Re: Snort 3 file statistics and logging
Y M via Snort-devel <[email protected]> Fri, 27 Sep 2019 21:23:54 +0000
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <MN2PR17MB3360D2635A3134A8C31A1A32A8810@MN2PR17MB3360.namprd17.prod.outlook.com> |
--===============2067906206655552168== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_MN2PR17MB3360D2635A3134A8C31A1A32A8810MN2PR17MB3360namp_" --_000_MN2PR17MB3360D2635A3134A8C31A1A32A8810MN2PR17MB3360namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Thank you, Steven. I certainly didn=92t pay attention to type id 287. This = one worked as opposed to type id 22. I wonder why would one log while the o= ther doesn=92t although both successfully apply. More reading for me on the trace options. I haven=92t used these before. Ar= e these considered day-to-day use or only for debugging? Thanks a bunch. YM ________________________________ From: Steven Baigal (sbaigal) <[email protected]> Sent: Friday, September 27, 2019 11:33 PM To: Y M; [email protected] Subject: Re: [Snort-devel] Snort 3 file statistics and logging For the second issue, you need to add policy for PDF: { when =3D { file_type_id =3D 287 }, use =3D { verdict =3D 'log', } }, Regarding the 0 bytes stats, try to remove the policy and add trace to file= _id: file_id =3D { enable_type =3D true, enable_signature =3D true, file_rules =3D file_magic, trace_type =3D true, trace_signature =3D true, trace_stream =3D true, } Steven B. From: Snort-devel <[email protected]> on behalf of Y M vi= a Snort-devel <[email protected]> Reply-To: Y M <[email protected]> Date: Friday, September 27, 2019 at 1:56 PM To: "[email protected]" <[email protected]> Subject: [Snort-devel] Snort 3 file statistics and logging Hello, Two odd behaviors are observed regarding file inspector statistics in snort= output and logging via file logger. First, from the below file statistics, file type stats (files) reflect the = detected files, which is correct. The file type stats (bytes) is reporting = zero bytes for some files, although the files have completed the transfers = and exist in the inspected pcap. -------------------------------------------------- File Statistics -------------------------------------------------- file type stats (files) Type Download Upload MSEXE( 21) 3 0 RTF( 23) 0 3 ZIP( 29) 1 1 PDF(287) 2 1 Total 6 5 -------------------------------------------------- file type stats (bytes) Type Download Upload MSEXE( 21) 2593303 0 RTF( 23) 0 0 ZIP( 29) 0 0 PDF(287) 465066 232533 Total 3058369 232533 -------------------------------------------------- Second, it appears that file logging for a PDF file policy does not create = a line for detected PDF files. Different PDF files also don't get logged al= though they are detected. Other file types/policies over the same protocols= get logged as expected. Example file policy: file_id =3D { file_rules =3D file_magic, file_policy =3D { { when =3D { file_type_id =3D 22 }, use =3D { verdict =3D 'log', en= able_file_signature =3D true } }, { when =3D { file_type_id =3D 29 }, use =3D { verdict =3D 'log', en= able_file_signature =3D true } }, { when =3D { sha256 =3D "omitted" }, use =3D { verdict =3D 'log' } = } } } file_log =3D { log_pkt_time =3D true, log_sys_time =3D false } The expected log lines in file.log from the above policies: 1. Log PDF files when detected. 2. Log ZIP files when detected. 3. Log the file with the specified hash. In the above example, everything gets logged except for PDF files. Below are the file statistics. -------------------------------------------------- File Statistics -------------------------------------------------- file type stats (files) Type Download Upload MSEXE( 21) 1 0 PDF(287) 1 1 Total 2 1 -------------------------------------------------- file type stats (bytes) Type Download Upload MSEXE( 21) 1123608 0 PDF(287) 232533 232533 Total 1356141 232533 -------------------------------------------------- file signature stats Type Download Upload MSEXE( 21) 1 0 PDF(287) 1 1 Total 2 1 This used to work on earlier versions of Snort 3. Running Snort with --warn= -all does not yield and warnings associated with the file inspector. The co= mmand used to run Snort: snort -c snort.lua -r test.pcap -l /var/log/snort --plugin-path /usr/local/= snort/extra -k none And Snort version is 3.0.0 (Build 261) Thank you. --_000_MN2PR17MB3360D2635A3134A8C31A1A32A8810MN2PR17MB3360namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable <html dir=3D"ltr"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1= 252"> <style id=3D"ms-outlook-ios-style" type=3D"text/css">html { background-color: transparent !important; } body { background-color: transparent !important; color: #333; line-height: 150%; font-family: "-apple-system", "HelveticaNeue"; margin: 0; } *:focus { outline: none; } .ms-outlook-ios-reference-expand { display: block; color: #999; padding: 20px 0px; text-decoration: none; } .ms-outlook-ios-availability-container { max-width: 500px; margin: auto; padding: 12px 15px 15px 15px; border: 1px solid #C7E0F4; border-radius: 4px; } .ms-outlook-ios-availability-container > .ms-outlook-ios-availability-delet= e-button { width: 25px; height: 25px; right: -12px; top: -12px; background-image: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEgAAA= BICAYAAABV7bNHAAAAAXNSR0IArs4c6QAACeVJREFUeAHtnMuPHcUVxmveY/CMX7IxDoo8RjAIg= YhNVpFlEKCgbOMkigRCAoHEBhaIBfAHGBagSLBBAhEJsUBJzDZyBCiMElYByyGLmCiMEyFjbAbb= MwbmPXy/dp+eunfqdlf3fcxg3086U7erq0+d+u6p09Vd506P6yBWVlZ61d1+yR2S8VTGVI5KRlJ= R4WZSmVY5KTmZygmVx3t6epZVdgQ97e5FpOxRH4cl90rukmyVNIMLuvgDyXuSoyLrdDPK1uVakT= IseUByTLIkaRfQTR/0Nbwugy3TqYzcLHla8oWk06BP+t5cxuaOtJVR/ZKnJF9J1hvYgC39HRl8U= Scy5KDkn5KNBmw6WGR/286r80HJy5JlyUYFtmHjYFUiKt3F1OE+dfgHyZ1VO+7wdR+pv9/ojvdZ= 2X5LEyRy7lEn70i2lO1sndtfVP+/FEnvl7GjFEEi59dS/pakssti3HcLK256dsl9u7DsZiVzSyt= uaRnhrHN9Wk729fa4ob4eNzzQ666RjA73uU0Dpcy9rKz277wOHxRJf6ytbnwU3aPIeUxqXpWwGi= 6Nmblld+7Sojv/3aJbECFVMCDCtm3qdzs397uRoUpm0C1fw+Mi6bUYG6IISj3nbSksbdXUt0vu8= wvz8prUPWKsimizSV51w9ZBt+OavojWa5pgzG9jPKmQoDTm/FkKS02raXnM/8/Pu0tzS2us69X0= 2aopY9NmuL83mVJMLcBUY8rNLi5n0/GCpuSy6uqxeajP/XjboBst71FMt18UxaRcgkTOPin5WBI= dkOcWV9ypr+eTqeQPpl/TY7umxzZ941tEjjgqBbi5KJLOyyO/1jRdrJumTL292wfdUH8pxQTuAy= Lps0bGNNQmcvCYDyXRt3K85j/nZmtiDMH2+tEBt0dSlpRGRkPW6ekF94UETzMQo27aOVzWm1gC/= Ewk4VFrkEfQy2r9xJorGlScVQDGc7QyS1qoQ7dLwfSGLQMOw9sBgv3nFxccfesLTbroVb94En2X= wCuy98lQ+6Dl6owl+oQkeL5e0SnFmjP6Ng2DiinjO4fctYOlY7qpKFV+M7/sTp6bc/OKWYbd8ti= 9ik2RgN1DIulv9e3XECByoJ64c3t949BxPTkjCpo3i5x2eU3IBurwpk9F0ox3UyhJ0idSQzxa9P= sIfcW4WhQ5uLbvOaxPbt093HFyGBBfCH1jgwHbsDESjHnNNKvxIHkP71L+J9lepJSA/O8vZ7OYg= 2E37hgquqwj5/87NZcsSumMmHTLddGBe0qX7JUXXTJD6z3ocZ0oJIdbOXcrC8hMq30bhBwGhi3Y= BLARW7E5AjvUBg4yZB4k7+GV5aRkd3a2wYeTZ+eydQ4B+fZ1mlYNzEuqiUmfnJnNAjfrpPFdUR5= +RgrG5EWzKPI96LCOC8lhavE8BaQkuVt1OiAnnRf8wSbupNgIsBnbIwAHcJHAJ+ghq8wreXwwsN= bo1K3c+ixTYpu/HvJtL9CTcZEQpOm1RxfcV3CR48HTnq1YIbMILMLv/j7lfvT8p+7ZY2ddVBQoU= IgOdKET3UXARmwF2M4YInBfykk2xX6li3xvCurgqdzA40PM1HpxYip5LHjhr+fco0dPN0US5KAD= XTxqoLsI2IitBn8MVhco4SKZZkYKm3q54H2OvbLgwZNnqxg8dGB1n/CNf5yvTJKRgw6Dr9vqQiU= EYTNgDIwlAgknvXIlSDpUdAEvuww8lcc+eB65f5d75Kfb7FJXhaQQOehEdwzgBpsN/lisLlDeBT= eQs1+y+jUHWlJldy4+88oiFnxvrx/eU5mkRuSg87JPxFni2+yPJedqONkPQSQS5IJ3yPaalJddv= M8pg6oktYocbE3eQaVuz1gYUwTugCCyLHLBC3YDbwJjp5ddQ1mWpFaSQ//YjO0Gf0xWFyjHowhi= 98HAa9KqiCWp1eSYvb7t/pjsfKAcJ3KNBU7UVLE1Y2h268VIQp/dkawkrgBu5VbHMQG5bMzhunr= 4tvtjqm/nHY9B0KhXEfzoP+jxgr1ZNCLJosLvvVt5q8jBZt92f0w54xmFoJGcBskpJeFkTWxVml= VU/BAiyScGta0kB32+7f6YONcAI7hDMUGrM0ydNFBVodpIethbJ5ka6loxrUwfpW+77eL65wOfE= 4IC9d0qYwB/mLGDRmUF5hupqqm3u1X91KIRdc0+u9V0pgPfa/wx1bfzjmfiCErfqXChvw/lKSr9= 0cjx71ZMK3+6ca6VJPm2+/Eox/gZgjSptrlgt3I2fRRjO3iov/paiI5C5FhA5jyxyYizshXxCNs= NZI5EYBoPmixqSAqKIXKJbs3XlHnkYLIFbggztMqTfNv9MVk/gXKSkZOknQvycwyRS3RrXlMWkW= ON20WSb7s/Jus3UJ6MIshfoidZFoy0JGLJMbWtJoktfGw3+GOyukCZEHQicKKmiiW6vT0kBYUsi= zIoS47pbiVJ2GzpM4zFf+yw/gLlCTzouIT0/lywbWIgBSUWVckx/a0iybfZH4v1Eyjh5Lg2HpMf= hkwEGtRU+Vu65Od4WSc17eoPntMLdrsTcc7uVgw8Fo1IQncMsBWbDf5YrC5QfgA3Fn3fCzSoqSI= nkLQ3QPISL81j8ObHq85ZhRzrI0SSr9vahUpstYQrxhCZ35hwYgT9SYpXFwmhXlRHTqCB5CV7y2= h1ofLpQzuSF/zP3L2z6WcrIwldbBqguwjYiK0GfwxWFyjh4ij1mafrBfUxHf+cyjz8S9u5tjd23= ciAG1Oy0kbGpJK6vpy5TBD5jLdpmzwCf9H0up925kF8fpM/RSBh0kBqCclLGxXY5qe/+LYX2Jxx= 4ROES7FxnwuySe0uIK9LMrtiplqu0jacxCayzrARYHNkJiwcJNOL6zKC5FJkM7xEZRHIAbR1EWl= vZHZdNqPoys6cxxZsspQ8bMXmSLyUcpE0z2IQR2KbBKpTksLod1UmUIk5MquOSAqBu/rfCruVZH= atpyfRt59dxiCwMXJq0fxIygGfE9R4EDXyIpbM3STOhB7vNp8eJ4VIOqgPE5I1BPrt7HN9pusVn= QZsgxZJ3UTyPA8RQYT9DyV3GmlFJYH7qvkpAmSIpH0qiEfdH7NASAgi6R7Vd38OFSLH6kQSP8V8= W5ItLO1cUXnF/6DOCBBJ3Z9kGhmNytST3tL56HV7SBe7C7xAz37Uqyx49sptY49NPfatflA/6rW= BpjHpHR1HB267dp3Li+q/9M/CS8cULcXfV0cHJB+t84DLdI+t/NQJ2zsDedJV8a8pmmZTRHX/uU= kRiyKp++9xikjivIjq/oOlSKKumH/RFfU6I4aURm3kVaSu8mOZeyWHJGSwNwM22iYk70ra/k/e2= k6Qz4TIIrHoJxKy+0lgR8YkZNqOpKJi4/ybwO8BdPFbSx34AtIAAAAASUVORK5CYII=3D"); background-size: 25px 25px; background-position: center; } #ms-outlook-ios-main-container { margin: 0 0 0 0; margin-top: 120; padding: 8; } #ms-outlook-ios-content-container { padding: 0; padding-top: 12; padding-bottom: 20; } .ms-outlook-ios-mention { color: #333; background-color: #f1f1f1; border-radius: 4px; padding: 0 2px 0 2px; pointer-events: none; text-decoration: none; } .ms-outlook-ios-mention-external { color: #ba8f0d; background-color: #fdf7e7; } .ms-outlook-ios-mention-external-clear-design { color: #ba8f0d; background-color: #f1f1f1; }</style><style id=3D"ms-outlook-ios-dark-mode-style" type=3D"text/css">.ms= -outlook-ios-dark-mode { color: #E1E1E1 !important; } .ms-outlook-ios-dark-mode .ms-outlook-ios-reference-expand { color: #777777 !important; } .ms-outlook-ios-dark-mode a:not([class]) { color: #0086F0; } .ms-outlook-ios-dark-mode font[color=3D"#000000"] { color: #E1E1E1 !important; } .ms-outlook-ios-dark-mode .ms-outlook-ios-availability-container { border-color: #303030 !important; } .ms-outlook-ios-dark-mode .ms-outlook-ios-availability-container > table > = tbody > tr > td:nth-child(1) > table:nth-child(1) > tbody > tr:nth-child(1)= > td:nth-child(2) { color: #0086F0; } .ms-outlook-ios-dark-mode .ms-outlook-ios-availability-container .ms-outloo= k-ios-availability-timeslot-container { background-color: #0086F0 !important; color: #000000 !important; } .ms-outlook-ios-dark-mode .ms-outlook-ios-availability-container .ms-outloo= k-ios-availability-border { border-top: 1px solid #0086F0 !important; } .ms-outlook-ios-dark-mode .ms-outlook-ios-availability-container > .ms-outl= ook-ios-availability-delete-button { background-image: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEgAAA= BICAYAAABV7bNHAAAAAXNSR0IArs4c6QAAC/FJREFUeAHtnF2MVVcVxw9z+RhgZhgY6GgTzIwvm= IBRWoMJNpRIg1Yf6kdH+6BNNDYQQ4yG+NAHE+KLD4Y0sQQx+lRJbDTURBNMm1JoQ1pFUZuCCQ9W= LInlm2EGGBiYGf+/M3fdu++Zfc7Z59x7h6FhJWf22V9rr/0/a6299r7nzLxoFmnXrl0de/bsWT9= v3rxPTE1NrdHQa3Q/qLRHV7fKuhFHZaNKuEZU9h+lp1R2Svdv79ix4x/iM6myWaF57R5l9erVD9= 68efOrmtwWjfWort4mxxxW/9cF2KHOzs4DZ86c+V+T/DK7twWggYGBzhs3bgDK07oekwQdmVKUr= 5wUUK/qemHJkiUHTp8+fbM8K3/PlgK0atWqLgm7XaDs1PUh/5DtKdW4Z3Xt1rj7Lly4cK1Vo1Ra= wWjz5s3zr1279n0JeEACPiGeXa3gW5BHl8beKhm2SZvubNiw4a/SqKZ9VdMaJK15RBPZK+E+XnB= CbW0uoN7RAN+VNh1tZqDSGrR27dqFGvg5AfNzpf3NCNGmvsj0raVLl/YNDg4eElATZcYppUH9/f= 0fnZiY+K0GfLjMoHehz/FKpfK1c+fOvVt07MIACZzPCpyXNNCyooPd5fZXBdJXBNJrReQoBJD8z= ZBMar8GwLxK04IFC6JFixZFpPPnz48keNTR0UGAGPPUGNHk5GSkBxHduXMnun37dnTr1q04LT3o= dMdxjfENmdvvQvkEA7Ry5cpnxHSfrlIxDYBodYkWL14cgxEqoNsO0MbGxiLFWDFgbl2Be1a27Rc= vXvxlSJ8ggKqa86IYFgYHUHp6emJNCREotA2aNTIyEoMV2sdpR4D5VIgm5QJU9Tl/EvNCZoXG9P= b2xmbkCBbfYkKYjJkNk0U7KIcwNUwO8zNzhJ+ZYNyo+gfzGx4eLqNR4zLtx/N8UiZA1dXq75Il2= CEzKYDRPsmdRwwA5qF9WXwZGA2NMjKAA08un5nCF6AAuwDhuB/KWt1SASLOUcc3NVjwUs5T7uvr= a/AxADE6OhpfRUFJmyhgdXd3x5erVWjhpUuXimrTcSnCxpMnT477xssKFJ9Thy/5OvnKFJDF4Lg= CX79+PRaYp9tqwjxx1pjiwoXT1s/YyMHqh+kF0oPi06sLNzKDvBrE9kFP+w219tYnuWBSXV317R= cCapUoImSSZaE8fkqrbBwuWEftDWOTs3xOOiVwN/m2JTNWJTaeYrZXVylwxsfHo/Pnz88aOEwcb= WFMxjbigfHgAom57q3OvaHLDBNjV64W32xolZJBnZctq/tvVB4fgC+YbcK/Mb6tfIyP6RUwt36B= fFU83nJlb9ASmRZHBv9VgxVuI989Dlnta1UId/ny5Vr+bt6sWLEiDkpNBplOkOOWmV1SnwG1r50= nNZiYGmxXg1xweEqsVkao9pUrVyx711Nkcc0NWZE5j6QcfVUMak1rAA3omFQNdtZqMm6wbVYPCB= XGrFDxuULIgkzIBiFrqD8CA7CwudQAkolwhpx7TIppuUEgq5UJYkznQopMyGaEzMieR2AAFtauB= pAqnrbCrNR9EsQ5BeKNLLZtqUM2ZDRyZbcyX+piEQPETzMqfMzX2C1j40nMAal9vFl06333Yw9/= O7q87c3o+iM/jFphhPCAFzzhnUdsaJEVQnbmkEdgASa0iwFSpPuk3Wd1ZlduxPYhxLTGPvWdaHL= pA9HYhm3Rta0/aQokpgkPeMU8xTuPkBFZjdw5WJkn7RAmsZnFAAmxLZ5GDUXYr60ExDnuoA0NE5= lFJ39fK7m1bqg0SAYOPIxc3lbmS5HVYjPmEOiLYkw6dunnYDHd5GPslrmqya7c1NZt47tfcvSn0= aIT9QO8MiB5wRFPeIcQsiKzkTsXK/Okj4JN5cSJEw+p8nueBg1FBF+KEeIynkjosQI9Fv77UDTZ= /eFo4oG1cX9S8pQ3RKoNI05n0sDpeuXZ3L4uO2Q3YNCiAAvoPHbs2B8r2i48LkZPuMyS9zg3jhc= gnkbRoLAsSK0CB7nxRcwBoLjQKDM76n2kdn+pCNWnVPkZXwMrA3mLfeyYwepC06IgtRIck9H1o1= iAG21bm0R6CoB2qPBjiYqGLJtSO3Mhrghg3NDfMqEgtQMcZODXE3vQaFTAOdVFTOxZ9eVXyFRCN= W0F45wl1P/4GOaBRB+W8obVSg65qM/xjc2Ww/wQroINdhbJxMbZwdWDm5TWIG/UDDjGA5CYMGRA= kKI51FkZ9ayArQAHXq7s7pyoS6EeAJr2viktKLaNKfd5jo02IeQDadyJceDRSnDg58ruzom6FOr= ukKrlAoTXN0I1W0UG0kInTjLerQYHvq7s7pxszGQKNnEknayY7Xwd/vrIrXsMdZ5l7jqEZH2jks= KhKPIpbGYU+1Yra4S5Nbt3M16WulrjzsnqkynYoEG5AJWw3eRYM/I+cDAr19xw1q0EyfU77pxmC= FcvGMVJj9Tz/jtiBlvmSd3VwN8juzQNHFvZOBC2lczSVqxkNgekY04BNEKg+Hk1zAwUiUAtUOQQ= qmygiEBZ4OCLuJrZuzFGGvGTtQWK7AgCAsU/A9B6MczcaoC8MWbwvAArTcA8cKxfu0By3zJhDgE= P+g846VMmWFoK2kZok+vsrDwvDQXH+AASZoVfMmrGJyGzew7kzsn4J1OwIQ56O1mRzGNW5tQYyN= WmZFtfvig4xqOVICGzPVjmEnKWDjYdfPsggXi9P5PcA6ciAJUFx4RpFUiuzO5cbBxPOgw2lSNHj= kzJD21UAz4uSSXiBnb1ED6JTWsI3dAB+8319R9MykTIaT4pqmjxeI83dLIJzVm+fHlNg65evRqy= ir188ODB38SRtBgcyh5Cy678kC3vxBN2gJbbb+2Xa03KgGOdvZrk8LZ2vhRZLQZiDoH+J8Yk3qb= rp9kz6vgDMUeOVMJ2WSohln1WgvyIdCqaWLUm6vzn/mjp4R9nD5A68nSFaRKaM9n7kWjx334VLX= gfD5FO7Nr56dn8D2+hBfifSc3zGf1kNFoDRC8ivKzJbk0farpGb2PVfhvj8Kzo8Wse/1bXY1rmG= gBGb83lDiEwX9ELDJ+jYW2zqsIXcnuqAU/AiIHth0Qrm0spshk4yOXKniWni0UNIDnqA6o4m9WR= OuzXjUCTb3bl9Z+tekwL2YyQOdD3nAUL61cD6LQ+RhNAu60iK+VJWFyUtPGsfrNVp3nEfsdODZG= 1gPbsBguTtQYQBfJB+8T8klWmpawEvF5ihMPG1ucKIYvtHZEJWW0FzpKRuYOB26Z+2KxSrUrjUi= 9eNI4dlNswec9umMtWNeyd+Mg1v2SfdufRnOTbZSwigYEh4v1Ir8y87srZoEFUrFu37mca6B23U= do9q5gbMArc+LU8U+20fu0oZ0xeCUQGI2RzX3+xcl/KnJl7sq62zLsVGuj+a8BVQBpMzECSqb2n= 5bFP+U9bWVaKWbnmRtTKa7g8VWKP/GAyi3t6Hfx5KQqfY5EyrTGrgN/ea4ylPXsU9/yiVuDceAG= iflCfMUo9v6Db+EUip4/3FiBYRvFJ+AIIRwlQ5APOXrx8fYXw42yHCNl1xqxWvHZXwOfAnk8Rvi= 6AvEeMXhMzoe5/zJKz9wIogcQnmHzHMP1BhKGXk3I4hfr7Im1MDm3jQvNYgnn6ZopoCCbDqkh/e= KUd1NGfGCckCEyI3PznUMZQTptPMV9UfsaqZ23SUlYV96gzrV3RckCdjQ/qUn2QK7Cc9r800fdV= 9kVdmWbp9uOeJ8xya08YrTAflWybl0fLOEHgPIcL3iWI7yT4JPPXIX0LTbaqSfvFuJC5JQUxs7H= gktUIkzLgMDXAYGVEUwDCzDHJq2C+fR/1miBVn/SS8sus7B5JS30WXtin8I2nnjjvNR6/R4BBTP= 6xAJ9evlZU5sIAMYAGeleatFEm8byynMvPVeJDueeRFZnLCFnIB/kGYFui8g/sPzcppUEuUIpAj= +oDYExup55W/QzEbTSL91UZdiITsjU7dNMa5AogbfrA/YOllgJkYA3oeyvFK/f/RZcBkpVW/8nb= k4pttqjdJl3BX9qm8OVXgzdkSq/q19J785+8pUwsGhoaqhw+fPiTmtw9828C/w/K8jZzsc+GngA= AAABJRU5ErkJggg=3D=3D") !important; } .ms-outlook-ios-dark-mode .ms-outlook-ios-availability-container > table > = tbody > tr > td:nth-child(1) > table:nth-child(4) > tbody > tr:nth-child(2)= > td > a { color: #0086F0 !important; } .ms-outlook-ios-dark-mode .ms-outlook-ios-mention { color: #ACACAC !important; background-color: #292929 !important; }</style> <meta name=3D"viewport" content=3D"width=3Ddevice-width, user-scalable=3Dno= , initial-scale=3D1.0, minimum-scale=3D1.0, maximum-scale=3D1.0"> </head> <body style=3D"-webkit-tap-highlight-color: rgba(0, 0, 0, 0);"> <div style=3D"direction: ltr;"> <div> <div></div> </div> <div style=3D"direction: ltr;">Thank you, Steven. I certainly didn=92t pay = attention to type id 287. This one worked as opposed to type id 22. I wonde= r why would one log while the other doesn=92t although both successfully ap= ply.</div> <div><br> </div> <div style=3D"direction: ltr;">More reading for me on the trace options. I = haven=92t used these before. Are these considered day-to-day use or only fo= r debugging?</div> <div><br> </div> <div style=3D"direction: ltr;">Thanks a bunch.</div> <div style=3D"direction: ltr;">YM</div> <div><br> </div> <div class=3D"ms-outlook-ios-signature"></div> </div> <div> <hr style=3D"display:inline-block;width:98%" tabindex=3D"-1"> <div id=3D"divRplyFwdMsg" dir=3D"dir=3D"ltr""><font face=3D"Calib= ri, sans-serif" style=3D"font-size:11pt"><b>From:</b> Steven Baigal (sbaiga= l) <[email protected]><br> <b>Sent:</b> Friday, September 27, 2019 11:33 PM<br> <b>To:</b> Y M; [email protected]<br> <b>Subject:</b> Re: [Snort-devel] Snort 3 file statistics and logging <div> </div> </font></div> <meta content=3D"text/html; charset=3Dutf-8"> <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <style><!--@font-face {font-family:"Cambria Math"}@font-face {font-family:C= alibri}@font-face {font-family:Consolas}p.MsoNormal, li.MsoNormal, div.MsoN= ormal {margin:0in; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Ca= libri",sans-serif}a:link, span.MsoHyperlink {color:#0563C1; text-decoration= :underline}a:visited, span.MsoHyperlinkFollowed {color:#954F72; text-decora= tion:underline}p.msonormal0, li.msonormal0, div.msonormal0 {margin:0in; mar= gin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri",sans-serif}span= .EmailStyle19 {font-family:"Calibri",sans-serif; color:windowtext}.MsoChpDe= fault {font-size:10.0pt}@page WordSection1 {margin:1.0in 1.0in 1.0in 1.0in}= div.WordSection1 {}ol {margin-bottom:0in}ul {margin-bottom:0in}--></style> <div class=3D"WordSection1"> <p class=3D"MsoNormal">For the second issue, you need to add policy for PDF= :</p> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black; background:white">{ when =3D { file_type_id =3D 287 }, use = =3D { verdict =3D 'log', } },</span></p> <p class=3D"MsoNormal"> </p> <p class=3D"MsoNormal">Regarding the 0 bytes stats, try to remove the polic= y and add trace to file_id:</p> <p class=3D"MsoNormal">file_id =3D {</p> <p class=3D"MsoNormal"> enable_type =3D true,</p> <p class=3D"MsoNormal"> enable_signature =3D true,</p> <p class=3D"MsoNormal"> file_rules =3D file_magic,</p> <p class=3D"MsoNormal"> trace_type =3D true,</p> <p class=3D"MsoNormal"> trace_signature =3D true,</p> <p class=3D"MsoNormal"> trace_stream =3D true,</p> <p class=3D"MsoNormal">}</p> <p class=3D"MsoNormal"></p> <p class=3D"MsoNormal">Steven B.</p> <div style=3D"border:none; border-top:solid #B5C4DF 1.0pt; padding:3.0pt 0i= n 0in 0in"> <p class=3D"MsoNormal"><b><span style=3D"font-size:12.0pt; color:black">Fro= m: </span> </b><span style=3D"font-size:12.0pt; color:black">Snort-devel <snort-dev= [email protected]> on behalf of Y M via Snort-devel <snort-d= [email protected]><br> <b>Reply-To: </b>Y M <[email protected]><br> <b>Date: </b>Friday, September 27, 2019 at 1:56 PM<br> <b>To: </b>"[email protected]" <[email protected]= ort.org><br> <b>Subject: </b>[Snort-devel] Snort 3 file statistics and logging</span></p= > </div> <div> <p class=3D"MsoNormal"> </p> </div> <div> <p class=3D"MsoNormal"><span style=3D"color:black">Hello,</span><span style= =3D"font-size:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt; color:black"> = </span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"color:black">Two odd behaviors are ob= served regarding file inspector statistics in snort output and logging via = file logger.</span><span style=3D"font-size:12.0pt; color:black"></span></p= > </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt; color:black"> = </span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"color:black">First, from the below fi= le statistics, file type stats (files) reflect the detected files, which is= correct. The file type stats (bytes) is reporting zero bytes for some file= s, although the files have completed the transfers and exist in the inspected pcap.</span><span style=3D"font-s= ize:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt; color:black"> = </span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">--------------------------------------------------</span><s= pan style=3D"color:black"></span></p> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">File Statistics</span><span style=3D"color:black"></span></= p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">--------------------------------------------------</span><s= pan style=3D"color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">file type stats (files)</span><span style=3D"color:black"><= /span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> Type = Download Upload</span><span style=3D"col= or:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> MSEXE( 21) = 3 0 &nb= sp; </span><span style=3D"color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> RTF( 23) &n= bsp; 0 3  = ; </span><span style=3D"color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> ZIP( 29) &n= bsp; 1 1  = ; </span><span style=3D"color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> PDF(287) &n= bsp; 2 1  = ; </span><span style=3D"color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> Total &nbs= p; 6 5 = </span><span style=3D"color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">--------------------------------------------------</span><s= pan style=3D"color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">file type stats (bytes)</span><span style=3D"color:black"><= /span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> Type = Download Upload</span><span style=3D"col= or:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> MSEXE( 21) = 2593303 0 </spa= n><span style=3D"color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> RTF( 23) &n= bsp; 0 0  = ; </span><span style=3D"color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> ZIP( 29) &n= bsp; 0 0  = ; </span><span style=3D"color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> PDF(287) &n= bsp; 465066 232533 </span><span sty= le=3D"color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> Total &nbs= p; 3058369 232533 </span><spa= n style=3D"color:black"></span></p> </div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">--------------------------------------------------</span><s= pan style=3D"font-size:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt; color:black"> = </span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"color:black">Second, it appears that = file logging for a PDF file policy does not create a line for detected PDF = files. Different PDF files also don't get logged although they are detected= . Other file types/policies over the same protocols get logged as expected. Example file policy:</span></p= > </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt; color:black"> = </span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">file_id =3D</span><span style=3D"font-size:12.0pt; color:bl= ack"></span></p> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">{</span><span style=3D"font-size:12.0pt; color:black"></spa= n></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> file_rules =3D file_magic,</span><span style= =3D"font-size:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> file_policy =3D</span><span style=3D"font-siz= e:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> {</span><span style=3D"font-size:12.0pt; colo= r:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> { when =3D { file_type_id =3D 2= 2 }, use =3D { verdict =3D 'log', enable_file_signature =3D true } },</span= ><span style=3D"font-size:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black; background:white"> { when =3D { = file_type_id =3D 29 }, use =3D { verdict =3D 'log', enable_file_signature = =3D true } },</span><span style=3D"font-size:12.0pt; color:black"></span></= p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> { when =3D { sha256 =3D "o= mitted" }, use =3D { verdict =3D 'log' } }</span><span style=3D"font-s= ize:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> }</span><span style=3D"font-size:12.0pt; colo= r:black"></span></p> </div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">}</span><span style=3D"font-size:12.0pt; color:black"></spa= n></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt; color:black"> = </span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">file_log =3D</span><span style=3D"font-size:12.0pt; color:b= lack"></span></p> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">{</span><span style=3D"font-size:12.0pt; color:black"></spa= n></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> log_pkt_time =3D true,</span><span style=3D"f= ont-size:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> log_sys_time =3D false</span><span style=3D"f= ont-size:12.0pt; color:black"></span></p> </div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">}</span><span style=3D"font-size:12.0pt; color:black"></spa= n></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt; color:black"> = </span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"color:black">The expected log lines i= n file.log from the above policies:</span><span style=3D"font-size:12.0pt; = color:black"></span></p> </div> <div> <ol start=3D"1" type=3D"1"> <li class=3D"MsoNormal" style=3D"color:black">Log PDF files when detected.<= span style=3D"font-size:12.0pt"></span></li><li class=3D"MsoNormal" style= =3D"color:black">Log ZIP files when detected.<span style=3D"font-size:12.0p= t"></span></li><li class=3D"MsoNormal" style=3D"color:black">Log the file w= ith the specified hash.<span style=3D"font-size:12.0pt"></span></li></ol> <div> <p class=3D"MsoNormal"><span style=3D"color:black">In the above example, ev= erything gets logged except for PDF files.</span><span style=3D"font-size:1= 2.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt; color:black"> = </span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"color:black">Below are the file stati= stics.</span><span style=3D"font-size:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt; color:black"> = </span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">--------------------------------------------------</span><s= pan style=3D"font-size:12.0pt; color:black"></span></p> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">File Statistics</span><span style=3D"font-size:12.0pt; colo= r:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">--------------------------------------------------</span><s= pan style=3D"font-size:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">file type stats (files)</span><span style=3D"font-size:12.0= pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> Type = Download Upload</span><span style=3D"fon= t-size:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> MSEXE( 21) = 1 0 &nb= sp; </span><span style=3D"font-size:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> PDF(287) &n= bsp; 1 1  = ; </span><span style=3D"font-size:12.0pt; color:black"></span>= </p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> Total &nbs= p; 2 1 = </span><span style=3D"font-size:12.0pt; color:black"></= span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">--------------------------------------------------</span><s= pan style=3D"font-size:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">file type stats (bytes)</span><span style=3D"font-size:12.0= pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> Type = Download Upload</span><span style=3D"fon= t-size:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> MSEXE( 21) = 1123608 0 </spa= n><span style=3D"font-size:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> PDF(287) &n= bsp; 232533 232533 </span><span sty= le=3D"font-size:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> Total &nbs= p; 1356141 232533 </span><spa= n style=3D"font-size:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">--------------------------------------------------</span><s= pan style=3D"font-size:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">file signature stats</span><span style=3D"font-size:12.0pt;= color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> Type = Download Upload</span><span style=3D"fon= t-size:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> MSEXE( 21) = 1 0 &nb= sp; </span><span style=3D"font-size:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> PDF(287) &n= bsp; 1 1  = ; </span><span style=3D"font-size:12.0pt; color:black"></span>= </p> </div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black"> Total &nbs= p; 2 1</span><span st= yle=3D"font-size:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt; color:black"> = </span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"color:black">This used to work on ear= lier versions of Snort 3. Running Snort with --warn-all does not yield and = warnings associated with the file inspector. The command used to run Snort:= </span><span style=3D"font-size:12.0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt; color:black"> = </span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt; font-family:Consola= s; color:black">snort -c snort.lua -r test.pcap -l /var/log/snort --pl= ugin-path /usr/local/snort/extra -k none</span><span style=3D"font-size:12.= 0pt; color:black"></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt; color:black"> = </span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"color:black">And Snort version is&nbs= p;3.0.0 (Build 261)</span><span style=3D"font-size:12.0pt; color:black"></s= pan></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt; color:black"> = </span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"color:black">Thank you.</span><span s= tyle=3D"font-size:12.0pt; color:black"></span></p> </div> </div> </div> </div> </body> </html> --_000_MN2PR17MB3360D2635A3134A8C31A1A32A8810MN2PR17MB3360namp_-- --===============2067906206655552168== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-devel mailing list [email protected] https://lists.snort.org/mailman/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort! --===============2067906206655552168==--