Re: CIP Packet not being Classified

Hi Russ,

  I was trying to use/decode externally procured CIP flow and it was not classifying any of the packets as CIP packet. Attaching the original packet. Then I exported one packet so that I could see logs and debug and that's the one I sent earlier. Unfortunately, even the original source capture doesn't have TCP establishment captured.

 After your response, I extracted another CIP packet from the source file whose dst port is the lesser than src, but still, it is not classifying as cip.

Any help here is appreciated.

Just one question on your earlier response - Are you saying that there may be an issue with snort code that it takes lower port side as server? Or did I misunderstand?
Isn't it that 44418 is the port reserved for cip and should be used?

( Actually I have seen this issue with other CIP packets also but unable to get now - Will add to this chain once I find )

Regards,
Sreedhar Reddy
________________________________
From: Russ Combs (rucombs) <[email protected]>
Sent: Tuesday, August 20, 2024 9:41 PM
To: Sreedhar Reddy (mopreddy) via Snort-users <[email protected]>; Sreedhar Reddy (mopreddy) <[email protected]>
Subject: Re: CIP Packet not being Classified

Sreedhar,

Both pcaps contain only 1 data packet; neither contains the TCP setup. Consequently, Snort is guessing that the end with the lower port number is the server. For the enip_one pcap, that guess is correct. For the lock_attempt pcap, the guess is not correct. If you can get a full flow, or cook one, you will get the lock_attempt to process correctly.

In the meantime, we can investigate tweaks for that assumption. We should be able to leverage knowledge of binder ports.

Hope that helps.
Russ

________________________________
From: Snort-users <[email protected]> on behalf of Sreedhar Reddy (mopreddy) via Snort-users <[email protected]>
Sent: Tuesday, August 20, 2024 9:19 AM
To: Sreedhar Reddy (mopreddy) via Snort-users <[email protected]>
Subject: Re: [Snort-users] CIP Packet not being Classified


________________________________
From: Sreedhar Reddy (mopreddy)
Sent: Tuesday, August 20, 2024 6:48 PM
To: Sreedhar Reddy (mopreddy) via Snort-users <[email protected]>
Subject: CIP Packet not being Classified

Team,

 I am facing an issue where some  of CIP Packets are not getting classified as CIP packets.  Everything else is same except input CIP packet.

 Your help is greatly appreciated.


Working Case:
snort --talos -r ~/pcaps/cip_enip_one.pcapng  -c /etc/snort/snort.lua --lua  'trace = { modules = {  all = 1  } };'

==>
--------------------------------------------------
Module Statistics
--------------------------------------------------
appid
                  packets: 1
        processed_packets: 1
           total_sessions: 1
--------------------------------------------------
binder
                new_flows: 1
                 inspects: 1
--------------------------------------------------
cip
                  packets: 1
--------------------------------------------------
detection
                 analyzed: 1
--------------------------------------------------


Non-Working Case:
snort --talos -r ~/pcaps/cip_lock_attempt_1.pcap  -c /etc/snort/snort.lua --lua  'trace = { modules = {  all = 1  } };' -k none

==>
--------------------------------------------------
Module Statistics
--------------------------------------------------
appid
                  packets: 1
        processed_packets: 1
           total_sessions: 1
--------------------------------------------------
binder
                new_flows: 1
                 inspects: 1
--------------------------------------------------
detection
                 analyzed: 1
--------------------------------------------------
port_scan
                  packets: 1
                 trackers: 2
--------------------------------------------------
stream
                    flows: 1
--------------------------------------------------
stream_tcp
                 sessions: 1
                      max: 1
                  created: 1
                 released: 1
             instantiated: 1
                   setups: 1
            data_trackers: 1
              segs_queued: 1
            segs_released: 1
          rebuilt_packets: 1
            rebuilt_bytes: 56
          client_cleanups: 1
                 max_segs: 1
                max_bytes: 56
         asymmetric_flows: 1
--------------------------------------------------
Appid Statistics
--------------------------------------------------
detected apps and services
              Application: Services   Clients    Users      Payloads   Misc       Referred
                  unknown: 1          0          0          0          0          0
--------------------------------------------------
Summary Statistics


No CIP statistics here ( added -k none for now as it was showing tcp checksum error )


Regards,
Sreedhar Reddy