Re: Snort Configuration
Joel Esler via Snort-users <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <[email protected]> |
These are not “false alerts”. They are preprocessor alerts. Snort doesn’t “make alerts up”, so the things that caused those preprocessor alerts to fire are actually in the traffic. I also wouldn’t classify a dataset from 2017 as “new”. So I am unclear in what you are trying to test. The community ruleset is a ruleset that is created by and for the community and is licensed under the gplv2. If you are going to test something (not sure what you are testing), I would test given the registered or the subscriber ruleset. > On Jan 18, 2022, at 4:37 PM, Eni Sinanaj via Snort-users <[email protected]> wrote: > > Hello, > I’m currently writing my bachelors thesis on how well snort performs on new datasets. I’m running snort against the CIC IDS 2017 Dataset and the Tuesday.pcap dataset is about 7G and it contains multiple brute Force attacks. Snort uses the community ruleset to sniff out the attacks, but all I get are decoder and preprocesses alerts. > > The command : > sudo snort -q --talos -c /usr/local/etc/snort/snort.lua -R ~/Downloads/snort3-community-rules/snort3-community.rules -r ~/Tuesday-WorkingHours.pcap.1 > > Output: [112:1:1] (arp_spoof) unicast ARP request (alerts: 16027) > [116:414:1] (ipv4) IPv4 packet to broadcast dest address (alerts: 1081) > [116:441:1] (icmp4) ICMP destination unreachable communication administratively prohibited (alerts: 3) > [116:442:1] (icmp4) ICMP destination unreachable communication with destination host is administratively prohibited (alerts: 72) > [116:444:1] (ipv4) IPv4 option set (alerts: 40) > [119:104:1] (http_inspect) HTTP response has UTF character set that failed to normalize (alerts: 2) > [119:13:1] (http_inspect) HTTP start line or header line terminated by LF without a CR (alerts: 5) > [119:15:1] (http_inspect) URI path contains a segment that is longer than the oversize_dir_length parameter (alerts: 4) > [119:19:1] (http_inspect) HTTP header line exceeds 4096 bytes (alerts: 2) > [119:1:1] (http_inspect) URI has percent-encoding of an unreserved character (alerts: 36) > [119:201:1] (http_inspect) not HTTP traffic or unrecoverable HTTP protocol error (alerts: 20) > [119:209:1] (http_inspect) format error in HTTP header (alerts: 2) > [119:212:1] (http_inspect) unrecognized type of percent encoding in URI (alerts: 3) > [119:221:1] (http_inspect) status code implying no body combined with Transfer-Encoding or nonzero Content-Length (alerts: 9) > [119:226:1] (http_inspect) unknown Content-Encoding used (alerts: 6) > [119:228:1] (http_inspect) server response before client request (alerts: 283) > [119:241:1] (http_inspect) Content-Transfer-Encoding used as HTTP header (alerts: 1123) > [119:260:1] (http_inspect) HTTP Content-Length message body was truncated (alerts: 2516) > [119:261:1] (http_inspect) HTTP chunked message body was truncated (alerts: 457) > [119:2:1] (http_inspect) URI is percent encoded and the result is percent encoded again (alerts: 122) > [119:6:1] (http_inspect) URI has two-byte or three-byte UTF-8 encoding (alerts: 99) > [119:8:1] (http_inspect) URI path contains consecutive slash characters (alerts: 168) > [122:15:1] (port_scan) IP filtered protocol sweep (alerts: 167) > [122:19:1] (port_scan) UDP portsweep (alerts: 1) > [122:1:1] (port_scan) TCP portscan (alerts: 8) > [122:21:1] (port_scan) UDP filtered portscan (alerts: 12) > [122:23:1] (port_scan) UDP filtered portsweep (alerts: 257) > [122:3:1] (port_scan) TCP portsweep (alerts: 183) > [122:7:1] (port_scan) TCP filtered portsweep (alerts: 7) > [123:8:1] (stream_ip) fragmentation overlap (alerts: 2) > [125:5:1] (ftp_server) FTP command parameters contained potential string format (alerts: 2) > [129:14:1] (stream_tcp) TCP timestamp is missing (alerts: 41) > [129:15:1] (stream_tcp) reset outside window (alerts: 1076) > [129:18:1] (stream_tcp) data sent on stream after TCP reset received (alerts: 236) > [129:1:1] (stream_tcp) SYN on established session (alerts: 1) > [129:3:1] (stream_tcp) data sent on stream not accepting data (alerts: 54) > [129:4:1] (stream_tcp) TCP timestamp is outside of PAWS window (alerts: 16) > [129:8:1] (stream_tcp) data sent on stream after TCP reset sent (alerts: 7) > [133:52:1] (dce_smb) SMB - deprecated dialect negotiated (alerts: 188) > [137:1:1] (ssl) invalid client HELLO after server HELLO detected (alerts: 25) > [137:2:1] (ssl) invalid server HELLO without client HELLO detected (alerts: 2) > rule profile (all, sorted by total_time) > # gid sid rev checks matches alerts time (us) avg/check avg/match avg/non-match timeouts suspends > = === === === ====== ======= ====== ========= ========= ========= ============= ======== ======== > 1 1300052 1 47329 0 0 101738 2 0 2 0 0 > 2 1 27144 3 27903 0 0 36395 1 0 1 0 0 > 3 1 3136 11 4097 0 0 24682 6 0 6 0 0 > 4 1 3140 11 4097 0 0 24682 6 0 6 0 0 > 5 1 16406 20 3003 0 0 20103 6 0 6 0 0 > 6 1 3138 11 4097 0 0 17234 4 0 4 0 0 > 7 1 3142 11 4097 0 0 17234 4 0 4 0 0 > 8 1 17380 23 1739 0 0 13902 7 0 7 0 0 > 9 1 20480 21 1577 0 0 10060 6 0 6 0 0 > 10 1 27865 7 757 0 0 6299 8 0 8 0 0 > 11 1 20478 22 863 0 0 5815 6 0 6 0 0 > 12 1 20483 22 1384 0 0 4451 3 0 3 0 0 > 13 1 22044 9 2950 0 0 3872 1 0 1 0 0 > 14 1 26251 12 1383 0 0 3856 2 0 2 0 0 > 15 1 41499 6 6825 0 0 3777 0 0 0 0 0 > 16 1 25515 11 29 0 0 3009 103 0 103 0 0 > 17 1 52057 1 26 0 0 2998 115 0 115 0 0 > 18 1 29189 5 1033 0 0 2295 2 0 2 0 0 > 19 1 30786 4 132 0 0 2291 17 0 17 0 0 > 20 1 30780 4 69 0 0 2116 30 0 30 0 0 > 21 1 30779 4 66 0 0 2075 31 0 31 0 0 > 22 1 30784 4 81 0 0 1590 19 0 19 0 0 > 23 1 30783 4 110 0 0 1581 14 0 14 0 0 > 24 1 25513 12 178 0 0 1500 8 0 8 0 0 > 25 1 42820 2 313 0 0 1333 4 0 4 0 0 > 26 1 30785 4 98 0 0 1321 13 0 13 0 0 > 27 1 30777 4 49 0 0 1221 24 0 24 0 0 > 28 1 21498 16 147 0 0 1202 8 0 8 0 0 > 29 1 43003 8 376 0 0 1185 3 0 3 0 0 > 30 1 30778 4 49 0 0 1184 24 0 24 0 0 > 31 1 21499 11 1901 0 0 1127 0 0 0 0 0 > 32 1 58751 3 833 0 0 1099 1 0 1 0 0 > 33 1 45966 1 3378 0 0 1047 0 0 0 0 0 > 34 1 21613 16 1181 0 0 986 0 0 0 0 0 > 35 1 21908 11 1139 0 0 956 0 0 0 0 0 > 36 1 32386 4 43 0 0 747 17 0 17 0 0 > 37 1 30973 7 235 0 0 732 3 0 3 0 0 > 38 1 24455 12 173 0 0 685 3 0 3 0 0 > 39 1 30220 6 43 0 0 665 15 0 15 0 0 > 40 1 42256 7 383 0 0 645 1 0 1 0 0 > 41 1 21728 12 916 0 0 633 0 0 0 0 0 > 42 1 21288 14 297 0 0 572 1 0 1 0 0 > 43 1 17733 18 56 0 0 498 8 0 8 0 0 > 44 1 28596 4 43 0 0 478 11 0 11 0 0 > 45 1 22043 8 58 0 0 418 7 0 7 0 0 > 46 1 47567 2 205 0 0 405 1 0 1 0 0 > 47 1 30782 4 95 0 0 375 3 0 3 0 0 > 48 1 58744 5 166 0 0 354 2 0 2 0 0 > 49 1 16407 20 64 0 0 320 5 0 5 0 0 > 50 1 43004 5 372 0 0 307 0 0 0 0 0 > 51 1 49090 1 372 0 0 307 0 0 0 0 0 > 52 1 20965 14 64 0 0 258 4 0 4 0 0 > 53 1 2419 30 22 0 0 242 11 0 11 0 0 > 54 1 16425 24 16 0 0 228 14 0 14 0 0 > 55 1 21725 12 298 0 0 209 0 0 0 0 0 > 56 1 21909 12 150 0 0 176 1 0 1 0 0 > 57 1 38951 2 281 0 0 173 0 0 0 0 0 > 58 1 50445 1 16 0 0 173 10 0 10 0 0 > 59 1 33825 7 140 0 0 88 0 0 0 0 0 > 60 1 30515 11 132 0 0 80 0 0 0 0 0 > 61 1 40035 10 9 0 0 70 7 0 7 0 0 > 62 1 47338 1 27 0 0 69 2 0 2 0 0 > 63 1 2422 31 6 0 0 66 11 0 11 0 0 > 64 1 20463 26 9 0 0 63 7 0 7 0 0 > 65 1 24359 9 136 0 0 55 0 0 0 0 0 > 66 1 47016 1 22 0 0 54 2 0 2 0 0 > 67 1 29386 15 62 0 0 53 0 0 0 0 0 > 68 1 30517 11 150 0 0 42 0 0 0 0 0 > 69 1 21727 12 11 0 0 40 3 0 3 0 0 > 70 1 30516 11 95 0 0 38 0 0 0 0 0 > 71 1 30906 3 9 0 0 37 4 0 4 0 0 > 72 1 21734 12 42 0 0 36 0 0 0 0 0 > 73 1 22045 10 18 0 0 29 1 0 1 0 0 > 74 1 21035 17 21 0 0 25 1 0 1 0 0 > 75 1 21856 13 23 0 0 24 1 0 1 0 0 > 76 1 21730 12 39 0 0 22 0 0 0 0 0 > 77 1 21696 13 16 0 0 19 1 0 1 0 0 > 78 1 30510 8 6 0 0 18 3 0 3 0 0 > 79 1 30520 9 6 0 0 18 3 0 3 0 0 > 80 1 29864 2 17 0 0 18 1 0 1 0 0 > 81 1 29385 15 13 0 0 16 1 0 1 0 0 > 82 1 30514 11 96 0 0 16 0 0 0 0 0 > 83 1 19211 23 1 0 0 14 14 0 14 0 0 > 84 1 20850 17 7 0 0 13 1 0 1 0 0 > 85 1 28430 4 1 0 0 12 12 0 12 0 0 > 86 1 30522 9 10 0 0 10 1 0 1 0 0 > 87 1 30512 8 10 0 0 10 1 0 1 0 0 > 88 1 21282 12 1 0 0 10 10 0 10 0 0 > 89 1 21746 12 5 0 0 8 1 0 1 0 0 > 90 1 21283 13 6 0 0 8 1 0 1 0 0 > 91 1 30511 8 16 0 0 7 0 0 0 0 0 > 92 1 30521 9 16 0 0 7 0 0 0 0 0 > 93 1 21738 13 4 0 0 7 1 0 1 0 0 > 94 1 21695 12 5 0 0 7 1 0 1 0 0 > 95 1 30513 8 12 0 0 7 0 0 0 0 0 > 96 1 30523 9 12 0 0 7 0 0 0 0 0 > 97 1 21736 12 4 0 0 6 1 0 1 0 0 > 98 1 21726 13 7 0 0 5 0 0 0 0 0 > 99 1 58743 5 12 0 0 5 0 0 0 0 0 > 100 1 28795 7 1 0 0 3 3 0 3 0 0 > 101 1 28429 3 1 0 0 2 2 0 2 0 0 > 102 1 21857 14 1 0 0 1 1 0 1 0 0 > 103 1 24456 12 1 0 0 1 1 0 1 0 0 > 104 1 21614 17 1 0 0 1 1 0 1 0 0 > 105 1 21747 13 1 0 0 0 0 0 0 0 0 > 106 1 31971 9 1 0 0 0 0 0 0 0 0 > 107 1 52549 1 1 0 0 0 0 0 0 0 0 > > > I also checkt the log file using Splunk but none of the found alerts match bruteforce. > Any Ideas why so many false alerts? > > With kind regards > Eni > > > _______________________________________________ > Snort-users mailing list > [email protected] > Go to this URL to change user options or unsubscribe: > https://lists.snort.org/mailman/listinfo/snort-users > > To unsubscribe, send an email to: > [email protected] > > Please visit http://blog.snort.org to stay current on all the latest Snort news! > > Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette