Re: Snort drops the incoming HTTP response packets

Hello Albert,

 I'm answering to the list, because I want others with the same problem to
see a possible solution for their problem. My earlier mails aren't visible
in the list archives, probably because they were addressed to you, and the
list was only on cc. You can see what happened below in my earlier replies.

 The main point is that this particular problem (i.e. being unable to
access the website http://mekh.hu via an inline mode snort 2.9.20) wasn't
caused by any of the rules, but by the preprocessor "normalize_tcp". I
didn't even have to disable it entirely, only the "block" flag, which
solved the problem.

 It would be helpful if snort would provide means to debug packed dropping
by functions like this, not only rules.

 Otherwise thank you for your tips, they were helpful, as you can see.

Best wishes,

NÉMETH, Tamás
IT sysadmin
Waterworks of Sopron, Hungary


Al Lewis (allewi) <[email protected]> ezt írta (időpont: 2022. aug. 29., H,
15:24):

> Hello,
>
> Were you able to make the suggested changes?
>
> *Albert Lewis*
>
> ENGINEER.SOFTWARE ENGINEERING
>
> SOURCE*fire*, Inc. now part of *Cisco*
>
> Email: [email protected]
> ------------------------------
> *From:* Tamás Németh <[email protected]>
> *Sent:* Thursday, August 25, 2022 6:31 PM
> *To:* Al Lewis (allewi) <[email protected]>
> *Subject:* Re: [Snort-users] Snort drops the incoming HTTP response
> packets
>
> OK, to me more specific:
>
> 1. The "block" flag of preprocessor normalize_tcp causes the
> silent dropping of the incoming HTTP answers.
>
> 2. Something in the preprocessor.rules set causes the "TCP Timestamp is
> missing" messages.
>
> Best wishes
>
> Al Lewis (allewi) <[email protected]> ezt írta (időpont: 2022. aug. 25.,
> Cs, 22:39):
>
> Hello,
>
> I was unable to reproduce the issue. Couple of things to try....
>
>
> 1)  As a test can you disable the blocking in inline normalization?
>
> Do this by commenting this line:
>
> preprocessor normalize_tcp: block, rsv, pad, urp, req_urg, req_pay,
> req_urp, ips, ecn stream
>
>
> 2) Enable the decoder and preprocessor rules?
>
> I saw alot of these in the traffic:
>
> 08/25-04:24:04.859141  [**] [129:14:1] TCP Timestamp is missing [**]
> [Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
> 84.206.44.166:80 -> 89.135.184.49:46505
>
>
> 3)  Disable checksum validation by adding '-k none' at startup.
>
>
>
> *Albert Lewis*
>
> ENGINEER.SOFTWARE ENGINEERING
>
> SOURCE*fire*, Inc. now part of *Cisco*
>
> Email: [email protected]
> ------------------------------
> *From:* Tamás Németh <[email protected]>
> *Sent:* Thursday, August 25, 2022 11:20 AM
> *To:* Al Lewis (allewi) <[email protected]>
> *Cc:* [email protected] <[email protected]>
> *Subject:* Re: [Snort-users] Snort drops the incoming HTTP response
> packets
>
> Thank you for your reply again.
>
> I wasn't able to reproduce everything as you instructed, but: I commented
> ALL the include lines in snort.conf corresponding to .rules files and
> started only one copy of it. After this I still cannot visit the site
> http://mekh.hu , because snort drops the webserver's response packets
> without any notification in /var/log/snort/alert. But even when running 2
> copies of snort and applying all the rules, snort seems to work perfectly
> and we can access EVERYTHING on the internet, except this one unencrypted
> website http://mekh.hu . All other websites are working, even unencrypted
> ones like http://neverssl.com
>
> Snort didn't work when running with the option "--daq dump" (because it
> simply dropped everything), but if you compare the files mekh_outide.pcapng
> and mekh_inside.pcapng in the ZIP file sent by me, you will see, what
> packages snort drops without any notification. I bet, if you're behind a
> snort IPS, you also won't be able to view the website http://mekh.hu ,
> but there is one more PCAP file in my ZIP, called mekh_unfiltered.pcapng,
> which shows the unimpeded traffic of that website.
>
> Thank you in advance
>
> Al Lewis (allewi) <[email protected]> ezt írta (időpont: 2022. aug. 25.,
> Cs, 15:39):
>
> At first glance it looks like you need to simplify things a bit and only
> run one instance of snort inline to narrow things down.
>
> Do you have a copy of the traffic unimpeded? This would help rule out any
> network related problems you have.
>
> Couple of things to try....
>
> Add the --daq dump to your startup command in order to get a pcap file
> name "inline-out.pcap". This will show at want point it stops passing
> traffic (if that is the case).
>
> Disable all rules / inspections. Do you still have the same problem?
>
> Is this problem seen with other types of traffic or is it HTTP specific?
>
>
>
>
>
>
>
> *Albert Lewis*
>
> ENGINEER.SOFTWARE ENGINEERING
>
> SOURCE*fire*, Inc. now part of *Cisco*
>
> Email: [email protected]
> ------------------------------
> *From:* Tamás Németh <[email protected]>
> *Sent:* Thursday, August 25, 2022 4:42 AM
> *To:* [email protected] <[email protected]>
> *Cc:* Al Lewis (allewi) <[email protected]>
> *Subject:* Re: [Snort-users] Snort drops the incoming HTTP response
> packets
>
> Thank you very much for your efforts! I uploaded all the information you
> might need (and a little more) to
> https://drive.google.com/file/d/14Wu-zLI_L8BZxpArEC5EYAgLfeo46X0a/view?usp=sharing
> It's a ZIP file, which I will delete in a few days. After decompressing,
> please start with reading README.txt.
>
> Thank you in advance for your help,
>
> Tamás Németh
> IT sysadmin
> Waterworks of Sopron, Hungary
>
> Al Lewis (allewi) <[email protected]> ezt írta (időpont: 2022. aug. 24.,
> Sze, 22:44):
>
> Hello,
>
> Can you share the configuration you are using? Do you have a pcap of the
> traffic in question?
>
> *Albert Lewis*
>
> ENGINEER.SOFTWARE ENGINEERING
>
> SOURCE*fire*, Inc. now part of *Cisco*
>
> Email: [email protected]
> ------------------------------
> *From:* Snort-users <[email protected]> on behalf of
> Tamás Németh via Snort-users <[email protected]>
> *Sent:* Wednesday, August 24, 2022 11:13 AM
> *To:* [email protected] <[email protected]>
> *Subject:* [Snort-users] Snort drops the incoming HTTP response packets
>
> Dear All!
>
>  I face the problem that snort drops the incoming HTTP response packets
> from a certain unencrypted HTTP website, but it does not log the
> dropping event in /var/log/snort/alert , so I have no idea, which rule is
> responsible (if a rule does in anyway). I'm using the registered
> rules snortrules-snapshot-29200.tar.gz , and the website is http://mekh.hu
>
>
>  How could I figure out the reason of snort to drop these packets.
>
> Thank you in advance,
>
> Tamás Németh
> IT sysadmin
> Waterworks of Sopron, Hungary
>
>

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette