Re: Snort 2.9.7.0 on Ubuntu 20.04.2 LTS problem, please help

See the thread below. Another user had a similar issue that was answered before:



Hello,
     Are you able to ping the destination machine from the source machine when snort is NOT running? If you are .. then snort is not inline.
If should be like this..

SRC eth1 ------> enp0s3 - SNORT - enp0s8 <------ DST eth1.

Snort should be the bridge that connects the two network segments.

So in your case…

SRC eth1 and enp0s3 from snort should be on one segment. And DST eth1 and snort enp0s8 interface should be on the other.

If you wanted to add IP’s .. eth1 from SRC should / could have 1.1.1.1 and DST eth1 could have 1.1.1.2.

Once snort is up and running they should be able to reach each other. If snort is not running and they can ping.. its not inline.

Hope this helps.

Thanks.

Albert Lewis
ENGINEER.SOFTWARE ENGINEERING
Cisco Systems Inc.
Email: [email protected]


From: Snort-users <[email protected]> on behalf of Kris Kristensen via Snort-users <[email protected]>
Reply-To: Kris Kristensen <[email protected]>
Date: Thursday, December 9, 2021 at 1:45 PM
To: "[email protected]" <[email protected]>
Subject: [Snort-users] IPS in Snort. Snort shows that packets are being dropped, but the attacking machine says no packet loss?
Hey all. Hope i am asking this question in the right section. I am a totally Snort newbie, so bear with me. I am trying to explain the problem as good as i can. But feel free to ask questions if i am missing something! I have posted this question too on Stackoverflow: https://stackoverflow.com/questions/70278978/ips-in-snort-snort-shows-that-packets-are-being-dropped-but-the-attacking-mach

I am trying to use Snort as an IPS system on a virtual machine for a project i am working on. I am using Ubuntu 20.04 as the machine running Snort in Oracle VirtualBox.

I have looked at many different guides on the internet, but i just can't get it to work right. So far i think i have enabled inline mode correctly with allowing multiple network interfaces from Virtualbox to the Ubuntu machine.

I have 3 network interfaces available:

enp0s3, enp0s8 and enp0s9.
I have enabled inline mode in the snort.conf file with writing: config daq: afpacket and config daq_mode: inline I have run a test on the command line: Sudo snort -T -c /etc/snort/snort.conf -Q -i enp0s3:enp0s8 and it says it is ok.


I have an alert test script/function called: alert icmp any any -> 192.168.87.106 any (msg:"TEST"; sid:100000; rev: 1) and it is working fine.

But when i am trying to make a drop script/function i am getting problems. My idea was trying to prevent Ping Flooding by blocking them. But so far i think i can't get it to drop any ping/icmp packets.


My test function to block the ping packets are: drop icmp any any -> any any (msg:"TEST"; sid:2001432) I am starting Snort in the terminal with this line:
sudo snort -A console -Q -c /etc/snort/snort.conf -i enp0s3:enp0s9 -N and it seems to start okay.


THE PROBLEM: So the problem is when i am pinging from the attacking machine, it says in Snort that the packages are being drop from the function i wrote earlier. But when i am going on my attacking machine, it says that the ping is completed with no packet loss. So i am kinda lost here. See the pictures below please.


Thanks in advance!

IDS console picture: https://i.stack.imgur.com/Hcows.png
Ping from my Windows machine picture: https://i.stack.imgur.com/75TGW.png
Network interfaces available picture: https://i.stack.imgur.com/mxd3L.png
Snort config file picture: https://i.stack.imgur.com/t6EBL.png


Albert Lewis
ENGINEER.SOFTWARE ENGINEERING
Cisco Systems Inc.
Email: [email protected]<mailto:[email protected]>



From: "Al Lewis (allewi)" <[email protected]>
Date: Thursday, January 6, 2022 at 11:44 PM
To: lukasz pastewski <[email protected]>, "[email protected]" <[email protected]>
Subject: Re: [Snort-users] Snort 2.9.7.0 on Ubuntu 20.04.2 LTS problem, please help

Snort is not inline and wont see traffic between other hosts. For that to happen you need to force it inline (where ALL traffic goes through snort.. in one interface and out the other) or span the traffic to snort from your switch.


Albert Lewis
ENGINEER.SOFTWARE ENGINEERING
Cisco Systems Inc.
Email: [email protected]<mailto:[email protected]>



From: Snort-users <[email protected]> on behalf of lukasz pastewski <[email protected]>
Date: Thursday, January 6, 2022 at 2:42 AM
To: "[email protected]" <[email protected]>
Subject: [Snort-users] Snort 2.9.7.0 on Ubuntu 20.04.2 LTS problem, please help

Hello, everybody,
Firstly, I am a beginner concerning SNORT. Please help me to solve my problem. I installed snort 2.9.7.0 on Ubuntu 20.04.2 LTS. After installing I configured everything according to documentation. Snort is set to promisc mode. It was installed on a machine connected to my network. The network consists of server computers (PDC, database servers, terminals etc.), about fifty workstations as well as switches (one of them is managed). The network infrastructure looks like below:
|
The Internet ---> router (pfsense) ---> SWITCH ---> workstations
|
So, my problem is like following:
If I do nmap, icmp etc. tests in my inner network, snort catches only queries concerning its local IP. For example if I scan computer B (x.x.x.z) using nmap from computer A (x.x.x.x) , snort (x.x.x.a) does not report the scanning (pings too). However pinging or scanning x.x.x.a (snort) from another place in the network is visible in snort logs. I’ve tried to connect my snort using port mirroring but the result is the same.
It is interesting the snort logs show some information, for example connections between workstation and a db server.
So please help.

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette