Re: snort3: reject rule problem
Meridoff via Snort-devel <[email protected]> Tue, 1 Oct 2019 20:25:12 +0300
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <CAFfuDwxyPMKRHxJu5+BpJ3jKxaVcT3y7XoL41dF_VHPE_4pHUQ@mail.gmail.com> |
--===============0601051708311881555==
Content-Type: multipart/alternative; boundary="00000000000034792e0593dca364"
--00000000000034792e0593dca364
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
I use IPS NFQ mode.
*1. My config * (only important things showed):
snort =3D { ["-e"] =3D true, ["-M"] =3D true, ["--create-pidfile"] =3D true=
, ["-z"]
=3D 0, ["-Q"]=3Dtrue}
ips =3D { enable_builtin_rules =3D false, mode=3D"inline" }
wizard =3D default_wizard
snort["-z"]=3D1
alert_fast =3D {file=3Dtrue}
stream=3D{}
stream_icmp=3D{}
stream_ip=3D{}
stream_tcp=3D{}
reject=3D{}
reject.control=3D"port"
ips.rules =3D [[
include /var/cache/m.rules
]]
m.rules:
drop icmp 192.168.33.10 any -> any any ( gid:8000; msg:"icmp"; sid:1; )
*Sending 4 pings *, have in alert log 4 entries and packets dropped
succesfully:
19/10/01-04:08:08.089543 [drop] [**] [8000:1:0] "icmp" [**] [Priority: 0]
{ICMP} 192.168.33.10 -> 192.168.33.214
19/10/01-04:08:09.097047 [drop] [**] [8000:1:0] "icmp" [**] [Priority: 0]
{ICMP} 192.168.33.10 -> 192.168.33.214
19/10/01-04:08:10.105488 [drop] [**] [8000:1:0] "icmp" [**] [Priority: 0]
{ICMP} 192.168.33.10 -> 192.168.33.214
19/10/01-04:08:11.113519 [drop] [**] [8000:1:0] "icmp" [**] [Priority: 0]
{ICMP} 192.168.33.10 -> 192.168.33.214
*2. Now I change *only 1 thing: the action of rule to "reject":
reject icmp 192.168.33.10 any -> any any ( gid:8000; msg:"icmp"; sid:1; )
*Sending pings:*
zzz@host:~$ ping 192.168.33.214
PING 192.168.33.214 (192.168.33.214) 56(84) bytes of data.
From 192.168.33.214 icmp_seq=3D1 Destination Port Unreachable -- It is OK=
,
Active worked!
^C
--- 192.168.33.214 ping statistics ---
6 packets transmitted, 0 received, +1 errors, 100% packet loss, time 4999ms
-- 6 Pings dropped.
*But what we see in alert log:*
19/10/01-04:09:40.194939 [reset] [**] [8000:1:0] "icmp" [**] [Priority: 0]
{ICMP} 192.168.33.10 -> 192.168.33.214
Only 1 alert message.
Okey, I wait for some time (more 1 minute) and send pings again: they
dropped and NO new entries in alert log.
*3. If I remove stream_ip and stream_icmp* inspectors: all Ok, for each
dropped ping there are entries in alert.log.
ping 192.168.33.214
PING 192.168.33.214 (192.168.33.214) 56(84) bytes of data.
From 192.168.33.214 icmp_seq=3D1 Destination Port Unreachable
From 192.168.33.214 icmp_seq=3D2 Destination Port Unreachable
From 192.168.33.214 icmp_seq=3D3 Destination Port Unreachable
From 192.168.33.214 icmp_seq=3D4 Destination Port Unreachable
From 192.168.33.214 icmp_seq=3D5 Destination Port Unreachable
Alert.log:
19/10/01-04:15:40.535491 [reset] [**] [8000:1:0] "icmp" [**] [Priority: 0]
{ICMP} 192.168.33.10 -> 192.168.33.214
19/10/01-04:15:41.534852 [reset] [**] [8000:1:0] "icmp" [**] [Priority: 0]
{ICMP} 192.168.33.10 -> 192.168.33.214
19/10/01-04:15:42.535242 [reset] [**] [8000:1:0] "icmp" [**] [Priority: 0]
{ICMP} 192.168.33.10 -> 192.168.33.214
19/10/01-04:15:43.535235 [reset] [**] [8000:1:0] "icmp" [**] [Priority: 0]
{ICMP} 192.168.33.10 -> 192.168.33.214
19/10/01-04:15:44.535043 [reset] [**] [8000:1:0] "icmp" [**] [Priority: 0]
{ICMP} 192.168.33.10 -> 192.168.33.214
=D0=B2=D1=82, 1 =D0=BE=D0=BA=D1=82. 2019 =D0=B3. =D0=B2 19:57, Steven Baiga=
l (sbaigal) <[email protected]>:
> active response needs inline mode, add -Q to command line.
>
> If running tcp, add normalizer =3D { tcp =3D { ips =3D true, }, }
>
> If using pcap test for inline mode, use -Q --daq dump --daq-var
> load-mode=3Dread-file
>
>
>
>
>
> *From: *Snort-devel <[email protected]> on behalf of
> "Russ Combs (rucombs) via Snort-devel" <[email protected]>
> *Reply-To: *"Russ Combs (rucombs)" <[email protected]>
> *Date: *Tuesday, October 1, 2019 at 12:33 PM
> *To: *Meridoff <[email protected]>, "[email protected]" <
> [email protected]>
> *Subject: *Re: [Snort-devel] snort3: reject rule problem
>
>
>
> What happens if you disable the active responses? Do you get multiple
> alerts? It seems like the active response is working.
>
>
>
> *From: *Snort-devel <[email protected]> on behalf of
> Meridoff via Snort-devel <[email protected]>
> *Reply-To: *Meridoff <[email protected]>
> *Date: *Tuesday, October 1, 2019 at 12:07 PM
> *To: *"[email protected]" <[email protected]>
> *Subject: *Re: [Snort-devel] snort3: reject rule problem
>
>
>
> >> That is per design =E2=80=93 the alert kicks off the active responses.=
The
> alert is logged, but the responses are not.
>
> I have many pings so it must be many alerts, but it's only one alert for
> pings, when active response is ON.
>
> Is it normanl ?
>
>
>
> =D0=B2=D1=82, 1 =D0=BE=D0=BA=D1=82. 2019 =D0=B3. =D0=B2 17:42, Meridoff <=
[email protected]>:
>
> I have many pings so it must be many alerts, but it's only one, when
> active response is ON.
>
> Is it normanl ?
>
>
>
> =D1=87=D1=82, 26 =D1=81=D0=B5=D0=BD=D1=82. 2019 =D0=B3. =D0=B2 17:41, Rus=
s Combs (rucombs) <[email protected]>:
>
> That is per design =E2=80=93 the alert kicks off the active responses. T=
he alert
> is logged, but the responses are not.
>
>
>
> *From: *Meridoff <[email protected]>
> *Date: *Thursday, September 26, 2019 at 10:25 AM
> *To: *"Russ Combs (rucombs)" <[email protected]>
> *Subject: *Re: [Snort-devel] snort3: reject rule problem
>
>
>
> Thanks, it's became better - Host/Port Unreachable sent for each ping
> packet now.
>
>
>
> BUT in log goes only 1st ping packet. For other ping packets - no alerts
> in log..
>
>
>
> I use active.min_interval =3D 1
>
> So this settings fix problem with Active response pacekts, but in log onl=
y
> 1st alert for all cases..
>
>
>
> =D1=87=D1=82, 26 =D1=81=D0=B5=D0=BD=D1=82. 2019 =D0=B3. =D0=B2 14:36, Rus=
s Combs (rucombs) <[email protected]>:
>
> Take a look at the active module. Try configuring active.min_interval.
>
>
>
> Russ
>
>
>
> *From: *Snort-devel <[email protected]> on behalf of
> Meridoff via Snort-devel <[email protected]>
> *Reply-To: *Meridoff <[email protected]>
> *Date: *Wednesday, September 25, 2019 at 5:39 PM
> *To: *"[email protected]" <[email protected]>
> *Subject: *[Snort-devel] snort3: reject rule problem
>
>
>
> Hello
>
> I have reject rule that send Port unreachable for ping.
>
>
>
> It's Ok, but only for 1st packet.
>
>
>
> The next ping packets are silently dropped and not detected and not logge=
d.
>
>
>
> reject icmp 192.168.0.1 any -> any any ( gid:8000; sid:1; msg:"ping"; )
>
>
>
> This happens when stream and stream_icmp inspectors are in config.
>
>
>
> If I remove stream {} and/or stream_icmp {} inspectors from snort lua con=
fig, then ALL OK: each packet is
>
> dropped, logged and ICMP Port unreach is sending on each dropped packet.
>
>
>
>
>
> Part of config:
>
>
>
> stream=3D{}
>
> stream_icmp=3D{}
>
> reject=3D{control=3D"port"}
>
>
>
> Thanks.
>
>
--00000000000034792e0593dca364
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div di=
r=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"lt=
r"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div=
dir=3D"ltr"><div>I use IPS NFQ mode.=C2=A0</div><div dir=3D"ltr"><b>1. My =
config </b>=C2=A0(only important things showed):</div><div dir=3D"ltr"><br>=
<div><div>snort =3D { ["-e"] =3D true, ["-M"] =3D true,=
["--create-pidfile"] =3D true, ["-z"] =3D 0, ["-Q=
"]=3Dtrue}</div><div>ips =3D { enable_builtin_rules =3D false, mode=3D=
"inline" }<br></div><div>wizard =3D default_wizard<br></div><div>=
snort["-z"]=3D1<br></div><div>alert_fast =3D {file=3Dtrue}</div><=
div><div>stream=3D{}</div><div>stream_icmp=3D{}</div><div>stream_ip=3D{}</d=
iv><div>stream_tcp=3D{}</div></div><div><div>reject=3D{}</div><div>reject.c=
ontrol=3D"port"<br></div></div><div>ips.rules =3D [[<br></div><di=
v>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 include /var/cach=
e/m.rules</div><div>]]</div><div><br></div><div>m.rules:</div><div><br></di=
v><div>drop icmp 192.168.33.10 any -> any any ( gid:8000; msg:"icmp=
"; sid:1; =C2=A0)=C2=A0<br></div><div><br></div><div><b>Sending 4 ping=
s </b>, have in alert log 4 entries and packets dropped succesfully:</div><=
/div><div>19/10/01-04:08:08.089543 [drop] [**] [8000:1:0] "icmp" =
[**] [Priority: 0] {ICMP} 192.168.33.10 -> 192.168.33.214<br></div><div>=
<div>19/10/01-04:08:09.097047 [drop] [**] [8000:1:0] "icmp" [**] =
[Priority: 0] {ICMP} 192.168.33.10 -> 192.168.33.214</div><div>19/10/01-=
04:08:10.105488 [drop] [**] [8000:1:0] "icmp" [**] [Priority: 0] =
{ICMP} 192.168.33.10 -> 192.168.33.214</div><div>19/10/01-04:08:11.11351=
9 [drop] [**] [8000:1:0] "icmp" [**] [Priority: 0] {ICMP} 192.168=
.33.10 -> 192.168.33.214</div></div><div><br></div><div><b>2. Now I chan=
ge </b>only 1 thing: the action of rule to "reject":</div><div><b=
r></div><div>reject =C2=A0icmp 192.168.33.10 any -> any any ( gid:8000; =
msg:"icmp"; sid:1; =C2=A0)=C2=A0<br></div><div><br></div><div><b>=
Sending pings:</b></div><div><div>zzz@host:~$ ping 192.168.33.214</div><div=
>PING 192.168.33.214 (192.168.33.214) 56(84) bytes of data.</div><div>From =
192.168.33.214 icmp_seq=3D1 Destination Port Unreachable =C2=A0 -- It is OK=
, Active worked!</div><div>^C</div><div>--- 192.168.33.214 ping statistics =
---</div><div>6 packets transmitted, 0 received, +1 errors, 100% packet los=
s, time 4999ms =C2=A0-- 6 Pings dropped.</div><div><br></div><div><b>But wh=
at we see in alert log:</b></div><div><div><br></div><div>19/10/01-04:09:40=
.194939 [reset] [**] [8000:1:0] "icmp" [**] [Priority: 0] {ICMP} =
192.168.33.10 -> 192.168.33.214</div></div><div><br></div><div>Only 1 al=
ert message.</div><div><br></div><div>Okey, I wait for some time (more 1 mi=
nute) and send pings again: they dropped and NO new entries in alert log.</=
div><div><br></div><div><b>3. If I remove stream_ip and stream_icmp</b> ins=
pectors: all Ok, for each dropped ping there are entries in alert.log.</div=
><div><br></div><div><div>ping 192.168.33.214</div><div>PING 192.168.33.214=
(192.168.33.214) 56(84) bytes of data.</div><div>From 192.168.33.214 icmp_=
seq=3D1 Destination Port Unreachable</div><div>From 192.168.33.214 icmp_seq=
=3D2 Destination Port Unreachable</div><div>From 192.168.33.214 icmp_seq=3D=
3 Destination Port Unreachable</div><div>From 192.168.33.214 icmp_seq=3D4 D=
estination Port Unreachable</div><div>From 192.168.33.214 icmp_seq=3D5 Dest=
ination Port Unreachable</div></div><div><br></div><div>Alert.log:=C2=A0</d=
iv><div><div>19/10/01-04:15:40.535491 [reset] [**] [8000:1:0] "icmp&qu=
ot; [**] [Priority: 0] {ICMP} 192.168.33.10 -> 192.168.33.214</div><div>=
19/10/01-04:15:41.534852 [reset] [**] [8000:1:0] "icmp" [**] [Pri=
ority: 0] {ICMP} 192.168.33.10 -> 192.168.33.214</div><div>19/10/01-04:1=
5:42.535242 [reset] [**] [8000:1:0] "icmp" [**] [Priority: 0] {IC=
MP} 192.168.33.10 -> 192.168.33.214</div><div>19/10/01-04:15:43.535235 [=
reset] [**] [8000:1:0] "icmp" [**] [Priority: 0] {ICMP} 192.168.3=
3.10 -> 192.168.33.214</div><div>19/10/01-04:15:44.535043 [reset] [**] [=
8000:1:0] "icmp" [**] [Priority: 0] {ICMP} 192.168.33.10 -> 19=
2.168.33.214</div></div><div><br></div><div><br></div><div><br></div></div>=
<div><br></div><div><br></div><div><br></div></div></div></div></div></div>=
</div></div></div></div></div></div></div></div></div></div><br><div class=
=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">=D0=B2=D1=82, 1 =D0=
=BE=D0=BA=D1=82. 2019 =D0=B3. =D0=B2 19:57, Steven Baigal (sbaigal) <<a =
href=3D"mailto:[email protected]">[email protected]</a>>:<br></div><bloc=
kquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:=
1px solid rgb(204,204,204);padding-left:1ex">
<div lang=3D"EN-US">
<div class=3D"gmail-m_5193518343323054304WordSection1">
<p class=3D"MsoNormal">active response needs inline mode, add -Q to command=
line.<u></u><u></u></p>
<p class=3D"MsoNormal">If running tcp, add normalizer =3D { tcp =3D { ips =
=3D true, }, }<u></u><u></u></p>
<p class=3D"MsoNormal">If using pcap test for inline mode, use -Q --daq dum=
p --daq-var load-mode=3Dread-file<u></u><u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
<div style=3D"border-right:none;border-bottom:none;border-left:none;border-=
top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class=3D"MsoNormal"><b><span style=3D"font-size:12pt;color:black">From: =
</span></b><span style=3D"font-size:12pt;color:black">Snort-devel <<a hr=
ef=3D"mailto:[email protected]" target=3D"_blank">snort-d=
[email protected]</a>> on behalf of "Russ Combs (rucombs=
) via Snort-devel" <<a href=3D"mailto:[email protected]" =
target=3D"_blank">[email protected]</a>><br>
<b>Reply-To: </b>"Russ Combs (rucombs)" <<a href=3D"mailto:ruc=
[email protected]" target=3D"_blank">[email protected]</a>><br>
<b>Date: </b>Tuesday, October 1, 2019 at 12:33 PM<br>
<b>To: </b>Meridoff <<a href=3D"mailto:[email protected]" target=3D"_bla=
nk">[email protected]</a>>, "<a href=3D"mailto:[email protected]=
ort.org" target=3D"_blank">[email protected]</a>" <<a hre=
f=3D"mailto:[email protected]" target=3D"_blank">snort-devel@list=
s.snort.org</a>><br>
<b>Subject: </b>Re: [Snort-devel] snort3: reject rule problem<u></u><u></u>=
</span></p>
</div>
<div>
<p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p>
</div>
<p class=3D"MsoNormal">What happens if you disable the active responses?=C2=
=A0 Do you get multiple alerts?=C2=A0 It seems like the active response is =
working.<u></u><u></u></p>
<p class=3D"MsoNormal">=C2=A0<u></u><u></u></p>
<div style=3D"border-right:none;border-bottom:none;border-left:none;border-=
top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class=3D"MsoNormal"><b><span style=3D"font-size:12pt;color:black">From: =
</span></b><span style=3D"font-size:12pt;color:black">Snort-devel <<a hr=
ef=3D"mailto:[email protected]" target=3D"_blank">snort-d=
[email protected]</a>> on behalf of Meridoff via Snort-devel =
<<a href=3D"mailto:[email protected]" target=3D"_blank">snort-=
[email protected]</a>><br>
<b>Reply-To: </b>Meridoff <<a href=3D"mailto:[email protected]" target=
=3D"_blank">[email protected]</a>><br>
<b>Date: </b>Tuesday, October 1, 2019 at 12:07 PM<br>
<b>To: </b>"<a href=3D"mailto:[email protected]" target=3D"_=
blank">[email protected]</a>" <<a href=3D"mailto:snort-de=
[email protected]" target=3D"_blank">[email protected]</a>><=
br>
<b>Subject: </b>Re: [Snort-devel] snort3: reject rule problem</span><u></u>=
<u></u></p>
</div>
<div>
<p class=3D"MsoNormal">=C2=A0<u></u><u></u></p>
</div>
<div>
<div>
<div>
<div>
<div>
<p class=3D"MsoNormal" style=3D"margin-bottom:12pt">>> That is per de=
sign =E2=80=93 the alert kicks off the active responses.=C2=A0 The alert is=
logged, but the responses are not.<u></u><u></u></p>
</div>
<div>
<p class=3D"MsoNormal">I have many pings so it must be many alerts, but it&=
#39;s only one alert for pings, when active response is ON.=C2=A0<u></u><u>=
</u></p>
</div>
<div>
<p class=3D"MsoNormal">Is it normanl ?<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
<p class=3D"MsoNormal">=C2=A0<u></u><u></u></p>
<div>
<div>
<p class=3D"MsoNormal">=D0=B2=D1=82, 1 =D0=BE=D0=BA=D1=82. 2019 =D0=B3. =D0=
=B2 17:42, Meridoff <<a href=3D"mailto:[email protected]" target=3D"_bla=
nk">[email protected]</a>>:<u></u><u></u></p>
</div>
<blockquote style=3D"border-top:none;border-right:none;border-bottom:none;b=
order-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin:5pt 0i=
n 5pt 4.8pt">
<div>
<div>
<p class=3D"MsoNormal">I have many pings so it must be many alerts, but it&=
#39;s only one, when active response is ON.=C2=A0<u></u><u></u></p>
</div>
<div>
<p class=3D"MsoNormal">Is it normanl ?<u></u><u></u></p>
</div>
<p class=3D"MsoNormal">=C2=A0<u></u><u></u></p>
<div>
<div>
<p class=3D"MsoNormal">=D1=87=D1=82, 26 =D1=81=D0=B5=D0=BD=D1=82. 2019 =D0=
=B3. =D0=B2 17:41, Russ Combs (rucombs) <<a href=3D"mailto:rucombs@cisco=
.com" target=3D"_blank">[email protected]</a>>:<u></u><u></u></p>
</div>
<blockquote style=3D"border-top:none;border-right:none;border-bottom:none;b=
order-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin:5pt 0i=
n 5pt 4.8pt">
<div>
<div>
<p class=3D"MsoNormal">That is per design =E2=80=93 the alert kicks off the=
active responses.=C2=A0 The alert is logged, but the responses are not.<u>=
</u><u></u></p>
<p class=3D"MsoNormal">=C2=A0<u></u><u></u></p>
<div style=3D"border-right:none;border-bottom:none;border-left:none;border-=
top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class=3D"MsoNormal"><b><span style=3D"font-size:12pt;color:black">From:
</span></b><span style=3D"font-size:12pt;color:black">Meridoff <<a href=
=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>><b=
r>
<b>Date: </b>Thursday, September 26, 2019 at 10:25 AM<br>
<b>To: </b>"Russ Combs (rucombs)" <<a href=3D"mailto:rucombs@c=
isco.com" target=3D"_blank">[email protected]</a>><br>
<b>Subject: </b>Re: [Snort-devel] snort3: reject rule problem</span><u></u>=
<u></u></p>
</div>
<div>
<p class=3D"MsoNormal">=C2=A0<u></u><u></u></p>
</div>
<div>
<p class=3D"MsoNormal">Thanks, it's became better - Host/Port Unreachab=
le sent for each ping packet now.=C2=A0
<u></u><u></u></p>
<div>
<p class=3D"MsoNormal">=C2=A0<u></u><u></u></p>
</div>
<div>
<p class=3D"MsoNormal">BUT in log goes only 1st ping packet. For other ping=
packets - no alerts in log..<u></u><u></u></p>
</div>
<div>
<p class=3D"MsoNormal">=C2=A0<u></u><u></u></p>
</div>
<div>
<p class=3D"MsoNormal">I use active.min_interval =3D 1<u></u><u></u></p>
</div>
<div>
<p class=3D"MsoNormal">So this settings fix problem with Active response=C2=
=A0pacekts, but in log only 1st alert for all cases..<u></u><u></u></p>
</div>
</div>
<p class=3D"MsoNormal">=C2=A0<u></u><u></u></p>
<div>
<div>
<p class=3D"MsoNormal">=D1=87=D1=82, 26 =D1=81=D0=B5=D0=BD=D1=82. 2019 =D0=
=B3. =D0=B2 14:36, Russ Combs (rucombs) <<a href=3D"mailto:rucombs@cisco=
.com" target=3D"_blank">[email protected]</a>>:<u></u><u></u></p>
</div>
<blockquote style=3D"border-top:none;border-right:none;border-bottom:none;b=
order-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin:5pt 0i=
n 5pt 4.8pt">
<div>
<div>
<p class=3D"MsoNormal">Take a look at the active module.=C2=A0 Try configur=
ing active.min_interval.<u></u><u></u></p>
<p class=3D"MsoNormal">=C2=A0<u></u><u></u></p>
<p class=3D"MsoNormal">Russ<u></u><u></u></p>
<p class=3D"MsoNormal">=C2=A0<u></u><u></u></p>
<div style=3D"border-right:none;border-bottom:none;border-left:none;border-=
top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class=3D"MsoNormal"><b><span style=3D"font-size:12pt;color:black">From:
</span></b><span style=3D"font-size:12pt;color:black">Snort-devel <<a hr=
ef=3D"mailto:[email protected]" target=3D"_blank">snort-d=
[email protected]</a>> on behalf of Meridoff via Snort-devel =
<<a href=3D"mailto:[email protected]" target=3D"_blank">snort-=
[email protected]</a>><br>
<b>Reply-To: </b>Meridoff <<a href=3D"mailto:[email protected]" target=
=3D"_blank">[email protected]</a>><br>
<b>Date: </b>Wednesday, September 25, 2019 at 5:39 PM<br>
<b>To: </b>"<a href=3D"mailto:[email protected]" target=3D"_=
blank">[email protected]</a>" <<a href=3D"mailto:snort-de=
[email protected]" target=3D"_blank">[email protected]</a>><=
br>
<b>Subject: </b>[Snort-devel] snort3: reject rule problem</span><u></u><u><=
/u></p>
</div>
<div>
<p class=3D"MsoNormal">=C2=A0<u></u><u></u></p>
</div>
<div>
<div>
<div>
<div>
<pre><span style=3D"color:black">Hello</span><u></u><u></u></pre>
<pre><span style=3D"color:black">I have reject rule that send Port unreacha=
ble for ping.</span><u></u><u></u></pre>
<pre><span style=3D"color:black">=C2=A0</span><u></u><u></u></pre>
<pre><span style=3D"color:black">It's Ok, but only for 1st packet.</spa=
n><u></u><u></u></pre>
<pre><span style=3D"color:black">=C2=A0</span><u></u><u></u></pre>
<pre><span style=3D"color:black">The next ping packets are silently dropped=
and not detected and not logged.</span><u></u><u></u></pre>
<pre><span style=3D"color:black">=C2=A0</span><u></u><u></u></pre>
<pre><span style=3D"color:black">reject icmp 192.168.0.1 any -> any any =
( gid:8000; sid:1; msg:"ping";=C2=A0 )</span><u></u><u></u></pre>
<pre><span style=3D"color:black">=C2=A0</span><u></u><u></u></pre>
<pre><span style=3D"color:black">This happens when stream and stream_icmp i=
nspectors are in config.</span><u></u><u></u></pre>
<pre><span style=3D"color:black">=C2=A0</span><u></u><u></u></pre>
<pre><span style=3D"color:black">If I remove stream {} and/or stream_icmp {=
} inspectors from snort lua config, then ALL OK: each packet is</span><u></=
u><u></u></pre>
<pre><span style=3D"color:black">dropped, logged and ICMP Port unreach is s=
ending on each dropped packet.</span><u></u><u></u></pre>
<pre><span style=3D"color:black">=C2=A0</span><u></u><u></u></pre>
<pre><span style=3D"color:black">=C2=A0</span><u></u><u></u></pre>
<pre><span style=3D"color:black">Part of config:</span><u></u><u></u></pre>
<pre><span style=3D"color:black">=C2=A0</span><u></u><u></u></pre>
<pre><span style=3D"color:black">stream=3D{}</span><u></u><u></u></pre>
<pre><span style=3D"color:black">stream_icmp=3D{}</span><u></u><u></u></pre=
>
<pre><span style=3D"color:black">reject=3D{control=3D"port"}</spa=
n><u></u><u></u></pre>
<pre><span style=3D"color:black">=C2=A0</span><u></u><u></u></pre>
<pre><span style=3D"color:black">Thanks.</span><u></u><u></u></pre>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote></div>
--00000000000034792e0593dca364--
--===============0601051708311881555==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel
Please visit http://blog.snort.org for the latest news about Snort!
--===============0601051708311881555==--