Re: snort3: reject rule problem
Meridoff via Snort-devel <[email protected]> Wed, 2 Oct 2019 12:32:32 +0300
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <CAFfuDwwZ9N4L9_LUQa1mZLfLvQLeLqKi8t4iWk1qfGwEsJkiGQ@mail.gmail.com> |
--===============4384536172500204577== Content-Type: multipart/alternative; boundary="000000000000a807ee0593ea263f" --000000000000a807ee0593ea263f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Ok, thanks. =D0=B2=D1=82, 1 =D0=BE=D0=BA=D1=82. 2019 =D0=B3. =D0=B2 21:13, Russ Combs (= rucombs) <[email protected]>: > That=E2=80=99s working as expected. You aren=E2=80=99t getting alerts be= cause you aren=E2=80=99t > getting packets. If you want to alert on each one and block them > individually, don=E2=80=99t send the active response. > > > > *From: *Snort-devel <[email protected]> on behalf of > Meridoff via Snort-devel <[email protected]> > *Reply-To: *Meridoff <[email protected]> > *Date: *Tuesday, October 1, 2019 at 1:27 PM > *To: *"[email protected]" <[email protected]> > *Subject: *Re: [Snort-devel] snort3: reject rule problem > > > > I use IPS NFQ mode. > > *1. My config * (only important things showed): > > > > snort =3D { ["-e"] =3D true, ["-M"] =3D true, ["--create-pidfile"] =3D tr= ue, > ["-z"] =3D 0, ["-Q"]=3Dtrue} > > ips =3D { enable_builtin_rules =3D false, mode=3D"inline" } > > wizard =3D default_wizard > > snort["-z"]=3D1 > > alert_fast =3D {file=3Dtrue} > > stream=3D{} > > stream_icmp=3D{} > > stream_ip=3D{} > > stream_tcp=3D{} > > reject=3D{} > > reject.control=3D"port" > > ips.rules =3D [[ > > include /var/cache/m.rules > > ]] > > > > m.rules: > > > > drop icmp 192.168.33.10 any -> any any ( gid:8000; msg:"icmp"; sid:1; ) > > > > *Sending 4 pings *, have in alert log 4 entries and packets dropped > succesfully: > > 19/10/01-04:08:08.089543 [drop] [**] [8000:1:0] "icmp" [**] [Priority: 0] > {ICMP} 192.168.33.10 -> 192.168.33.214 > > 19/10/01-04:08:09.097047 [drop] [**] [8000:1:0] "icmp" [**] [Priority: 0] > {ICMP} 192.168.33.10 -> 192.168.33.214 > > 19/10/01-04:08:10.105488 [drop] [**] [8000:1:0] "icmp" [**] [Priority: 0] > {ICMP} 192.168.33.10 -> 192.168.33.214 > > 19/10/01-04:08:11.113519 [drop] [**] [8000:1:0] "icmp" [**] [Priority: 0] > {ICMP} 192.168.33.10 -> 192.168.33.214 > > > > *2. Now I change *only 1 thing: the action of rule to "reject": > > > > reject icmp 192.168.33.10 any -> any any ( gid:8000; msg:"icmp"; sid:1; > ) > > > > *Sending pings:* > > zzz@host:~$ ping 192.168.33.214 > > PING 192.168.33.214 (192.168.33.214) 56(84) bytes of data. > > From 192.168.33.214 icmp_seq=3D1 Destination Port Unreachable -- It is = OK, > Active worked! > > ^C > > --- 192.168.33.214 ping statistics --- > > 6 packets transmitted, 0 received, +1 errors, 100% packet loss, time > 4999ms -- 6 Pings dropped. > > > > *But what we see in alert log:* > > > > 19/10/01-04:09:40.194939 [reset] [**] [8000:1:0] "icmp" [**] [Priority: 0= ] > {ICMP} 192.168.33.10 -> 192.168.33.214 > > > > Only 1 alert message. > > > > Okey, I wait for some time (more 1 minute) and send pings again: they > dropped and NO new entries in alert log. > > > > *3. If I remove stream_ip and stream_icmp* inspectors: all Ok, for each > dropped ping there are entries in alert.log. > > > > ping 192.168.33.214 > > PING 192.168.33.214 (192.168.33.214) 56(84) bytes of data. > > From 192.168.33.214 icmp_seq=3D1 Destination Port Unreachable > > From 192.168.33.214 icmp_seq=3D2 Destination Port Unreachable > > From 192.168.33.214 icmp_seq=3D3 Destination Port Unreachable > > From 192.168.33.214 icmp_seq=3D4 Destination Port Unreachable > > From 192.168.33.214 icmp_seq=3D5 Destination Port Unreachable > > > > Alert.log: > > 19/10/01-04:15:40.535491 [reset] [**] [8000:1:0] "icmp" [**] [Priority: 0= ] > {ICMP} 192.168.33.10 -> 192.168.33.214 > > 19/10/01-04:15:41.534852 [reset] [**] [8000:1:0] "icmp" [**] [Priority: 0= ] > {ICMP} 192.168.33.10 -> 192.168.33.214 > > 19/10/01-04:15:42.535242 [reset] [**] [8000:1:0] "icmp" [**] [Priority: 0= ] > {ICMP} 192.168.33.10 -> 192.168.33.214 > > 19/10/01-04:15:43.535235 [reset] [**] [8000:1:0] "icmp" [**] [Priority: 0= ] > {ICMP} 192.168.33.10 -> 192.168.33.214 > > 19/10/01-04:15:44.535043 [reset] [**] [8000:1:0] "icmp" [**] [Priority: 0= ] > {ICMP} 192.168.33.10 -> 192.168.33.214 > > > > > > > > > > > > > > > > =D0=B2=D1=82, 1 =D0=BE=D0=BA=D1=82. 2019 =D0=B3. =D0=B2 19:57, Steven Bai= gal (sbaigal) <[email protected]>: > > active response needs inline mode, add -Q to command line. > > If running tcp, add normalizer =3D { tcp =3D { ips =3D true, }, } > > If using pcap test for inline mode, use -Q --daq dump --daq-var > load-mode=3Dread-file > > > > > > *From: *Snort-devel <[email protected]> on behalf of > "Russ Combs (rucombs) via Snort-devel" <[email protected]> > *Reply-To: *"Russ Combs (rucombs)" <[email protected]> > *Date: *Tuesday, October 1, 2019 at 12:33 PM > *To: *Meridoff <[email protected]>, "[email protected]" < > [email protected]> > *Subject: *Re: [Snort-devel] snort3: reject rule problem > > > > What happens if you disable the active responses? Do you get multiple > alerts? It seems like the active response is working. > > > > *From: *Snort-devel <[email protected]> on behalf of > Meridoff via Snort-devel <[email protected]> > *Reply-To: *Meridoff <[email protected]> > *Date: *Tuesday, October 1, 2019 at 12:07 PM > *To: *"[email protected]" <[email protected]> > *Subject: *Re: [Snort-devel] snort3: reject rule problem > > > > >> That is per design =E2=80=93 the alert kicks off the active responses.= The > alert is logged, but the responses are not. > > I have many pings so it must be many alerts, but it's only one alert for > pings, when active response is ON. > > Is it normanl ? > > > > =D0=B2=D1=82, 1 =D0=BE=D0=BA=D1=82. 2019 =D0=B3. =D0=B2 17:42, Meridoff <= [email protected]>: > > I have many pings so it must be many alerts, but it's only one, when > active response is ON. > > Is it normanl ? > > > > =D1=87=D1=82, 26 =D1=81=D0=B5=D0=BD=D1=82. 2019 =D0=B3. =D0=B2 17:41, Rus= s Combs (rucombs) <[email protected]>: > > That is per design =E2=80=93 the alert kicks off the active responses. T= he alert > is logged, but the responses are not. > > > > *From: *Meridoff <[email protected]> > *Date: *Thursday, September 26, 2019 at 10:25 AM > *To: *"Russ Combs (rucombs)" <[email protected]> > *Subject: *Re: [Snort-devel] snort3: reject rule problem > > > > Thanks, it's became better - Host/Port Unreachable sent for each ping > packet now. > > > > BUT in log goes only 1st ping packet. For other ping packets - no alerts > in log.. > > > > I use active.min_interval =3D 1 > > So this settings fix problem with Active response pacekts, but in log onl= y > 1st alert for all cases.. > > > > =D1=87=D1=82, 26 =D1=81=D0=B5=D0=BD=D1=82. 2019 =D0=B3. =D0=B2 14:36, Rus= s Combs (rucombs) <[email protected]>: > > Take a look at the active module. Try configuring active.min_interval. > > > > Russ > > > > *From: *Snort-devel <[email protected]> on behalf of > Meridoff via Snort-devel <[email protected]> > *Reply-To: *Meridoff <[email protected]> > *Date: *Wednesday, September 25, 2019 at 5:39 PM > *To: *"[email protected]" <[email protected]> > *Subject: *[Snort-devel] snort3: reject rule problem > > > > Hello > > I have reject rule that send Port unreachable for ping. > > > > It's Ok, but only for 1st packet. > > > > The next ping packets are silently dropped and not detected and not logge= d. > > > > reject icmp 192.168.0.1 any -> any any ( gid:8000; sid:1; msg:"ping"; ) > > > > This happens when stream and stream_icmp inspectors are in config. > > > > If I remove stream {} and/or stream_icmp {} inspectors from snort lua con= fig, then ALL OK: each packet is > > dropped, logged and ICMP Port unreach is sending on each dropped packet. > > > > > > Part of config: > > > > stream=3D{} > > stream_icmp=3D{} > > reject=3D{control=3D"port"} > > > > Thanks. > > --000000000000a807ee0593ea263f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Ok, thanks.=C2=A0<br></div><br><div class=3D"gmail_quote">= <div dir=3D"ltr" class=3D"gmail_attr">=D0=B2=D1=82, 1 =D0=BE=D0=BA=D1=82. 2= 019 =D0=B3. =D0=B2 21:13, Russ Combs (rucombs) <<a href=3D"mailto:rucomb= [email protected]">[email protected]</a>>:<br></div><blockquote class=3D"gmail= _quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204= ,204);padding-left:1ex"> <div lang=3D"EN-US"> <div class=3D"gmail-m_1147519896978491629WordSection1"> <p class=3D"MsoNormal">That=E2=80=99s working as expected.=C2=A0 You aren= =E2=80=99t getting alerts because you aren=E2=80=99t getting packets.=C2=A0= If you want to alert on each one and block them individually, don=E2=80=99= t send the active response.<u></u><u></u></p> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> <div style=3D"border-right:none;border-bottom:none;border-left:none;border-= top:1pt solid rgb(181,196,223);padding:3pt 0in 0in"> <p class=3D"MsoNormal"><b><span style=3D"font-size:12pt;color:black">From: = </span></b><span style=3D"font-size:12pt;color:black">Snort-devel <<a hr= ef=3D"mailto:[email protected]" target=3D"_blank">snort-d= [email protected]</a>> on behalf of Meridoff via Snort-devel = <<a href=3D"mailto:[email protected]" target=3D"_blank">snort-= [email protected]</a>><br> <b>Reply-To: </b>Meridoff <<a href=3D"mailto:[email protected]" target= =3D"_blank">[email protected]</a>><br> <b>Date: </b>Tuesday, October 1, 2019 at 1:27 PM<br> <b>To: </b>"<a href=3D"mailto:[email protected]" target=3D"_= blank">[email protected]</a>" <<a href=3D"mailto:snort-de= [email protected]" target=3D"_blank">[email protected]</a>><= br> <b>Subject: </b>Re: [Snort-devel] snort3: reject rule problem<u></u><u></u>= </span></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <div> <div> <div> <div> <div> <div> <div> <div> <div> <div> <div> <div> <div> <div> <p class=3D"MsoNormal">I use IPS NFQ mode.=C2=A0<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal"><b>1. My config </b>=C2=A0(only important things sho= wed):<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> <div> <div> <p class=3D"MsoNormal">snort =3D { ["-e"] =3D true, ["-M&quo= t;] =3D true, ["--create-pidfile"] =3D true, ["-z"] =3D= 0, ["-Q"]=3Dtrue}<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">ips =3D { enable_builtin_rules =3D false, mode=3D&qu= ot;inline" }<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">wizard =3D default_wizard<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">snort["-z"]=3D1<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">alert_fast =3D {file=3Dtrue}<u></u><u></u></p> </div> <div> <div> <p class=3D"MsoNormal">stream=3D{}<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">stream_icmp=3D{}<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">stream_ip=3D{}<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">stream_tcp=3D{}<u></u><u></u></p> </div> </div> <div> <div> <p class=3D"MsoNormal">reject=3D{}<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">reject.control=3D"port"<u></u><u></u></p> </div> </div> <div> <p class=3D"MsoNormal">ips.rules =3D [[<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 include /var/cache/m.rules<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">]]<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal">m.rules:<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal">drop icmp 192.168.33.10 any -> any any ( gid:8000= ; msg:"icmp"; sid:1; =C2=A0)=C2=A0<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal"><b>Sending 4 pings </b>, have in alert log 4 entries= and packets dropped succesfully:<u></u><u></u></p> </div> </div> <div> <p class=3D"MsoNormal">19/10/01-04:08:08.089543 [drop] [**] [8000:1:0] &quo= t;icmp" [**] [Priority: 0] {ICMP} 192.168.33.10 -> 192.168.33.214<u= ></u><u></u></p> </div> <div> <div> <p class=3D"MsoNormal">19/10/01-04:08:09.097047 [drop] [**] [8000:1:0] &quo= t;icmp" [**] [Priority: 0] {ICMP} 192.168.33.10 -> 192.168.33.214<u= ></u><u></u></p> </div> <div> <p class=3D"MsoNormal">19/10/01-04:08:10.105488 [drop] [**] [8000:1:0] &quo= t;icmp" [**] [Priority: 0] {ICMP} 192.168.33.10 -> 192.168.33.214<u= ></u><u></u></p> </div> <div> <p class=3D"MsoNormal">19/10/01-04:08:11.113519 [drop] [**] [8000:1:0] &quo= t;icmp" [**] [Priority: 0] {ICMP} 192.168.33.10 -> 192.168.33.214<u= ></u><u></u></p> </div> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal"><b>2. Now I change </b>only 1 thing: the action of r= ule to "reject":<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal">reject =C2=A0icmp 192.168.33.10 any -> any any ( = gid:8000; msg:"icmp"; sid:1; =C2=A0)=C2=A0<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal"><b>Sending pings:</b><u></u><u></u></p> </div> <div> <div> <p class=3D"MsoNormal">zzz@host:~$ ping 192.168.33.214<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">PING 192.168.33.214 (192.168.33.214) 56(84) bytes of= data.<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">From 192.168.33.214 icmp_seq=3D1 Destination Port Un= reachable =C2=A0 -- It is OK, Active worked!<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">^C<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">--- 192.168.33.214 ping statistics ---<u></u><u></u>= </p> </div> <div> <p class=3D"MsoNormal">6 packets transmitted, 0 received, +1 errors, 100% p= acket loss, time 4999ms =C2=A0-- 6 Pings dropped.<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal"><b>But what we see in alert log:</b><u></u><u></u></= p> </div> <div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal">19/10/01-04:09:40.194939 [reset] [**] [8000:1:0] &qu= ot;icmp" [**] [Priority: 0] {ICMP} 192.168.33.10 -> 192.168.33.214<= u></u><u></u></p> </div> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal">Only 1 alert message.<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal">Okey, I wait for some time (more 1 minute) and send = pings again: they dropped and NO new entries in alert log.<u></u><u></u></p= > </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal"><b>3. If I remove stream_ip and stream_icmp</b> insp= ectors: all Ok, for each dropped ping there are entries in alert.log.<u></u= ><u></u></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <div> <p class=3D"MsoNormal">ping 192.168.33.214<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">PING 192.168.33.214 (192.168.33.214) 56(84) bytes of= data.<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">From 192.168.33.214 icmp_seq=3D1 Destination Port Un= reachable<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">From 192.168.33.214 icmp_seq=3D2 Destination Port Un= reachable<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">From 192.168.33.214 icmp_seq=3D3 Destination Port Un= reachable<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">From 192.168.33.214 icmp_seq=3D4 Destination Port Un= reachable<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">From 192.168.33.214 icmp_seq=3D5 Destination Port Un= reachable<u></u><u></u></p> </div> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal">Alert.log:=C2=A0<u></u><u></u></p> </div> <div> <div> <p class=3D"MsoNormal">19/10/01-04:15:40.535491 [reset] [**] [8000:1:0] &qu= ot;icmp" [**] [Priority: 0] {ICMP} 192.168.33.10 -> 192.168.33.214<= u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">19/10/01-04:15:41.534852 [reset] [**] [8000:1:0] &qu= ot;icmp" [**] [Priority: 0] {ICMP} 192.168.33.10 -> 192.168.33.214<= u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">19/10/01-04:15:42.535242 [reset] [**] [8000:1:0] &qu= ot;icmp" [**] [Priority: 0] {ICMP} 192.168.33.10 -> 192.168.33.214<= u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">19/10/01-04:15:43.535235 [reset] [**] [8000:1:0] &qu= ot;icmp" [**] [Priority: 0] {ICMP} 192.168.33.10 -> 192.168.33.214<= u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">19/10/01-04:15:44.535043 [reset] [**] [8000:1:0] &qu= ot;icmp" [**] [Priority: 0] {ICMP} 192.168.33.10 -> 192.168.33.214<= u></u><u></u></p> </div> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> <div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> <p class=3D"MsoNormal"><u></u>=C2=A0<u></u></p> <div> <div> <p class=3D"MsoNormal">=D0=B2=D1=82, 1 =D0=BE=D0=BA=D1=82. 2019 =D0=B3. =D0= =B2 19:57, Steven Baigal (sbaigal) <<a href=3D"mailto:[email protected]"= target=3D"_blank">[email protected]</a>>:<u></u><u></u></p> </div> <blockquote style=3D"border-top:none;border-right:none;border-bottom:none;b= order-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4= .8pt;margin-right:0in"> <div> <div> <p class=3D"MsoNormal">active response needs inline mode, add -Q to command= line.<u></u><u></u></p> <p class=3D"MsoNormal">If running tcp, add normalizer =3D { tcp =3D { ips = =3D true, }, }<u></u><u></u></p> <p class=3D"MsoNormal">If using pcap test for inline mode, use -Q --daq dum= p --daq-var load-mode=3Dread-file<u></u><u></u></p> <p class=3D"MsoNormal">=C2=A0<u></u><u></u></p> <p class=3D"MsoNormal">=C2=A0<u></u><u></u></p> <div style=3D"border-right:none;border-bottom:none;border-left:none;border-= top:1pt solid rgb(181,196,223);padding:3pt 0in 0in"> <p class=3D"MsoNormal"><b><span style=3D"font-size:12pt;color:black">From: </span></b><span style=3D"font-size:12pt;color:black">Snort-devel <<a hr= ef=3D"mailto:[email protected]" target=3D"_blank">snort-d= [email protected]</a>> on behalf of "Russ Combs (rucombs= ) via Snort-devel" <<a href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a>><br> <b>Reply-To: </b>"Russ Combs (rucombs)" <<a href=3D"mailto:ruc= [email protected]" target=3D"_blank">[email protected]</a>><br> <b>Date: </b>Tuesday, October 1, 2019 at 12:33 PM<br> <b>To: </b>Meridoff <<a href=3D"mailto:[email protected]" target=3D"_bla= nk">[email protected]</a>>, "<a href=3D"mailto:[email protected]= ort.org" target=3D"_blank">[email protected]</a>" <<a hre= f=3D"mailto:[email protected]" target=3D"_blank">snort-devel@list= s.snort.org</a>><br> <b>Subject: </b>Re: [Snort-devel] snort3: reject rule problem</span><u></u>= <u></u></p> </div> <div> <p class=3D"MsoNormal">=C2=A0<u></u><u></u></p> </div> <p class=3D"MsoNormal">What happens if you disable the active responses?=C2= =A0 Do you get multiple alerts?=C2=A0 It seems like the active response is = working.<u></u><u></u></p> <p class=3D"MsoNormal">=C2=A0<u></u><u></u></p> <div style=3D"border-right:none;border-bottom:none;border-left:none;border-= top:1pt solid rgb(181,196,223);padding:3pt 0in 0in"> <p class=3D"MsoNormal"><b><span style=3D"font-size:12pt;color:black">From: </span></b><span style=3D"font-size:12pt;color:black">Snort-devel <<a hr= ef=3D"mailto:[email protected]" target=3D"_blank">snort-d= [email protected]</a>> on behalf of Meridoff via Snort-devel = <<a href=3D"mailto:[email protected]" target=3D"_blank">snort-= [email protected]</a>><br> <b>Reply-To: </b>Meridoff <<a href=3D"mailto:[email protected]" target= =3D"_blank">[email protected]</a>><br> <b>Date: </b>Tuesday, October 1, 2019 at 12:07 PM<br> <b>To: </b>"<a href=3D"mailto:[email protected]" target=3D"_= blank">[email protected]</a>" <<a href=3D"mailto:snort-de= [email protected]" target=3D"_blank">[email protected]</a>><= br> <b>Subject: </b>Re: [Snort-devel] snort3: reject rule problem</span><u></u>= <u></u></p> </div> <div> <p class=3D"MsoNormal">=C2=A0<u></u><u></u></p> </div> <div> <div> <div> <div> <div> <p class=3D"MsoNormal" style=3D"margin-bottom:12pt">>> That is per de= sign =E2=80=93 the alert kicks off the active responses.=C2=A0 The alert is= logged, but the responses are not.<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">I have many pings so it must be many alerts, but it&= #39;s only one alert for pings, when active response is ON.=C2=A0<u></u><u>= </u></p> </div> <div> <p class=3D"MsoNormal">Is it normanl ?<u></u><u></u></p> </div> </div> </div> </div> </div> <p class=3D"MsoNormal">=C2=A0<u></u><u></u></p> <div> <div> <p class=3D"MsoNormal">=D0=B2=D1=82, 1 =D0=BE=D0=BA=D1=82. 2019 =D0=B3. =D0= =B2 17:42, Meridoff <<a href=3D"mailto:[email protected]" target=3D"_bla= nk">[email protected]</a>>:<u></u><u></u></p> </div> <blockquote style=3D"border-top:none;border-right:none;border-bottom:none;b= order-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin:5pt 0i= n 5pt 4.8pt"> <div> <div> <p class=3D"MsoNormal">I have many pings so it must be many alerts, but it&= #39;s only one, when active response is ON.=C2=A0<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">Is it normanl ?<u></u><u></u></p> </div> <p class=3D"MsoNormal">=C2=A0<u></u><u></u></p> <div> <div> <p class=3D"MsoNormal">=D1=87=D1=82, 26 =D1=81=D0=B5=D0=BD=D1=82. 2019 =D0= =B3. =D0=B2 17:41, Russ Combs (rucombs) <<a href=3D"mailto:rucombs@cisco= .com" target=3D"_blank">[email protected]</a>>:<u></u><u></u></p> </div> <blockquote style=3D"border-top:none;border-right:none;border-bottom:none;b= order-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin:5pt 0i= n 5pt 4.8pt"> <div> <div> <p class=3D"MsoNormal">That is per design =E2=80=93 the alert kicks off the= active responses.=C2=A0 The alert is logged, but the responses are not.<u>= </u><u></u></p> <p class=3D"MsoNormal">=C2=A0<u></u><u></u></p> <div style=3D"border-right:none;border-bottom:none;border-left:none;border-= top:1pt solid rgb(181,196,223);padding:3pt 0in 0in"> <p class=3D"MsoNormal"><b><span style=3D"font-size:12pt;color:black">From: </span></b><span style=3D"font-size:12pt;color:black">Meridoff <<a href= =3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>><b= r> <b>Date: </b>Thursday, September 26, 2019 at 10:25 AM<br> <b>To: </b>"Russ Combs (rucombs)" <<a href=3D"mailto:rucombs@c= isco.com" target=3D"_blank">[email protected]</a>><br> <b>Subject: </b>Re: [Snort-devel] snort3: reject rule problem</span><u></u>= <u></u></p> </div> <div> <p class=3D"MsoNormal">=C2=A0<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">Thanks, it's became better - Host/Port Unreachab= le sent for each ping packet now.=C2=A0 <u></u><u></u></p> <div> <p class=3D"MsoNormal">=C2=A0<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">BUT in log goes only 1st ping packet. For other ping= packets - no alerts in log..<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">=C2=A0<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">I use active.min_interval =3D 1<u></u><u></u></p> </div> <div> <p class=3D"MsoNormal">So this settings fix problem with Active response=C2= =A0pacekts, but in log only 1st alert for all cases..<u></u><u></u></p> </div> </div> <p class=3D"MsoNormal">=C2=A0<u></u><u></u></p> <div> <div> <p class=3D"MsoNormal">=D1=87=D1=82, 26 =D1=81=D0=B5=D0=BD=D1=82. 2019 =D0= =B3. =D0=B2 14:36, Russ Combs (rucombs) <<a href=3D"mailto:rucombs@cisco= .com" target=3D"_blank">[email protected]</a>>:<u></u><u></u></p> </div> <blockquote style=3D"border-top:none;border-right:none;border-bottom:none;b= order-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin:5pt 0i= n 5pt 4.8pt"> <div> <div> <p class=3D"MsoNormal">Take a look at the active module.=C2=A0 Try configur= ing active.min_interval.<u></u><u></u></p> <p class=3D"MsoNormal">=C2=A0<u></u><u></u></p> <p class=3D"MsoNormal">Russ<u></u><u></u></p> <p class=3D"MsoNormal">=C2=A0<u></u><u></u></p> <div style=3D"border-right:none;border-bottom:none;border-left:none;border-= top:1pt solid rgb(181,196,223);padding:3pt 0in 0in"> <p class=3D"MsoNormal"><b><span style=3D"font-size:12pt;color:black">From: </span></b><span style=3D"font-size:12pt;color:black">Snort-devel <<a hr= ef=3D"mailto:[email protected]" target=3D"_blank">snort-d= [email protected]</a>> on behalf of Meridoff via Snort-devel = <<a href=3D"mailto:[email protected]" target=3D"_blank">snort-= [email protected]</a>><br> <b>Reply-To: </b>Meridoff <<a href=3D"mailto:[email protected]" target= =3D"_blank">[email protected]</a>><br> <b>Date: </b>Wednesday, September 25, 2019 at 5:39 PM<br> <b>To: </b>"<a href=3D"mailto:[email protected]" target=3D"_= blank">[email protected]</a>" <<a href=3D"mailto:snort-de= [email protected]" target=3D"_blank">[email protected]</a>><= br> <b>Subject: </b>[Snort-devel] snort3: reject rule problem</span><u></u><u><= /u></p> </div> <div> <p class=3D"MsoNormal">=C2=A0<u></u><u></u></p> </div> <div> <div> <div> <div> <pre><span style=3D"color:black">Hello</span><u></u><u></u></pre> <pre><span style=3D"color:black">I have reject rule that send Port unreacha= ble for ping.</span><u></u><u></u></pre> <pre><span style=3D"color:black">=C2=A0</span><u></u><u></u></pre> <pre><span style=3D"color:black">It's Ok, but only for 1st packet.</spa= n><u></u><u></u></pre> <pre><span style=3D"color:black">=C2=A0</span><u></u><u></u></pre> <pre><span style=3D"color:black">The next ping packets are silently dropped= and not detected and not logged.</span><u></u><u></u></pre> <pre><span style=3D"color:black">=C2=A0</span><u></u><u></u></pre> <pre><span style=3D"color:black">reject icmp 192.168.0.1 any -> any any = ( gid:8000; sid:1; msg:"ping";=C2=A0 )</span><u></u><u></u></pre> <pre><span style=3D"color:black">=C2=A0</span><u></u><u></u></pre> <pre><span style=3D"color:black">This happens when stream and stream_icmp i= nspectors are in config.</span><u></u><u></u></pre> <pre><span style=3D"color:black">=C2=A0</span><u></u><u></u></pre> <pre><span style=3D"color:black">If I remove stream {} and/or stream_icmp {= } inspectors from snort lua config, then ALL OK: each packet is</span><u></= u><u></u></pre> <pre><span style=3D"color:black">dropped, logged and ICMP Port unreach is s= ending on each dropped packet.</span><u></u><u></u></pre> <pre><span style=3D"color:black">=C2=A0</span><u></u><u></u></pre> <pre><span style=3D"color:black">=C2=A0</span><u></u><u></u></pre> <pre><span style=3D"color:black">Part of config:</span><u></u><u></u></pre> <pre><span style=3D"color:black">=C2=A0</span><u></u><u></u></pre> <pre><span style=3D"color:black">stream=3D{}</span><u></u><u></u></pre> <pre><span style=3D"color:black">stream_icmp=3D{}</span><u></u><u></u></pre= > <pre><span style=3D"color:black">reject=3D{control=3D"port"}</spa= n><u></u><u></u></pre> <pre><span style=3D"color:black">=C2=A0</span><u></u><u></u></pre> <pre><span style=3D"color:black">Thanks.</span><u></u><u></u></pre> </div> </div> </div> </div> </div> </div> </blockquote> </div> </div> </div> </blockquote> </div> </div> </blockquote> </div> </div> </div> </blockquote> </div> </div> </div> </blockquote></div> --000000000000a807ee0593ea263f-- --===============4384536172500204577== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-devel mailing list [email protected] https://lists.snort.org/mailman/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort! --===============4384536172500204577==--