Re: Help regarding GTP Inspect Inspector

If you check the "src/service_inspectors/gtp/gtp_parser.cc" file you can see all of the conditions being checked that can cause the "GTP_EVENT_BAD_MSG_LEN" event.



Albert Lewis

Email: [email protected]<mailto:[email protected]>

________________________________
From: Snort-users <[email protected]> on behalf of Al Lewis (allewi) via Snort-users <[email protected]>
Sent: Monday, August 19, 2024 11:15 AM
To: [email protected] <[email protected]>; Aditya Venkatesh <[email protected]>
Subject: Re: [Snort-users] Help regarding GTP Inspect Inspector

Hello,

      Which packet are you expecting to alert on? When looking at them in wireshark, none of them have an invalid packet length so you wont receive an alert.


Albert Lewis

Email: [email protected]<mailto:[email protected]>

________________________________
From: Snort-users <[email protected]> on behalf of Aditya Venkatesh via Snort-users <[email protected]>
Sent: Friday, August 16, 2024 7:37 AM
To: [email protected] <[email protected]>
Subject: [Snort-users] Help regarding GTP Inspect Inspector

Hello!
I am currently working on trying to configure snort 3 to process GTP packets.
I have enabled the inspector in the snort.lua. In my rules file, I have included gid:143, sid:1. But when snort is run against a pcap file, the inspector does not seem to be triggered/activated.
Not sure what steps I am missing.
Any help in this regard would be greatly appreciated.

Attached to this mail is the pcap file, configuration and the rule that I have tried.

Configuration (gtp specific portions not full configuration file):
gtp_inspect = default_gtp
binder =
{
{ when = { proto = 'udp', ports = '2123 2152 3386', role='server' }, use = { type = 'gtp_inspect' } },
{ when = { service = 'gtp' },              use = { type = 'gtp_inspect' } }
}


Rule used:
alert (message:"Invalid Length";gid:143;sid:1;)

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette