Re: CIP Packet not being Classified

Sreedhar,

Both pcaps contain only 1 data packet; neither contains the TCP setup. Consequently, Snort is guessing that the end with the lower port number is the server. For the enip_one pcap, that guess is correct. For the lock_attempt pcap, the guess is not correct. If you can get a full flow, or cook one, you will get the lock_attempt to process correctly.

In the meantime, we can investigate tweaks for that assumption. We should be able to leverage knowledge of binder ports.

Hope that helps.
Russ

________________________________
From: Snort-users <[email protected]> on behalf of Sreedhar Reddy (mopreddy) via Snort-users <[email protected]>
Sent: Tuesday, August 20, 2024 9:19 AM
To: Sreedhar Reddy (mopreddy) via Snort-users <[email protected]>
Subject: Re: [Snort-users] CIP Packet not being Classified


________________________________
From: Sreedhar Reddy (mopreddy)
Sent: Tuesday, August 20, 2024 6:48 PM
To: Sreedhar Reddy (mopreddy) via Snort-users <[email protected]>
Subject: CIP Packet not being Classified

Team,

 I am facing an issue where some  of CIP Packets are not getting classified as CIP packets.  Everything else is same except input CIP packet.

 Your help is greatly appreciated.


Working Case:
snort --talos -r ~/pcaps/cip_enip_one.pcapng  -c /etc/snort/snort.lua --lua  'trace = { modules = {  all = 1  } };'

==>
--------------------------------------------------
Module Statistics
--------------------------------------------------
appid
                  packets: 1
        processed_packets: 1
           total_sessions: 1
--------------------------------------------------
binder
                new_flows: 1
                 inspects: 1
--------------------------------------------------
cip
                  packets: 1
--------------------------------------------------
detection
                 analyzed: 1
--------------------------------------------------


Non-Working Case:
snort --talos -r ~/pcaps/cip_lock_attempt_1.pcap  -c /etc/snort/snort.lua --lua  'trace = { modules = {  all = 1  } };' -k none

==>
--------------------------------------------------
Module Statistics
--------------------------------------------------
appid
                  packets: 1
        processed_packets: 1
           total_sessions: 1
--------------------------------------------------
binder
                new_flows: 1
                 inspects: 1
--------------------------------------------------
detection
                 analyzed: 1
--------------------------------------------------
port_scan
                  packets: 1
                 trackers: 2
--------------------------------------------------
stream
                    flows: 1
--------------------------------------------------
stream_tcp
                 sessions: 1
                      max: 1
                  created: 1
                 released: 1
             instantiated: 1
                   setups: 1
            data_trackers: 1
              segs_queued: 1
            segs_released: 1
          rebuilt_packets: 1
            rebuilt_bytes: 56
          client_cleanups: 1
                 max_segs: 1
                max_bytes: 56
         asymmetric_flows: 1
--------------------------------------------------
Appid Statistics
--------------------------------------------------
detected apps and services
              Application: Services   Clients    Users      Payloads   Misc       Referred
                  unknown: 1          0          0          0          0          0
--------------------------------------------------
Summary Statistics


No CIP statistics here ( added -k none for now as it was showing tcp checksum error )


Regards,
Sreedhar Reddy

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette