Re: Snort 3.5 Logging Packets to a PCAP File of a Triggered Alert
Yehor Velykozhon via Snort-users <[email protected]> Mon, 25 Nov 2024 13:34:02 +0000
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <AS2PR05MB101049B95AE625D4D91DA4111BC2E2@AS2PR05MB10104.eurprd05.prod.outlook.com> |
--===============4257408649298189848== Content-Language: en-GB Content-Type: multipart/alternative; boundary="_000_AS2PR05MB101049B95AE625D4D91DA4111BC2E2AS2PR05MB10104eu_" --_000_AS2PR05MB101049B95AE625D4D91DA4111BC2E2AS2PR05MB10104eu_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hello Justin, in order to provide meaningful answer to your question, I=92d like to give = more context on how Snort3 works. Difference between Snort2 and Snort3 Snort2, in majority of cases, is working with wire packets. Opposite to it, Snort3 uses wire packets to create meaningful (for protocol= s) PDU and evaluate those. Due to mentioned difference, wire packets in Snort3 are giving much less co= ntext on =93Why IPS event was generated=94. What exactly could happen in Snort3 Whenever Snort3 received some wire packet, for example some TCP payload, it= could be easily reassembled in various ways: * accumulate several fragmented wire packets into single pseudo packet * reassemble TCP packet into PDU once ACK packet is received * etc. How exactly PDU will look like =96 fully depend on protocol and configurati= on. Due to such complex handling of wire packets, it=92s a common case when log= ged packet isn=92t directly related to IPS event. For example, IPS event is generated on ACK packet, instead of the real mali= cious one. In a fact, Snort3 can generate several PDU on same wire packet =96 in order= to provide useful data to protocol handlers. Note: to get more details of how it=92s works, check the documentation for = stream and splitters. Beside such reassembling of wire packets, there could be another difference= between those: decompression, decoding, normalization, etc. For example, Snort3 could decompress transferred over some protocol (http, = ftp, etc.) archive. Also, Snort3 could modify received packet (check =93normalizer=94 module) d= uring processing. Due to all mentioned points, it could be really hard to understand the stat= e of Snort3 in a moment of IPS event only based on wire packet dump. As a final step, there could be another layer of specific to Snort3 context= =96 IPS buffers. Such buffers are used during detection stage and depend on various things. = Good example =96 base64_decode. That IPS buffer will be generated based on received packet =96 either PDU o= r wire packet =96 and generated during detection stage. Packet in pcap Overall, replaying single packet (even with artificially added handshake) w= on=92t make Snort3 generate same IPS event in majority of cases: Snort3 nee= d the full context of connection to perform correct decoding, reassembling,= detection. Beside it, there easily could be some cases when a single packet itself won= =92t be enough to be matched. Example 1. You have 2 rules, 1st set flowbit =93file_zip=94, 2nd can be matched only i= f flowbit =93file_zip=94 is set. If those 2 rules are matched on different packets, only that, final, packet= will be logged (if you=92re checking alert for rule 2). Due to it, replaying single packet won=92t help in this case. Example 2. You have a rule which evaluation is starting at very start of the file, but= it could be matched only at the very end of the file, for example, after 1= 0 mb of data. In this case, only the last packet (where the match occurred) is logged, so= replaying single packet won=92t help. There is a good example of such case in our demo repos: https://github.com/= snort3/snort3_demo/tree/master/tests/framework/detection/stateful_signature= _evaluation Other approaches If you want to analyze why exactly some IPS event happened, take a look at = other loggers. For example, at =93alert_fast=94. It has configuration =93buffers=94 =96 th= at one will dump extra buffers, except current evaluated packet. It has 3 types of configurations which define what should be dumped: * =93rule=94 =96 all the IPS buffers that were used to match the rule * =93inspector=94 =96 all the buffers that current protocol handler (se= rvice inspector) could provide * =93both=94 =96 well, just both options enabled Thanks to all of those dumps, not only you can get wire packet, but also yo= u other buffers that Snort3 used/saw in the connection before/at the moment= of IPS event. Beside it, I=92d like to highlight that you can use several loggers simulta= neously. So, you can configure alert_json - as you used to use it and alert_fast wit= h buffers dump =96 to get a proper way to troubleshoot IPS events. How to dump packet to pcap format If you want to get a packet as pcap file, you can take a look at unified2 l= ogger. It=92ll dump IPS event in binary format so you can use the tool =93u= 2boat=94 (which is in located in same directly as Snort3 binary be default)= to generate a pcap file based on that log. Thanks, Yehor. From: Snort-users <[email protected]> on behalf of Justin= Forte via Snort-users <[email protected]> Date: Friday, 15 November 2024 at 16:17 To: [email protected] <[email protected]> Subject: [Snort-users] Snort 3.5 Logging Packets to a PCAP File of a Trigge= red Alert CAUTION: This email originated from outside the organization. Do not click = links or open attachments unless you recognize the sender and know the cont= ent is safe. Hello, I have a question hopefully I can get an answer for. I am new to Snort and= have been tasked with upgrading our IDS boxes with Snort from 2.9.20 to 3.= 5. I have everything setup except for I am having issues with recreating a= process from our Snort 2.9.20 system. Currently on our 2.9.20 build it is= setup to log triggered alerts and then captures and logs PCAPs around the = triggered alert. I can get the alert_json configured how I want and it wil= l work. I have attempted to use pcap_log with defaults but the pcap file d= oes not populate to store the packets. I can add the -L and add pcap or lo= g_pcap but this captures all the packets, which is not something we want at= this time. Can anyone guide me in a way I can configure packets to be cap= tured to a pcap file around a triggered alert? Thanks, Justin Forte IT Cybersecurity Analyst I O: 417.831.8838 [Image removed by sender. City Utilities] [Image removed by sender. City Utilities]<http://www.cityutilities.net/> PO Box 551 | Springfield, MO 65801-0551 cityutilities.net<http://www.cityutilities.net/> --_000_AS2PR05MB101049B95AE625D4D91DA4111BC2E2AS2PR05MB10104eu_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:= //www.w3.org/TR/REC-html40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1= 252"> <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <!--[if !mso]><style>v\:* {behavior:url(#default#VML);} o\:* {behavior:url(#default#VML);} w\:* {behavior:url(#default#VML);} .shape {behavior:url(#default#VML);} </style><![endif]--><style><!-- /* Font Definitions */ @font-face {font-family:Wingdings; panose-1:5 0 0 0 0 0 0 0 0 0;} @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Aptos; panose-1:2 11 0 4 2 2 2 2 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm; font-size:11.0pt; font-family:"Aptos",sans-serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:#467886; text-decoration:underline;} p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph {mso-style-priority:34; margin-top:0cm; margin-right:0cm; margin-bottom:0cm; margin-left:36.0pt; font-size:11.0pt; font-family:"Aptos",sans-serif;} span.EmailStyle21 {mso-style-type:personal-reply; font-family:"Calibri",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only; font-size:11.0pt; mso-ligatures:none;} @page WordSection1 {size:612.0pt 792.0pt; margin:72.0pt 72.0pt 72.0pt 72.0pt;} div.WordSection1 {page:WordSection1;} /* List Definitions */ @list l0 {mso-list-id:1057624667; mso-list-type:hybrid; mso-list-template-ids:-246633608 -716557634 134807555 134807557 134807553 = 134807555 134807557 134807553 134807555 134807557;} @list l0:level1 {mso-level-start-at:0; mso-level-number-format:bullet; mso-level-text:\F0B7 ; mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-18.0pt; font-family:Symbol; mso-fareast-font-family:Calibri; mso-bidi-font-family:Arial;} @list l0:level2 {mso-level-number-format:bullet; mso-level-text:o; mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-18.0pt; font-family:"Courier New";} @list l0:level3 {mso-level-number-format:bullet; mso-level-text:\F0A7 ; mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-18.0pt; font-family:Wingdings;} @list l0:level4 {mso-level-number-format:bullet; mso-level-text:\F0B7 ; mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-18.0pt; font-family:Symbol;} @list l0:level5 {mso-level-number-format:bullet; mso-level-text:o; mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-18.0pt; font-family:"Courier New";} @list l0:level6 {mso-level-number-format:bullet; mso-level-text:\F0A7 ; mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-18.0pt; font-family:Wingdings;} @list l0:level7 {mso-level-number-format:bullet; mso-level-text:\F0B7 ; mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-18.0pt; font-family:Symbol;} @list l0:level8 {mso-level-number-format:bullet; mso-level-text:o; mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-18.0pt; font-family:"Courier New";} @list l0:level9 {mso-level-number-format:bullet; mso-level-text:\F0A7 ; mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-18.0pt; font-family:Wingdings;} ol {margin-bottom:0cm;} ul {margin-bottom:0cm;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--> </head> <body lang=3D"en-UA" link=3D"#467886" vlink=3D"#96607D" style=3D"word-wrap:= break-word"> <div class=3D"WordSection1"> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US">Hello </span><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-family:"Ari= al",sans-serif;color:black">Justin,<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black">in order to provide meanin= gful answer to your question, I=92d like to give more context on how Snort3= works.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:16.0pt;font-= family:"Arial",sans-serif;color:black">Difference between Snort2 = and Snort3<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black">Snort2, in majority of cas= es, is working with wire packets.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black">Opposite to it, Snort3 use= s wire packets to create meaningful (for protocols) PDU and evaluate those.= <o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black">Due to mentioned differenc= e, wire packets in Snort3 are giving much less context on =93Why IPS event = was generated=94.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:16.0pt;font-= family:"Arial",sans-serif;color:black">What exactly could happen = in Snort3<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black">Whenever Snort3 received s= ome wire packet, for example some TCP payload, it could be easily reassembl= ed in various ways:<o:p></o:p></span></p> <ul style=3D"margin-top:0cm" type=3D"disc"> <li class=3D"MsoListParagraph" style=3D"color:black;margin-left:0cm;mso-lis= t:l0 level1 lfo1"> <span lang=3D"EN-US" style=3D"font-size:10.0pt;font-family:"Arial"= ;,sans-serif">accumulate several fragmented wire packets into single pseudo= packet<o:p></o:p></span></li><li class=3D"MsoListParagraph" style=3D"color= :black;margin-left:0cm;mso-list:l0 level1 lfo1"> <span lang=3D"EN-US" style=3D"font-size:10.0pt;font-family:"Arial"= ;,sans-serif">reassemble TCP packet into PDU once ACK packet is received<o:= p></o:p></span></li><li class=3D"MsoListParagraph" style=3D"color:black;mar= gin-left:0cm;mso-list:l0 level1 lfo1"> <span lang=3D"EN-US" style=3D"font-size:10.0pt;font-family:"Arial"= ;,sans-serif">etc.<o:p></o:p></span></li></ul> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black">How exactly PDU will look = like =96 fully depend on protocol and configuration.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black">Due to such complex handli= ng of wire packets, it=92s a common case when logged packet isn=92t directl= y related to IPS event.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black">For example, IPS event is = generated on ACK packet, instead of the real malicious one.<o:p></o:p></spa= n></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black">In a fact, Snort3 can gene= rate several PDU on same wire packet =96 in order to provide useful data to= protocol handlers.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black">Note: to get more details = of how it=92s works, check the documentation for stream and splitters.<o:p>= </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black">Beside such reassembling o= f wire packets, there could be another difference between those: decompress= ion, decoding, normalization, etc.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black">For example, Snort3 could = decompress transferred over some protocol (http, ftp, etc.) archive.<o:p></= o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black">Also, Snort3 could modify = received packet (check =93normalizer=94 module) during processing.<o:p></o:= p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black">Due to all mentioned point= s, it could be really hard to understand the state of Snort3 in a moment of= IPS event only based on wire packet dump.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black">As a final step, there cou= ld be another layer of specific to Snort3 context =96 IPS buffers.<o:p></o:= p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black">Such buffers are used duri= ng detection stage and depend on various things. Good example =96 base64_de= code.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black">That IPS buffer will be ge= nerated based on received packet =96 either PDU or wire packet =96 and gene= rated during detection stage.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:16.0pt;font-= family:"Arial",sans-serif;color:black">Packet in pcap<o:p></o:p><= /span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-= family:"Arial",sans-serif;color:black"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US">Overall, replaying single = packet (even with artificially added handshake) won=92t make Snort3 generat= e same IPS event in majority of cases: Snort3 need the full context of connection to perform correct decoding, reassembling, = detection.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US">Beside it, there easily co= uld be some cases when a single packet itself won=92t be enough to be match= ed.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US"><br> Example 1. <o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US">You have 2 rules, 1<sup>st= </sup> set flowbit =93file_zip=94, 2<sup>nd</sup> can be matched only if fl= owbit =93file_zip=94 is set.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US">If those 2 rules are match= ed on different packets, only that, final, packet will be logged (if you=92= re checking alert for rule 2).<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US">Due to it, replaying singl= e packet won=92t help in this case. <o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US">Example 2.<o:p></o:p></spa= n></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US">You have a rule which eval= uation is starting at very start of the file, but it could be matched only = at the very end of the file, for example, after 10 mb of data.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US">In this case, only the las= t packet (where the match occurred) is logged, so replaying single packet w= on=92t help.<br> There is a good example of such case in our demo repos: <a href=3D"https://= github.com/snort3/snort3_demo/tree/master/tests/framework/detection/statefu= l_signature_evaluation"> https://github.com/snort3/snort3_demo/tree/master/tests/framework/detection= /stateful_signature_evaluation</a><o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:16.0pt;font-= family:"Calibri",sans-serif;mso-fareast-language:EN-US">Other app= roaches<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US">If you want to analyze why= exactly some IPS event happened, take a look at other loggers.<o:p></o:p><= /span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US">For example, at =93alert_f= ast=94. It has configuration =93buffers=94 =96 that one will dump extra buf= fers, except current evaluated packet.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US">It has 3 types of configur= ations which define what should be dumped:<o:p></o:p></span></p> <ul style=3D"margin-top:0cm" type=3D"disc"> <li class=3D"MsoListParagraph" style=3D"margin-left:0cm;mso-list:l0 level1 = lfo1"><span lang=3D"EN-US" style=3D"font-family:"Calibri",sans-se= rif;mso-fareast-language:EN-US">=93rule=94 =96 all the IPS buffers that wer= e used to match the rule<o:p></o:p></span></li><li class=3D"MsoListParagrap= h" style=3D"margin-left:0cm;mso-list:l0 level1 lfo1"><span lang=3D"EN-US" s= tyle=3D"font-family:"Calibri",sans-serif;mso-fareast-language:EN-= US">=93inspector=94 =96 all the buffers that current protocol handler (serv= ice inspector) could provide<o:p></o:p></span></li><li class=3D"MsoListPara= graph" style=3D"margin-left:0cm;mso-list:l0 level1 lfo1"><span lang=3D"EN-U= S" style=3D"font-family:"Calibri",sans-serif;mso-fareast-language= :EN-US">=93both=94 =96 well, just both options enabled<o:p></o:p></span></l= i></ul> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US">Thanks to all of those dum= ps, not only you can get wire packet, but also you other buffers that Snort= 3 used/saw in the connection before/at the moment of IPS event.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US">Beside it, I=92d like to h= ighlight that you can use several loggers simultaneously.<o:p></o:p></span>= </p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US">So, you can configure aler= t_json - as you used to use it and alert_fast with buffers dump =96 to get = a proper way to troubleshoot IPS events.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:16.0pt;font-= family:"Calibri",sans-serif;mso-fareast-language:EN-US">How to du= mp packet to pcap format<o:p></o:p></span></p> <p class=3D"MsoNormal"><b><span lang=3D"EN-US" style=3D"font-family:"C= alibri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span= ></b></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US">If you want to get a packe= t as pcap file, you can take a look at unified2 logger. It=92ll dump IPS ev= ent in binary format so you can use the tool =93u2boat=94 (which is in located in same directly as Snort3 binary be default) to gene= rate a pcap file based on that log.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></= p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US">Thanks, Yehor.<o:p></o:p><= /span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></= p> <div id=3D"mail-editor-reference-message-container"> <div> <div> <div style=3D"border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm = 0cm 0cm"> <p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><b><span lang=3D"EN-U= S" style=3D"font-size:12.0pt;color:black">From: </span></b><span lang=3D"EN-US" style=3D"font-size:12.0pt;color:black">Snor= t-users <[email protected]> on behalf of Justin For= te via Snort-users <[email protected]><br> <b>Date: </b>Friday, 15 November 2024 at 16:17<br> <b>To: </b>[email protected] <[email protected]><= br> <b>Subject: </b>[Snort-users] Snort 3.5 Logging Packets to a PCAP File of a= Triggered Alert<o:p></o:p></span></p> </div> <table class=3D"MsoNormalTable" border=3D"0" cellspacing=3D"0" cellpadding= =3D"0" align=3D"left"> <tbody> <tr> <td style=3D"background:#BBA555;padding:5.25pt 5.5pt 5.25pt 1.5pt"></td> <td width=3D"100%" style=3D"width:100.0%;background:#FFE599;padding:5.25pt = 3.75pt 5.25pt 11.25pt"> <div> <p style=3D"mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-w= rap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizon= tal:column;mso-height-rule:exactly"> <b><span style=3D"font-size:11.0pt;font-family:"Arial",sans-serif= ;color:#212121">CAUTION:</span></b><span style=3D"font-size:11.0pt;font-fam= ily:"Arial",sans-serif;color:#212121"> This email originated from= outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. </span><o:p>= </o:p></p> </div> </td> </tr> </tbody> </table> <div> <div> <p class=3D"MsoNormal"><span lang=3D"EN-US">Hello,<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"> <o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">I have a question hopefully I c= an get an answer for. I am new to Snort and have been tasked with upg= rading our IDS boxes with Snort from 2.9.20 to 3.5. I have everything= setup except for I am having issues with recreating a process from our Snort 2.9.20 system. Currently on our 2.9.20 buil= d it is setup to log triggered alerts and then captures and logs PCAPs arou= nd the triggered alert. I can get the alert_json configured how I wan= t and it will work. I have attempted to use pcap_log with defaults but the pcap file does not populate to store the pa= ckets. I can add the -L and add pcap or log_pcap but this captures al= l the packets, which is not something we want at this time. Can anyon= e guide me in a way I can configure packets to be captured to a pcap file around a triggered alert?<o:p></o:p></span><= /p> <p class=3D"MsoNormal"><span lang=3D"EN-US"> <o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">Thanks,<o:p></o:p></span></p> <p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><span lang=3D"EN-US" = style=3D"font-size:10.0pt;font-family:"Arial",sans-serif;color:bl= ack">Justin Forte<br> IT Cybersecurity Analyst I<br> O: 417.831.8838</span><span lang=3D"EN-US"><o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"> <o:p></o:p></span></p> </div> <p><span lang=3D"EN-US" style=3D"font-family:"Arial",sans-serif">= <br> <span style=3D"border:solid windowtext 1.0pt;padding:0cm"><img border=3D"0"= width=3D"300" height=3D"12" style=3D"width:3.125in;height:.125in" id=3D"_x= 0000_i1026" src=3D"cid:~WRD0000.jpg" alt=3D"Image removed by sender. City U= tilities"></span><br> <br> <a href=3D"http://www.cityutilities.net/" title=3D""Link: City Utiliti= es" t "><span style=3D"color:windowtext;text-decoration:none"><span st= yle=3D"color:#467886;border:solid windowtext 1.0pt;padding:0cm"><img border= =3D"0" width=3D"125" height=3D"75" style=3D"width:1.302in;height:.7812in" i= d=3D"_x0000_i1025" src=3D"cid:~WRD0000.jpg" alt=3D"Image removed by sender.= City Utilities"></span></span></a><br> <br> </span><span lang=3D"EN-US" style=3D"font-size:10.0pt;font-family:"Ari= al",sans-serif">PO Box 551 | Springfield, MO 65801-0551<br> <a href=3D"http://www.cityutilities.net/" target=3D"_blank" title=3D"Link: = City Utilities">cityutilities.net</a></span><span lang=3D"EN-US"><o:p></o:p= ></span></p> </div> </div> </div> </div> </div> </body> </html> --_000_AS2PR05MB101049B95AE625D4D91DA4111BC2E2AS2PR05MB10104eu_-- --===============4257408649298189848== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette --===============4257408649298189848==--