Re: Snort drops the incoming HTTP response packets

Thank you for your reply again.

I wasn't able to reproduce everything as you instructed, but: I commented
ALL the include lines in snort.conf corresponding to .rules files and
started only one copy of it. After this I still cannot visit the site
http://mekh.hu , because snort drops the webserver's response packets
without any notification in /var/log/snort/alert. But even when running 2
copies of snort and applying all the rules, snort seems to work perfectly
and we can access EVERYTHING on the internet, except this one unencrypted
website http://mekh.hu . All other websites are working, even unencrypted
ones like http://neverssl.com

Snort didn't work when running with the option "--daq dump" (because it
simply dropped everything), but if you compare the files mekh_outide.pcapng
and mekh_inside.pcapng in the ZIP file sent by me, you will see, what
packages snort drops without any notification. I bet, if you're behind a
snort IPS, you also won't be able to view the website http://mekh.hu , but
there is one more PCAP file in my ZIP, called mekh_unfiltered.pcapng, which
shows the unimpeded traffic of that website.

Thank you in advance

Al Lewis (allewi) <[email protected]> ezt írta (időpont: 2022. aug. 25., Cs,
15:39):

> At first glance it looks like you need to simplify things a bit and only
> run one instance of snort inline to narrow things down.
>
> Do you have a copy of the traffic unimpeded? This would help rule out any
> network related problems you have.
>
> Couple of things to try....
>
> Add the --daq dump to your startup command in order to get a pcap file
> name "inline-out.pcap". This will show at want point it stops passing
> traffic (if that is the case).
>
> Disable all rules / inspections. Do you still have the same problem?
>
> Is this problem seen with other types of traffic or is it HTTP specific?
>
>
>
>
>
>
>
> *Albert Lewis*
>
> ENGINEER.SOFTWARE ENGINEERING
>
> SOURCE*fire*, Inc. now part of *Cisco*
>
> Email: [email protected]
> ------------------------------
> *From:* Tamás Németh <[email protected]>
> *Sent:* Thursday, August 25, 2022 4:42 AM
> *To:* [email protected] <[email protected]>
> *Cc:* Al Lewis (allewi) <[email protected]>
> *Subject:* Re: [Snort-users] Snort drops the incoming HTTP response
> packets
>
> Thank you very much for your efforts! I uploaded all the information you
> might need (and a little more) to
> https://drive.google.com/file/d/14Wu-zLI_L8BZxpArEC5EYAgLfeo46X0a/view?usp=sharing
> It's a ZIP file, which I will delete in a few days. After decompressing,
> please start with reading README.txt.
>
> Thank you in advance for your help,
>
> Tamás Németh
> IT sysadmin
> Waterworks of Sopron, Hungary
>
> Al Lewis (allewi) <[email protected]> ezt írta (időpont: 2022. aug. 24.,
> Sze, 22:44):
>
> Hello,
>
> Can you share the configuration you are using? Do you have a pcap of the
> traffic in question?
>
> *Albert Lewis*
>
> ENGINEER.SOFTWARE ENGINEERING
>
> SOURCE*fire*, Inc. now part of *Cisco*
>
> Email: [email protected]
> ------------------------------
> *From:* Snort-users <[email protected]> on behalf of
> Tamás Németh via Snort-users <[email protected]>
> *Sent:* Wednesday, August 24, 2022 11:13 AM
> *To:* [email protected] <[email protected]>
> *Subject:* [Snort-users] Snort drops the incoming HTTP response packets
>
> Dear All!
>
>  I face the problem that snort drops the incoming HTTP response packets
> from a certain unencrypted HTTP website, but it does not log the
> dropping event in /var/log/snort/alert , so I have no idea, which rule is
> responsible (if a rule does in anyway). I'm using the registered
> rules snortrules-snapshot-29200.tar.gz , and the website is http://mekh.hu
>
>
>  How could I figure out the reason of snort to drop these packets.
>
> Thank you in advance,
>
> Tamás Németh
> IT sysadmin
> Waterworks of Sopron, Hungary
>
>

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette