Re: Help regarding GTP Inspect Inspector

Try this one.

box@box:/var/tmp/snort3$ ./bin/snort -c etc/snort/aditya.lua -r etc/snort/aditya.pcap -R etc/snort/aditya.rules -Acsv -k none  -q
08/19-11:35:05.000050, 1, UDP, raw, 922, C2S, 172.16.12.2:2152, 10.200.11.70:2152, 143:1:0, allow





Albert Lewis

Email: [email protected]<mailto:[email protected]>

________________________________
From: Snort-users <[email protected]> on behalf of Al Lewis (allewi) via Snort-users <[email protected]>
Sent: Monday, August 19, 2024 1:10 PM
To: Russ Combs (rucombs) <[email protected]>; [email protected] <[email protected]>; Aditya Venkatesh <[email protected]>
Subject: Re: [Snort-users] Help regarding GTP Inspect Inspector

Thanks Russ,

Aditya, I guess that answers why all of the traffic is being discarded and not inspected.


Albert Lewis

Email: [email protected]<mailto:[email protected]>

________________________________
From: Russ Combs (rucombs) <[email protected]>
Sent: Monday, August 19, 2024 1:05 PM
To: [email protected] <[email protected]>; Aditya Venkatesh <[email protected]>; Al Lewis (allewi) <[email protected]>
Subject: Re: [Snort-users] Help regarding GTP Inspect Inspector

The packet is eth:ip:udp:gtp:ip:udp:data which is decoded OK but gtp_inspect is not processing it because the inner proto is UDP data. There are length checks by the codec for 116:298 which is not raised and there are length checks by the inspector for 143:1 which do not apply to type 0xFF (T-PDU). So this isn't going to alert either way.
________________________________
From: Snort-users <[email protected]> on behalf of Al Lewis (allewi) via Snort-users <[email protected]>
Sent: Monday, August 19, 2024 12:13 PM
To: [email protected] <[email protected]>; Aditya Venkatesh <[email protected]>; Al Lewis (allewi) <[email protected]>
Subject: Re: [Snort-users] Help regarding GTP Inspect Inspector

If you check the "src/service_inspectors/gtp/gtp_parser.cc" file you can see all of the conditions being checked that can cause the "GTP_EVENT_BAD_MSG_LEN" event.



Albert Lewis

Email: [email protected]<mailto:[email protected]>

________________________________
From: Snort-users <[email protected]> on behalf of Al Lewis (allewi) via Snort-users <[email protected]>
Sent: Monday, August 19, 2024 11:15 AM
To: [email protected] <[email protected]>; Aditya Venkatesh <[email protected]>
Subject: Re: [Snort-users] Help regarding GTP Inspect Inspector

Hello,

      Which packet are you expecting to alert on? When looking at them in wireshark, none of them have an invalid packet length so you wont receive an alert.


Albert Lewis

Email: [email protected]<mailto:[email protected]>

________________________________
From: Snort-users <[email protected]> on behalf of Aditya Venkatesh via Snort-users <[email protected]>
Sent: Friday, August 16, 2024 7:37 AM
To: [email protected] <[email protected]>
Subject: [Snort-users] Help regarding GTP Inspect Inspector

Hello!
I am currently working on trying to configure snort 3 to process GTP packets.
I have enabled the inspector in the snort.lua. In my rules file, I have included gid:143, sid:1. But when snort is run against a pcap file, the inspector does not seem to be triggered/activated.
Not sure what steps I am missing.
Any help in this regard would be greatly appreciated.

Attached to this mail is the pcap file, configuration and the rule that I have tried.

Configuration (gtp specific portions not full configuration file):
gtp_inspect = default_gtp
binder =
{
{ when = { proto = 'udp', ports = '2123 2152 3386', role='server' }, use = { type = 'gtp_inspect' } },
{ when = { service = 'gtp' },              use = { type = 'gtp_inspect' } }
}


Rule used:
alert (message:"Invalid Length";gid:143;sid:1;)

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette