above example, everything gets=
logged except for PDF files.</span></div>
<div><span style=3D"font-size: 11pt;"><br>
</span></div>
<div><span style=3D"font-size: 11pt;">Below are the file statistics.</span>=
</div>
<div><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;">--------------------------------------------------</span><span><br>
</span>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;">File Statistics</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;">--------------------------------------------------</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;">file type stats (files)</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> Type &n=
bsp; Download Upload
</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> MSEXE( 21) &nb=
sp;1 0 =
</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> PDF(287)  =
; 1 1 &=
nbsp;</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> Total =
2 1 &nb=
sp; </span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;">--------------------------------------------------</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;">file type stats (bytes)</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> Type &n=
bsp; Download Upload
</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> MSEXE( 21) &nb=
sp;1123608 0 </span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> PDF(287)  =
; 232533 232533
</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> Total =
1356141 232533
</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;">--------------------------------------------------</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;">file signature stats</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> Type &n=
bsp; Download Upload
</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> MSEXE( 21) &nb=
sp;1 0 =
</span><br>
</div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;"> PDF(287)  =
; 1 1 &=
nbsp;</span><br>
</div>
<span style=3D"font-size: 10pt; font-family: Consolas, Courier, monospace;"=
> Total  =
; 2 1</span><br>
</div>
<div><span style=3D"font-size: 11pt;"><br>
</span></div>
<div><span style=3D"font-size: 11pt;">This used to work on earlier versions=
of Snort 3. Running Snort with --warn-all does not yield and warnings asso=
ciated with the file inspector. The command used to run Snort:</span><br>
</div>
<div><span><br>
</span></div>
<div><span style=3D"font-size: 10pt; font-family: Consolas, Courier, monosp=
ace;">snort -c snort.lua </span><span style=3D"font-size: 10pt; font-f=
amily: Consolas, Courier, monospace;">-r test.pcap -l /var/log/snort --plug=
in-path /usr/local/snort/extra -k none</span></div>
<div><br>
</div>
<div><span style=3D"font-size: 11pt;">And Snort version is </span><spa=
n style=3D"font-size: 11pt;">3.0.0 (Build 261)</span></div>
<div><br>
</div>
<div><span style=3D"font-size: 11pt;">Thank you.</span></div>
<span></span></div>
</body>
</html>
--_000_MN2PR17MB3360795922101F5B051B201AA8810MN2PR17MB3360namp_--
--===============2892525499264221549==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel
Please visit http://blog.snort.org for the latest news about Snort!
--===============2892525499264221549==--