Re: Multiple alerts generated when detecting HTTP traffic

HTTP message and corresponding Snort alerts list: 

1.  'GET /connecttest.txt HTTP/1.1\r\nContent-Type: text/plain\r\nContent-Length: 14\r\nHost: www.msftconnecttest.com\r\n\r\n/parse_xml.cgi'

    =>

    04/12-23:38:53.265510, 355, TCP, raw, 176, C2S, 127.0.0.1:47120, 127.0.0.1:8080, 1:2086:14, allow
    04/12-23:38:53.265510, 356, TCP, stream_tcp, 14, C2S, 127.0.0.1:47120, 127.0.0.1:8080, 1:2086:14, allow

2.  'GET /connecttest.txt HTTP/1.1\r\nContent-Type: text/plain\r\nContent-Length: 14\r\nHost: www.msftconnecttest.com\r\n\r\n/parse_xml.cgi/parse_xml.cgi'

    =>

    04/12-23:41:03.651800, 1031, TCP, raw, 190, C2S, 127.0.0.1:58780, 127.0.0.1:8080, 1:2086:14, allow

    04/12-23:41:03.651800, 1032, TCP, stream_tcp, 14, C2S, 127.0.0.1:58780, 127.0.0.1:8080, 1:2086:14, allow
    04/12-23:41:03.651800, 1035, TCP, stream_tcp, 14, C2S, 127.0.0.1:58780, 127.0.0.1:8080, 1:2086:14, allow

3.  'GET /connecttest.txt HTTP/1.1\r\nContent-Type: text/plain\r\nContent-Length: 28\r\nHost: www.msftconnecttest.com\r\n\r\n/parse_xml.cgi/parse_xml.cgi'

    =>

    04/12-23:41:57.336934, 1639, TCP, raw, 190, C2S, 127.0.0.1:54852, 127.0.0.1:8080, 1:2086:14, allow
    04/12-23:41:57.336934, 1640, TCP, stream_tcp, 28, C2S, 127.0.0.1:54852, 127.0.0.1:8080, 1:2086:14, allow

4.  'GET /parse_xml.cgi HTTP/1.1\r\nContent-Type: text/plain\r\nContent-Length: 0\r\nHost: www.msftconnecttest.com\r\n\r\n'

    =>

    04/12-23:42:45.034787, 2364, TCP, raw, 159, C2S, 127.0.0.1:43482, 127.0.0.1:8080, 1:2086:14, allow




-----原始邮件-----
发件人:"Russ Combs (rucombs)" <[email protected]>
发送时间:2024-04-12 21:55:25 (星期五)
收件人: "徐必昂" <[email protected]>, "[email protected]" <[email protected]>
抄送:
主题: Re: [Snort-users] Multiple alerts generated when detecting HTTP traffic


Run your test that generates multiple alerts using -A csv instead of -A alert_full and send the csv alerts you get.
From: Snort-users <[email protected]> on behalf of 徐必昂 <[email protected]>
Sent: Thursday, April 11, 2024 4:40 AM
To: [email protected] <[email protected]>
Subject: [Snort-users] Multiple alerts generated when detecting HTTP traffic
 
Hello. I previously raised an issue on github (https://github.com/snort3/snort3/issues/356), "InverseRE" told me it was because I enabled the search_engine.detect_raw_tcp option, but when I tested it using the following two commands the output was the same:
    sudo snort -c /usr/local/etc/snort/snort.lua -i lo -R /path/to/rule/file -A alert_full -k none --lua 'search_engine.detect_raw_tcp = true'
    sudo snort -c /usr/local/etc/snort/snort.lua -i lo -R /path/to/rule/file -A alert_full -k none --lua 'search_engine.detect_raw_tcp = false'
I saved the output of the two commands to files and compared them. The results are as follows:
    $ diff detect_raw_tcp_false.log detect_raw_tcp_true.log
    117c117
    < appid: MaxRss diff: 3024
    ---
    > appid: MaxRss diff: 3144
    241,242c241,242
    <                   seconds: 0.024722
    <                  pkts/sec: 324
    ---
    >                   seconds: 0.024748
    >                  pkts/sec: 323
And according to the snort3 documentation, this option is set to false by default, and I didn't modify it.
So is this option the cause of the problem? If so, what's wrong with my command? If not, what causes this problem?

Thanks.
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        [email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette