Re: Something may wrong with my configuration, someone can help me???Please tell where my configuration was wrong!

Thanks! When i configured as the deamon, it works very well now.



At 2021-12-16 02:55:32, "Steven Baigal (sbaigal)" <[email protected]> wrote:

Please take a look this demo test for capturing file from http traffic:

 

https://github.com/snort3/snort3_demo/blob/master/tests/inspectors/file_id_file_log/snort.lua

 

to enable capture, add  enable_file_capture = true to file type 22:

{  when = { file_type_id = 22 }, use = { verdict = 'log', enable_file_signature = true, enable_file_capture = true } },

 

Run command:

 

snort -c snort.lua -r http_noblock.pcap -A csv -k none

 

I have tried this test and it captured the PDF file.

 

 

 

From: wuhenzhiyue <[email protected]>
Date: Wednesday, December 15, 2021 at 6:08 AM
To: Steven Baigal (sbaigal) <[email protected]>
Cc: [email protected] <[email protected]>
Subject: Re:Re: [Snort-users] Something may wrong with my configuration, someone can help me???Please tell where my configuration was wrong!

First, thanks a lot.But Second, apologize for reply so late.Last, i haven add "wizard = default_wizard", but it seems doesn't work too. We i try more, i found that if the file size is larger than 300 bytes nearly, it couldn't work. If the file is 79 bytes, and the direction is down, it works well. Could you give me some mind?
Best regards ,

At 2021-12-07 07:15:52, "Steven Baigal (sbaigal)" <[email protected]> wrote:

I don’t see binder configuration from you snort.lua file. Try to add:

 

wizard = default_wizard

 

From: Snort-users <[email protected]> on behalf of wuhenzhiyue via Snort-users <[email protected]>
Date: Monday, December 6, 2021 at 1:20 PM
To: [email protected] <[email protected]>
Subject: [Snort-users] Something may wrong with my configuration, someone can help me???Please tell where my configuration was wrong!

Hello anybody

    When i used snort 3.1.0.0 or 3.1.10.0 to capture file or match file_type with ftp and NFQUEUE in inline mode, it don't work! I don't know why. There is no any error., i also tried to get file from http pcap, but nothing happened. This's my usage and configs which deferent from default:

    1. iptabes config:

        iptables -t mangle -A INPUT -p tcp -j NFQUEUE

    2. ftp server in my host(just input without forward):

        vsfpt

    3. start snort command:

        snort -Q --daq nfq --daq-var queue_maxlen=655350 -c /usr/local/etc/snort/snort.lua --tweaks security -A alert_fast -R /.../local.rules --wall-all -l /home/../snortLog -v

    4. local.rules config:

        .......

        alert tcp any any <> any any (msg: "Test.... "; file_type: "RAR"; sid: 30; rev: 1;)

        alert tcp any any <> any any (msg: "1111111111"; service: ftp-data; ftp_data; file_type: "RAR"; sid: 31; rev: 1)

        ......

    5. snort.lua config:

active = {device = "ens33", }

detection = {pcre_override = true, pcre_enable = true,}

 

trace = {
    output = stdout,
    modules = {
        file_id = { all = 1, }

    }
}

stream = {}

stream.file_cache = {

    cap_weight = 65525,

    idle_timeout = 180

}

 

stream_ip = {}

stream_tcp = {}

stream_udp = {}

stream_icmp = {}

stream_user = {}

stream_file = {upload = true}

......

http_inspect = {}

http2_inspect = {}

......

normalizer = {

   ip4 = {base = false},

   tcp = {ips = true, ecn = 'stream'}

}

......

telnet = {

    encryted_traffic = true,

    chech_encryted = true,

    normalize = true

}

dce_smb = {

    smb_file_inspection = 'on',

    smb_file_depth = 0,

}

......

ftp_server = default_ftp_server

ftp_client = {}

ftp_data = {}

 

file_id = {

   enable_signature = true,

   enable_type = true,

   enable_capture = true,

 

   trace_type = true,

   trace_signature = true,

   trace_stream = true,

 

   --include('file_magic.lua') is configured by defualt

   file_rules = file_magic,

   file_policy = {

       {when = {file_type_id = 21}, use = {verdict = 'log', enable_file_capture = true}},

      {when = {file_type_id = 30}, use = {verdict = 'log', enable_file_capture = true}},

      {when = {file_type_id = 320}, use = {verdict = 'log', enable_file_capture = true}}

    }

 

  --defualt

  type_depth = 56384,

  signature_depth = 10485760,

  max_files_cashed = 65535,

 

  show_data_depth = 1000,

  capture_memcap = 100,

  capture_max_size = 10485760,

}

......

ips = {

  mode = 'inline'.

  variables = default_variables

}

reject = {reset = "both", control = "all"}

......

alert_fast = {file = true}

alert_syslog = {

  facility = 'user',

  level = 'warning'

}

 

log_codecs = {file = true}

log_hext = {file = true, raw = true}

file_log = {

  log_pkt_time = true,

  log_sys_time = false

}

 

  6. security.lua config:

  arp_spoof = nil

  ftp_server.check_encrypted = true

  detection = {

     pcre_match_limit = 3500,

     pcre_match_recursion = 3500

   }

  ........

  http_inspect.unzip = true

  ......

  port_scan = nil

  .......

  stream_ip.min_frag_length = 100

  stream_ip.max_overlaps = 0

  stream_ip.max_frags = 8192

  stream_ip.policy = linux

  stream_ip.session_timeout = 30

  stream_ip.min_ttl = 1

  stream_ip.min_frag_length = 0

 

  stream.ip_frags_only = false

  stream.held_packet_timeout = 1000

  stream_max_flows = 476288

  stream_pruning_timeout = 30

 

  stream_tcp.overla_limit = 0

  stream_tcp.max_pdu = 4380

  stream_tcp.max_window = 0

  stream_tcp.track_only = false

  stream_tcp.policy = linux

  stream_tcp.show_rebuilt_packets = true

  stream_tcp.reassemble_async = true

 

  stream_user.session_timeout = 30

 

    stream.ip_cache = {cap_weight = 11000, idle_timeout = 180 }

    stream.tcp_cache = {cap_weight = 65535, idle_timeout = 3600}

stream.ip_cache = {cap_weight = 11000, idle_timeout = 180 }

    stream.file_cache = {cap_weight = 64, idle_timeout = 180 }

    stream_tcp.queue_limit = {max_bytes = 10485760, max_segments = 2621}

    stream_tcp.small_segments = {count = 3, maximum_size = 150}

......

Best regards ,

Weiran

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette