Re: Snort 3 resets not working. Question?

Hello Gustaf,

I copied your config and ran it locally but not seeing “connection timeout” during pings. Can you please copy paste the ping output here and provide a pcap if possible? Seems strange. Issue could be specific to your local machine.

Thanks!

--
V/r
Nihal N. Desai

From: Snort-users <[email protected]> on behalf of Gustaf Florén via Snort-users <[email protected]>
Date: Tuesday, May 24, 2022 at 2:35 PM
To: [email protected] <[email protected]>
Subject: [Snort-users] Snort 3 resets not working. Question?
Hello!

I am running snort 3 inline mode and trying to get active response to work.
When I ping a host located behind snort inline I get a "connection timeout" when I with active response and reject action in rule should get "Destination port unreachable"....???
When I look at the snort log it reads [reset], so the reset should be sent but still "connection timeout" when sending a ping...
Below are my configs:

ips =
{
mode = inline,
enable_builtin_rules = true,
variables = default_variables,
rules = [[ rules-here ]]
}

reject = { control="all", reset="both" }

active = { attempts = 2, device = "eth0", dst_mac = "mac-addr-of-eth0",}

normalizer = { tcp = { ips = true, } }


Starting snort with:

snort -c snort.lua --daq-dir /usr/local/lib/daq --daq afpacket --daq-var fanout_type=hash \
-s 65535 -k none -l /var/log/snort -Q -i eth0:enx5ca6e6fb7f8a -u snort -g snort -D


And icmp rule:
reject icmp any any -> any any (msg:"icmp"; sid:1; )


Any ideas what is wrong/missing??

/Gustaf

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette