Re: Snort 3 not dropping packets in IPS/inline mode

Exactly my point, the rules are set correctly and shows the below in fast
alert mode.

[image: image.png]

But in reality the verdict is showing pass and also snort3 is not
dropping the packet. I did not have this problem while using snort2.9.
Here is my test rule:


*drop icmp any any -> $HOME_NET any (msg:"ICMP connection test";
sid:1000001; rev:1;)drop tcp any any -> $HOME_NET 80 (msg:"TCP connection
test"; sid:1000002; rev:1;)*

On Thu, Jan 20, 2022 at 10:32 PM Steven Baigal (sbaigal) <[email protected]>
wrote:

> I only see pass verdict from this log. Are these packets expected to be
> dropped? Check your ips rules and make sure you have correct rules for your
> setup.
>
>
>
> *From: *Mikha George <[email protected]>
> *Date: *Thursday, January 20, 2022 at 11:39 AM
> *To: *Steven Baigal (sbaigal) <[email protected]>
> *Cc: *[email protected] <[email protected]>
> *Subject: *Re: [Snort-users] Snort 3 not dropping packets in IPS/inline
> mode
>
> Hi Steven,
>
>
>
> Thank you for the response.
>
>
>
> Enabling the packet tracer showed the below result.
>
>
>
>
>
> On Thu, Jan 20, 2022 at 9:05 PM Steven Baigal (sbaigal) <[email protected]>
> wrote:
>
> You can enable packet tracer to debug the issue and see if the verdict was
> applied correctly:
>
>
>
> *packet_tracer = { enable = true, }*
>
>
>
> *and you can also capture the pcap to see if tcp RST is generated
> correctly for both directions.*
>
> If you are using VLAN, please try the latest code, there was a bug fix
> related to drop connection for vlan traffic.
>
>
>
>
>
> *From: *Snort-users <[email protected]> on behalf of
> Mikha George via Snort-users <[email protected]>
> *Date: *Wednesday, January 19, 2022 at 5:43 PM
> *To: *[email protected] <[email protected]>
> *Subject: *[Snort-users] Snort 3 not dropping packets in IPS/inline mode
>
> Snort 3 is not dropping the packets even after the rule specifies to block
> packets. It is running in inline mode and shows *drop* but the packets
> are being sent however.
>
> Snort is using the DAQ modules for running in inline mode. The command I
> use to run snort is as below:
>
> *./snort --daq-dir /usr/local/lib/daq --daq afpacket --daq-var debug
> --daq-var fanout_type=hash -i eth0:eth1 -Q -R
> /usr/local/snort/rules/local.rules -A alert_fast*
>
> I have two network interfaces attached as required which are up and
> running.
>
> Any help is highly appreciated and would mean a lot. PFA screenshot
> for reference.
>
>
>
> Thanks & Regards,
>
> Mikha George
>
>
>
>

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette