Re: Snort drops the incoming HTTP response packets

Hello,

I was unable to reproduce the issue. Couple of things to try....


1)  As a test can you disable the blocking in inline normalization?

Do this by commenting this line:

preprocessor normalize_tcp: block, rsv, pad, urp, req_urg, req_pay, req_urp, ips, ecn stream


2) Enable the decoder and preprocessor rules?

I saw alot of these in the traffic:

08/25-04:24:04.859141  [**] [129:14:1] TCP Timestamp is missing [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 84.206.44.166:80 -> 89.135.184.49:46505


3)  Disable checksum validation by adding '-k none' at startup.




Albert Lewis

ENGINEER.SOFTWARE ENGINEERING

SOURCEfire, Inc. now part of Cisco

Email: [email protected]<mailto:[email protected]>

________________________________
From: Tamás Németh <[email protected]>
Sent: Thursday, August 25, 2022 11:20 AM
To: Al Lewis (allewi) <[email protected]>
Cc: [email protected] <[email protected]>
Subject: Re: [Snort-users] Snort drops the incoming HTTP response packets

Thank you for your reply again.

I wasn't able to reproduce everything as you instructed, but: I commented ALL the include lines in snort.conf corresponding to .rules files and started only one copy of it. After this I still cannot visit the site http://mekh.hu , because snort drops the webserver's response packets without any notification in /var/log/snort/alert. But even when running 2 copies of snort and applying all the rules, snort seems to work perfectly and we can access EVERYTHING on the internet, except this one unencrypted website http://mekh.hu . All other websites are working, even unencrypted ones like http://neverssl.com

Snort didn't work when running with the option "--daq dump" (because it simply dropped everything), but if you compare the files mekh_outide.pcapng and mekh_inside.pcapng in the ZIP file sent by me, you will see, what packages snort drops without any notification. I bet, if you're behind a snort IPS, you also won't be able to view the website http://mekh.hu , but there is one more PCAP file in my ZIP, called mekh_unfiltered.pcapng, which shows the unimpeded traffic of that website.

Thank you in advance

Al Lewis (allewi) <[email protected]<mailto:[email protected]>> ezt írta (időpont: 2022. aug. 25., Cs, 15:39):
At first glance it looks like you need to simplify things a bit and only run one instance of snort inline to narrow things down.

Do you have a copy of the traffic unimpeded? This would help rule out any network related problems you have.

Couple of things to try....

Add the --daq dump to your startup command in order to get a pcap file name "inline-out.pcap". This will show at want point it stops passing traffic (if that is the case).

Disable all rules / inspections. Do you still have the same problem?

Is this problem seen with other types of traffic or is it HTTP specific?








Albert Lewis

ENGINEER.SOFTWARE ENGINEERING

SOURCEfire, Inc. now part of Cisco

Email: [email protected]<mailto:[email protected]>

________________________________
From: Tamás Németh <[email protected]<mailto:[email protected]>>
Sent: Thursday, August 25, 2022 4:42 AM
To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Cc: Al Lewis (allewi) <[email protected]<mailto:[email protected]>>
Subject: Re: [Snort-users] Snort drops the incoming HTTP response packets

Thank you very much for your efforts! I uploaded all the information you might need (and a little more) to https://drive.google.com/file/d/14Wu-zLI_L8BZxpArEC5EYAgLfeo46X0a/view?usp=sharing
It's a ZIP file, which I will delete in a few days. After decompressing, please start with reading README.txt.

Thank you in advance for your help,

Tamás Németh
IT sysadmin
Waterworks of Sopron, Hungary

Al Lewis (allewi) <[email protected]<mailto:[email protected]>> ezt írta (időpont: 2022. aug. 24., Sze, 22:44):
Hello,

Can you share the configuration you are using? Do you have a pcap of the traffic in question?


Albert Lewis

ENGINEER.SOFTWARE ENGINEERING

SOURCEfire, Inc. now part of Cisco

Email: [email protected]<mailto:[email protected]>

________________________________
From: Snort-users <[email protected]<mailto:[email protected]>> on behalf of Tamás Németh via Snort-users <[email protected]<mailto:[email protected]>>
Sent: Wednesday, August 24, 2022 11:13 AM
To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Subject: [Snort-users] Snort drops the incoming HTTP response packets

Dear All!

 I face the problem that snort drops the incoming HTTP response packets from a certain unencrypted HTTP website, but it does not log the dropping event in /var/log/snort/alert , so I have no idea, which rule is responsible (if a rule does in anyway). I'm using the registered rules snortrules-snapshot-29200.tar.gz , and the website is http://mekh.hu

 How could I figure out the reason of snort to drop these packets.

Thank you in advance,

Tamás Németh
IT sysadmin
Waterworks of Sopron, Hungary

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette