Re: Slow FTP on inline Snort3

Hi,

 

From the command line I run the below:

snort --lua “ftp_server=nil”

snort --lua “ftp_client=nil”

snort --lua “ftp_data=nil”

 

But the ftp slowness issue persist.

Moreover I have module profiler  enabled so when restarting snort I can
still see ftp_data in my logs as per the below

 

module profile (all, depth 255, sorted by total_time)

#                      module layer    checks   time(us)  avg/check
%/caller  %/total

=                      ====== =====    ======   ========  =========
========  =======

  1                        daq     1   3850698  437754092        113
86.34    86.34

  2                      appid     1   2283539   14758960          6
2.91     2.91

  3                  rule_eval     1   2289183   13833401          6
2.73     2.73

  4                       mpse     1   8427958   11170357          1
2.20     2.20

  5                      other     1   2283893   10085088          4
1.99     1.99

  6                     stream     1   2283539    7243892          3
1.43     1.43

  7                  port_scan     1   2283539    5104398          2
1.01     1.01

  8                     decode     1   2283898    2090235          0
0.41     0.41

  9                 stream_udp     1   2232655    1128173          0
0.22     0.22

  10                    binder     1    780599    1118263          1
0.22     0.22

  11                       dns     1   2235368     899964          0
0.18     0.18

  12              back_orifice     1   2232655     807899          0
0.16     0.16

  13                    eventq     1   3077527     335708          0
0.07     0.07

  14                normalizer     1   2283534     329377          0
0.06     0.06

  15                stream_tcp     1     28114     205986          7
0.04     0.04

  16                reputation     1    780604     113530          0
0.02     0.02

  17                       paf     1      5105       5266          1
0.00     0.00

  18                 arp_spoof     1       359        427          1
0.00     0.00

  19                    wizard     1        64        237          3
0.00     0.00

  20                 stream_ip     1        10         60          6
0.00     0.00

  21                  ftp_data     1         1          3          3
0.00     0.00

--                      total    --   2283893  506985326        221
--   100.00

 

From: Steven Baigal (sbaigal) <[email protected]> 
Sent: Tuesday, December 7, 2021 5:38 PM
To: Mohammad Hachem <[email protected]>; [email protected]
Subject: Re: [Snort-users] Slow FTP on inline Snort3

 

To disable ftp, you can set ftp module to nil, from command line:

--lua “ftp_server = nil” or include a lua file at the end of your
configuration:

 

if  ftp_server ~= nil then

   ftp_server = nil

   ftp_data = nil

   ftp_client = nil

end

 

From: Snort-users <[email protected]
<mailto:[email protected]> > on behalf of Mohammad Hachem
<[email protected] <mailto:[email protected]> >
Date: Tuesday, December 7, 2021 at 8:03 AM
To: [email protected] <mailto:[email protected]>
<[email protected] <mailto:[email protected]> >
Subject: [Snort-users] Slow FTP on inline Snort3

Hi,

 

I have a Snort3 running in inline mode and only rules related to DNS traffic
are enabled.

I noticed that when ftp traffic is passing through snort it’s getting
significantly slower.

I checked snort and alerts logs and nothing related to ftp was found.

The only thing that I can think about that could cause this issue is the
ftp_server and ftp_client inspector which are enabled by default on Snort.

I commented out the below 2 lines in my snort configuration file to try to
disable these modules, but they are still running

    --{ when = { service = 'ftp' },              use = { type = 'ftp_server'
} },

    --{ when = { service = 'ftp-data' },         use = { type = 'ftp_data' }
},

 

Any idea what is the appropriate configuration to apply in order to disable
these inspectors and is there any other modules on snort that could be
causing this ftp slowness issue.

 

Regards,

Mohammad Hachem

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette