Re: Log flooded with "(decode) same src/dst IP"

You can check the manual of the "help-module" command for more details.

You can suppress the noisy rule only as well.. run './bin/snort --help-module suppress' for details.


"./bin/snort --help-module suppress"

suppress


Help: configure event suppressions

Type: basic

Usage: context

Configuration:

int suppress[].gid = 0: rule generator ID { 0:8129 }
int suppress[].sid = 0: rule signature ID { 0:max32 }
enum suppress[].track: suppress only matching source or destination addresses { 'by_src' | 'by_dst' }
string suppress[].ip: restrict suppression to these addresses according to track




Albert Lewis

ENGINEER.SOFTWARE ENGINEERING

SOURCEfire, Inc. now part of Cisco

Email: [email protected]<mailto:[email protected]>

________________________________
From: Snort-users <[email protected]> on behalf of Amish via Snort-users <[email protected]>
Sent: Tuesday, November 15, 2022 5:12 AM
To: Oleksii Shumeiko -X (oshumeik - SOFTSERVE INC at Cisco) <[email protected]>
Cc: [email protected] <[email protected]>
Subject: Re: [Snort-users] Log flooded with "(decode) same src/dst IP"


Thanks that helped indeed. But I wonder if there is detailed help instead of one liners.

Also you have mentioned that disabling builtin rules is not recommended but then:

1) Why is it disabled by default?
2) Russ Combs mentioned in past that they are just for testing

> Source: https://seclists.org/snort/2020/q2/69
> ips.enable_builtin_rules is just a convenience for turning on all builtin rules that is primarily used for testing.

I guess I will disable them for now.

Thanks again and Regards,

Amish.

On 15/11/22 13:18, Oleksii Shumeiko -X (oshumeik - SOFTSERVE INC at Cisco) wrote:
Hi.

There are several ways. Consider the following commands:
./snort --help-config suppress
./snort --help-config ips
./snort --help-config enable

So, the first option is to suppress the logging for a given rule and/or IP addresses. For example, adding the following line to your configuration will suppress 116:151 built-in rule:
suppress = { { gid = 116, sid = 151 } }

The second option is to disable that rule entirely by updating ips states:
ips.states = ips.states .. [[ alert ( gid:116; sid: 151; enable:no; ) ]]

The third option is to disable all built-in rules (not recommended, but could be useful for debugging purposes):
ips.enable_builtin_rules = false

Good luck and have a nice day ahead,
Alexey


On 15 Nov 2022, at 09:31, Amish via Snort-users <[email protected]<mailto:[email protected]>> wrote:

Hello

Recently I upgraded from snort 2 to 3.

I am using snort 3.1.45 in NFQUEUE (IPS) mode.

The snort is installed on gateway and monitors all traffic to and fro LAN.

I use snort-community rules, installed via pulled pork 3.

I also use latest OpenAppID.

I noticed that the log file (alert_fast) gets flooded with following lines:

11/15-12:38:25.616624 [**] [116:151:1] "(decode) same src/dst IP" [**] [Priority: 3] [AppID: SQL Server] {TCP} 192.168.1.151:1433 -> 192.168.1.151:58586
11/15-12:38:25.618817 [**] [116:151:1] "(decode) same src/dst IP" [**] [Priority: 3] [AppID: SQL Server] {TCP} 192.168.1.151:1433 -> 192.168.1.151:58586
11/15-12:38:25.620745 [**] [116:151:1] "(decode) same src/dst IP" [**] [Priority: 3] [AppID: SQL Server] {TCP} 192.168.1.151:1433 -> 192.168.1.151:58586
11/15-12:38:25.622575 [**] [116:151:1] "(decode) same src/dst IP" [**] [Priority: 3] [AppID: SQL Server] {TCP} 192.168.1.151:1433 -> 192.168.1.151:58586
11/15-12:38:25.623990 [**] [116:151:1] "(decode) same src/dst IP" [**] [Priority: 3] [AppID: SQL Server] {TCP} 192.168.1.151:1433 -> 192.168.1.151:58586
11/15-12:38:25.625335 [**] [116:151:1] "(decode) same src/dst IP" [**] [Priority: 3] [AppID: SQL Server] {TCP} 192.168.1.151:1433 -> 192.168.1.151:58586

This occurs because 192.168.1.151 connects to its own public IP which gets redirected back to 192.168.1.151 via NAT.

So how do I disable this rule? Grepping for "same src" in snort.rules file gives nothing.

So I have no clue where the rule is located. It filled up 200GB of harddisk in less than 15 days.

Can someone give pointers?

Thank you,

Amish.

_______________________________________________
Snort-users mailing list
[email protected]<mailto:[email protected]>
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

To unsubscribe, send an email to:
[email protected]<mailto:[email protected]>

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette