Re: Issues with Reputation Inspector/Preprocessor

I ran a test and it alerts as expected (see below). The stripped down configuration and pcap used are attached as a reference/example.



xubuntu20@box:/var/tmp/snort3$ ./bin/snort -c etc/snort/reputation-test.lua -r etc/snort/reputation-test.pcap -Acmg -k none -q
06/07-09:20:41.476003 [force_block] [**] [136:4:1] "(reputation) packets blocked based on destination" [**] [Priority: 3] {UDP} 192.169.25.1:5060 -> 172.33.0.1:5060
02:01:02:03:04:05 -> 02:09:08:07:06:05 type:0x800 len:0x1D3
192.169.25.1:5060 -> 172.33.0.1:5060 UDP TTL:64 TOS:0x0 ID:1 IpLen:20 DgmLen:453
Len: 425

snort.raw[425]:
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -
49 4E 56 49 54 45 31 20  73 69 70 3A 34 33 32 31  INVITE1  sip:4321
40 31 39 32 2E 31 36 38  2E 31 2E 38 37 3B 75 73  @192.168 .1.87;us
65 72 3D 70 68 6F 6E 65  20 53 49 50 2F 32 2E 30  er=phone  SIP/2.0
0D 0A 56 69 61 3A 20 53  49 50 2F 32 2E 30 2F 55  ..Via: S IP/2.0/U
44 50 20 31 39 32 2E 31  36 38 2E 31 2E 34 38 3A  DP 192.1 68.1.48:
35 30 36 30 3B 62 72 61  6E 63 68 3D 7A 39 68 47  5060;bra nch=z9hG
34 62 4B 2D 6A 37 67 74  72 6A 67 77 65 34 30 39  4bK-j7gt rjgwe409
3B 72 70 6F 72 74 0D 0A  46 72 6F 6D 3A 20 31 31  ;rport.. From: 11
31 20 3C 73 69 70 3A 31  31 31 40 31 39 32 2E 31  1 <sip:1 [email protected]
36 38 2E 31 2E 33 36 3E  3B 74 61 67 3D 34 6D 6B  68.1.36> ;tag=4mk
36 7A 73 34 34 72 35 0D  0A 54 6F 3A 20 3C 73 69  6zs44r5. .To: <si
70 3A 34 33 32 31 40 31  39 32 2E 31 36 38 2E 31  p:4321@1 92.168.1
2E 38 37 3B 75 73 65 72  3D 70 68 6F 6E 65 3E 0D  .87;user =phone>.
0A 43 61 6C 6C 2D 49 44  3A 20 33 63 34 37 36 39  .Call-ID : 3c4769
30 61 62 32 33 39 2D 34  34 62 30 78 78 79 36 65  0ab239-4 4b0xxy6e
76 75 73 40 31 39 32 2D  31 36 38 2D 31 2D 34 38  vus@192- 168-1-48
0D 0A 43 53 65 71 3A 20  31 20 49 4E 56 49 54 45  ..CSeq:  1 INVITE
0D 0A 4D 61 78 2D 46 6F  72 77 61 72 64 73 3A 20  ..Max-Fo rwards:
37 30 0D 0A 43 6F 6E 74  61 63 74 3A 20 3C 73 69  70..Cont act: <si
70 3A 31 31 31 40 31 39  32 2E 31 36 38 2E 31 2E  p:111@19 2.168.1.
34 38 3A 35 30 36 30 3B  6C 69 6E 65 3D 62 72 31  48:5060; line=br1
6D 76 76 64 66 3E 0D 0A  41 63 63 65 70 74 3A 20  mvvdf>.. Accept:
61 70 70 6C 69 63 61 74  69 6F 6E 2F 73 64 70 0D  applicat ion/sdp.
0A 43 6F 6E 74 65 6E 74  2D 54 79 70 65 3A 20 61  .Content -Type: a
70 70 6C 69 63 61 74 69  6F 6E 2F 73 64 70 0D 0A  pplicati on/sdp..
43 6F 6E 74 65 6E 74 2D  4C 65 6E 67 74 68 3A 20  Content- Length:
34 0D 0A 0D 0A 67 6F 6F  64                       4....goo d
- - - - - - - - - - - -  - - - - - - - - - - - -  - - - - - - - - -

xubuntu20@xubuntu20-new:/var/tmp/snort3$


Albert Lewis

Email: [email protected]<mailto:[email protected]>

________________________________
From: teste teste <[email protected]>
Sent: Friday, November 17, 2023 12:36 PM
To: Al Lewis (allewi) <[email protected]>
Subject: RE: Issues with Reputation Inspector/Preprocessor


I am sending the snort.lua file as an attachment,



In the IPS.rules section, combined.rules is basically a file with all the rules from the other rule files, I tried to use pulledPork but the amount of rules loaded was too little (like 9000) so I made my own script to update the rules.



Best regards,



From: Al Lewis (allewi)<mailto:[email protected]>
Sent: 17 de novembro de 2023 16:41
To: teste teste<mailto:[email protected]>
Subject: Re: Issues with Reputation Inspector/Preprocessor



Can you share your entire snort.lua file?



Albert Lewis

Email: [email protected]<mailto:[email protected]>



From: Snort-users <[email protected]> on behalf of teste teste via Snort-users <[email protected]>
Sent: Thursday, November 16, 2023 10:45 AM
To: [email protected] <[email protected]>
Subject: [Snort-users] Issues with Reputation Inspector/Preprocessor



Hello Snort Community,



As the title says, I am having issues with this feature, what I want is to have alerts triggered when a blacklisted IP tries to communicate with my network.

What I want is somrthing like this: https://sublimerobots.com/2015/12/the-snort-reputation-preprocessor/



I am using Snort 3.1.69.0 and this is what I have done so far:

Configured Snort and rules to be used,

[cid:[email protected]]



Configured Reputation Inspector/Preprocessor,

[cid:[email protected]]



This the the alert I pasted for the blacklist alert:

[cid:[email protected]]



My test IP is in the blocklist:

[cid:[email protected]]



The rules are loaded, the reputation rule is classified as the builtin rule.

[cid:[email protected]]



Only these alerts appear

[cid:[email protected]]



And I would like something like “12/09-20:25:10.423907 [136:1:1] (spp_reputation) packets blacklisted [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 10.0.0.72:51312 -> 10.0.0.101:22”.





I have been at this for hours trying different things but nothing works, would appreciate it if anyone can give any insight.

Thank you

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette