Re: Problems with snort 2.9 nfq inline

Subsequent investigation revealed that the packets were passing
through after several retransmissions by the kernel.
It seems that the difference in the time taken for the packet to pass
between 2.9.11.2 or earlier and 2.9.12 or later was the reason why the
packet appeared to be blocked in 2.9.11.2 or earlier.
I also noticed that RST packets from Snort's Active Response were not
reaching the communicating source client.

The following is the first part of the communication, as retrieved by
the LOG module of iptables.

Dec 17 15:47:56 rp401a kernel: IN= OUT=eth0 SRC=10.0.3.51
DST=10.0.10.8 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=14656 DF PROTO=TCP
SPT=48254 DPT=8000 WINDOW=26883 RES=0x00 SYN URGP=0 UID=0 GID=0
Dec 17 15:47:56 rp401a kernel: IN=eth0 OUT=
MAC=06:5e:69:86:53:2d:06:e4:ff:70:e9:8b:08:00 SRC=10.0.10.8
DST=10.0.3.51 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP
SPT=8000 DPT=48254 WINDOW=26847 RES=0x00 ACK SYN URGP=0 UID=0 GID=0
Dec 17 15:47:56 rp401a kernel: IN= OUT=eth0 SRC=10.0.3.51
DST=10.0.10.8 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=14657 DF PROTO=TCP
SPT=48254 DPT=8000 WINDOW=211 RES=0x00 ACK URGP=0 UID=0 GID=0
Dec 17 15:47:56 rp401a kernel: IN= OUT=eth0 SRC=10.0.3.51
DST=10.0.10.8 LEN=151 TOS=0x00 PREC=0x00 TTL=64 ID=14658 DF PROTO=TCP
SPT=48254 DPT=8000 WINDOW=211 RES=0x00 ACK PSH URGP=0 UID=0 GID=0
Dec 17 15:47:56 rp401a kernel: IN=lo OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=10.0.10.8
DST=10.0.3.51 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=64231 PROTO=TCP
SPT=8000 DPT=48254 WINDOW=0 RES=0x00 ACK RST URGP=0
Dec 17 15:47:56 rp401a kernel: IN= OUT=eth0 SRC=10.0.3.51
DST=10.0.10.8 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=62078 PROTO=TCP
SPT=48254 DPT=8000 WINDOW=0 RES=0x00 ACK RST URGP=0 UID=0 GID=0
Dec 17 15:47:56 rp401a kernel: IN= OUT=eth0 SRC=10.0.3.51
DST=10.0.10.8 LEN=151 TOS=0x00 PREC=0x00 TTL=64 ID=14659 DF PROTO=TCP
SPT=48254 DPT=8000 WINDOW=211 RES=0x00 ACK PSH URGP=0 UID=0 GID=0
...

Is there any way to make inline mode work with NFQ on a host that has
only one IP address assigned to it?
It may be possible to time out the communication by setting
net.ipv4.tcp_retries2 to a smaller value, but I am looking for a
better way.

Best regards,
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette