Re: Snort drops the incoming HTTP response packets

Hello Al,

 Thank you for the effort again. I tried your 3 proposals independently.
The results are the following:

1. Commenting the line "preprocessor normalize_tcp: block, rsv, pad, urp,
req_urg, req_pay, req_urp, ips, ecn stream" seems to solve the problem! I
can access the website this way. I gotta sleep now, but tomorrow I'll
probably try which option causes the problem.



2. Enabling the decoder and preprocessor rules retains the problem in a
different way: Now I see the error messages mentioned by you:

08/25-23:55:52.366972  [Drop] [**] [129:14:2]  <eth049:eth149> TCP
Timestamp is missing [**] [Classification: Potentially Bad Traffic]
[Priority: 2] {TCP} 84.206.44.166:80 -> 89.135.184.49:59811

In the same time our proxy sends TCP RST packages from the inside and lets
its clients immediately know that it's not possible to connect to the
website.



3. The command line option "-k none" doesn't seem to improve anything.
Snort still drops the packages without notification.


So, as far as I can understand, the proposals no. 2 and 3 may help with
figuring out what the exact problem is, and maybe also solve it.

Thank you for your help!

Al Lewis (allewi) <[email protected]> ezt írta (időpont: 2022. aug. 25., Cs,
22:39):

> Hello,
>
> I was unable to reproduce the issue. Couple of things to try....
>
>
> 1)  As a test can you disable the blocking in inline normalization?
>
> Do this by commenting this line:
>
> preprocessor normalize_tcp: block, rsv, pad, urp, req_urg, req_pay,
> req_urp, ips, ecn stream
>
>
> 2) Enable the decoder and preprocessor rules?
>
> I saw alot of these in the traffic:
>
> 08/25-04:24:04.859141  [**] [129:14:1] TCP Timestamp is missing [**]
> [Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
> 84.206.44.166:80 -> 89.135.184.49:46505
>
>
> 3)  Disable checksum validation by adding '-k none' at startup.
>
>
>
> *Albert Lewis*
>
> ENGINEER.SOFTWARE ENGINEERING
>
> SOURCE*fire*, Inc. now part of *Cisco*
>
> Email: [email protected]
> ------------------------------
> *From:* Tamás Németh <[email protected]>
> *Sent:* Thursday, August 25, 2022 11:20 AM
> *To:* Al Lewis (allewi) <[email protected]>
> *Cc:* [email protected] <[email protected]>
> *Subject:* Re: [Snort-users] Snort drops the incoming HTTP response
> packets
>
> Thank you for your reply again.
>
> I wasn't able to reproduce everything as you instructed, but: I commented
> ALL the include lines in snort.conf corresponding to .rules files and
> started only one copy of it. After this I still cannot visit the site
> http://mekh.hu , because snort drops the webserver's response packets
> without any notification in /var/log/snort/alert. But even when running 2
> copies of snort and applying all the rules, snort seems to work perfectly
> and we can access EVERYTHING on the internet, except this one unencrypted
> website http://mekh.hu . All other websites are working, even unencrypted
> ones like http://neverssl.com
>
> Snort didn't work when running with the option "--daq dump" (because it
> simply dropped everything), but if you compare the files mekh_outide.pcapng
> and mekh_inside.pcapng in the ZIP file sent by me, you will see, what
> packages snort drops without any notification. I bet, if you're behind a
> snort IPS, you also won't be able to view the website http://mekh.hu ,
> but there is one more PCAP file in my ZIP, called mekh_unfiltered.pcapng,
> which shows the unimpeded traffic of that website.
>
> Thank you in advance
>
> Al Lewis (allewi) <[email protected]> ezt írta (időpont: 2022. aug. 25.,
> Cs, 15:39):
>
> At first glance it looks like you need to simplify things a bit and only
> run one instance of snort inline to narrow things down.
>
> Do you have a copy of the traffic unimpeded? This would help rule out any
> network related problems you have.
>
> Couple of things to try....
>
> Add the --daq dump to your startup command in order to get a pcap file
> name "inline-out.pcap". This will show at want point it stops passing
> traffic (if that is the case).
>
> Disable all rules / inspections. Do you still have the same problem?
>
> Is this problem seen with other types of traffic or is it HTTP specific?
>
>
>
>
>
>
>
> *Albert Lewis*
>
> ENGINEER.SOFTWARE ENGINEERING
>
> SOURCE*fire*, Inc. now part of *Cisco*
>
> Email: [email protected]
> ------------------------------
> *From:* Tamás Németh <[email protected]>
> *Sent:* Thursday, August 25, 2022 4:42 AM
> *To:* [email protected] <[email protected]>
> *Cc:* Al Lewis (allewi) <[email protected]>
> *Subject:* Re: [Snort-users] Snort drops the incoming HTTP response
> packets
>
> Thank you very much for your efforts! I uploaded all the information you
> might need (and a little more) to
> https://drive.google.com/file/d/14Wu-zLI_L8BZxpArEC5EYAgLfeo46X0a/view?usp=sharing
> It's a ZIP file, which I will delete in a few days. After decompressing,
> please start with reading README.txt.
>
> Thank you in advance for your help,
>
> Tamás Németh
> IT sysadmin
> Waterworks of Sopron, Hungary
>
> Al Lewis (allewi) <[email protected]> ezt írta (időpont: 2022. aug. 24.,
> Sze, 22:44):
>
> Hello,
>
> Can you share the configuration you are using? Do you have a pcap of the
> traffic in question?
>
> *Albert Lewis*
>
> ENGINEER.SOFTWARE ENGINEERING
>
> SOURCE*fire*, Inc. now part of *Cisco*
>
> Email: [email protected]
> ------------------------------
> *From:* Snort-users <[email protected]> on behalf of
> Tamás Németh via Snort-users <[email protected]>
> *Sent:* Wednesday, August 24, 2022 11:13 AM
> *To:* [email protected] <[email protected]>
> *Subject:* [Snort-users] Snort drops the incoming HTTP response packets
>
> Dear All!
>
>  I face the problem that snort drops the incoming HTTP response packets
> from a certain unencrypted HTTP website, but it does not log the
> dropping event in /var/log/snort/alert , so I have no idea, which rule is
> responsible (if a rule does in anyway). I'm using the registered
> rules snortrules-snapshot-29200.tar.gz , and the website is http://mekh.hu
>
>
>  How could I figure out the reason of snort to drop these packets.
>
> Thank you in advance,
>
> Tamás Németh
> IT sysadmin
> Waterworks of Sopron, Hungary
>
>

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette