IPS in Snort. Snort shows that packets are being dropped, but the attacking machine says no packet loss?

Hey all. Hope i am asking this question in the right section. I am a totally Snort newbie, so bear with me. I am trying to explain the problem as good as i can. But feel free to ask questions if i am missing something! I have posted this question too on Stackoverflow: https://stackoverflow.com/questions/70278978/ips-in-snort-snort-shows-that-packets-are-being-dropped-but-the-attacking-mach


I am trying to use Snort as an IPS system on a virtual machine for a project i am working on. I am using Ubuntu 20.04 as the machine running Snort in Oracle VirtualBox.

I have looked at many different guides on the internet, but i just can't get it to work right. So far i think i have enabled inline mode correctly with allowing multiple network interfaces from Virtualbox to the Ubuntu machine.

I have 3 network interfaces available:

enp0s3, enp0s8 and enp0s9.


I have enabled inline mode in the snort.conf file with writing: config daq: afpacket and config daq_mode: inline I have run a test on the command line: Sudo snort -T -c /etc/snort/snort.conf -Q -i enp0s3:enp0s8 and it says it is ok.


I have an alert test script/function called: alert icmp any any -> 192.168.87.106 any (msg:"TEST"; sid:100000; rev: 1) and it is working fine.

But when i am trying to make a drop script/function i am getting problems. My idea was trying to prevent Ping Flooding by blocking them. But so far i think i can't get it to drop any ping/icmp packets.


My test function to block the ping packets are: drop icmp any any -> any any (msg:"TEST"; sid:2001432) I am starting Snort in the terminal with this line:
sudo snort -A console -Q -c /etc/snort/snort.conf -i enp0s3:enp0s9 -N and it seems to start okay.


THE PROBLEM: So the problem is when i am pinging from the attacking machine, it says in Snort that the packages are being drop from the function i wrote earlier. But when i am going on my attacking machine, it says that the ping is completed with no packet loss. So i am kinda lost here. See the pictures below please.


Thanks in advance!


IDS console picture: https://i.stack.imgur.com/Hcows.png
Ping from my Windows machine picture: https://i.stack.imgur.com/75TGW.png
Network interfaces available picture: https://i.stack.imgur.com/mxd3L.png
Snort config file picture: https://i.stack.imgur.com/t6EBL.png

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette