Re: Snort 3 resets not working. Question?

Hello Gustaf, this is working as intended for icmp. If you are not using latest version then please download latest one to try that out. We will get docs updated.

You can also try same test with udp to see “Destination unreachable” messages.

Thanks!

--
V/r
Nihal N. Desai

From: Snort-users <[email protected]> on behalf of Nihal Desai (nihdesai) via Snort-users <[email protected]>
Date: Wednesday, May 25, 2022 at 1:45 AM
To: Gustaf Florén <[email protected]>, [email protected] <[email protected]>
Subject: Re: [Snort-users] Snort 3 resets not working. Question?
Hello Gustaf,

I copied your config and ran it locally but not seeing “connection timeout” during pings. Can you please copy paste the ping output here and provide a pcap if possible? Seems strange. Issue could be specific to your local machine.

Thanks!

--
V/r
Nihal N. Desai

From: Snort-users <[email protected]> on behalf of Gustaf Florén via Snort-users <[email protected]>
Date: Tuesday, May 24, 2022 at 2:35 PM
To: [email protected] <[email protected]>
Subject: [Snort-users] Snort 3 resets not working. Question?
Hello!

I am running snort 3 inline mode and trying to get active response to work.
When I ping a host located behind snort inline I get a "connection timeout" when I with active response and reject action in rule should get "Destination port unreachable"....???
When I look at the snort log it reads [reset], so the reset should be sent but still "connection timeout" when sending a ping...
Below are my configs:

ips =
{
mode = inline,
enable_builtin_rules = true,
variables = default_variables,
rules = [[ rules-here ]]
}

reject = { control="all", reset="both" }

active = { attempts = 2, device = "eth0", dst_mac = "mac-addr-of-eth0",}

normalizer = { tcp = { ips = true, } }


Starting snort with:

snort -c snort.lua --daq-dir /usr/local/lib/daq --daq afpacket --daq-var fanout_type=hash \
-s 65535 -k none -l /var/log/snort -Q -i eth0:enx5ca6e6fb7f8a -u snort -g snort -D


And icmp rule:
reject icmp any any -> any any (msg:"icmp"; sid:1; )


Any ideas what is wrong/missing??

/Gustaf

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette