duplicated answer with afpacket on docker

Hi all I'm pretty new to snort (not yet read all the doc) and I've a 
stupid question, I launch snort in a docker container in the network 
namespace of the host like so (I will arrange the cap in a second moment)

$ docker run --name snort -h snort3 -u root --network="host" 
--privileged -d -it snort3 bash

I've the test rule:

$ docker exec -it snort cat /usr/local/etc/rules/local.rules
alert icmp any any -> any any ( msg:"ICMP Traffic Detected"; sid: 
10000001; metadata: policy security-ips alert; )

Try to using the afpacket daq (so the socket AFPACKET to clone the layer 
2 packets?) I get duplicated packets in response when I ping from or 
towards the host for example:

$ docker exec -it snort snort -Q --daq afpacket -i eth0 -c 
/usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules -A 
FAST -s 65535 -k none -q
01/28-16:22:24.517667 [**] [1:10000001:0] "ICMP Traffic Detected" [**] 
[Priority: 0] {ICMP} *** -> 142.251.209.35
01/28-16:22:24.536163 [**] [1:10000001:0] "ICMP Traffic Detected" [**] 
[Priority: 0] {ICMP} 142.251.209.35 -> ***
01/28-16:22:24.536163 [**] [1:10000001:0] "ICMP Traffic Detected" [**] 
[Priority: 0] {ICMP} 142.251.209.35 -> ***
01/28-16:22:25.518846 [**] [1:10000001:0] "ICMP Traffic Detected" [**] 
[Priority: 0] {ICMP} *** -> 142.251.209.35
01/28-16:22:25.527230 [**] [1:10000001:0] "ICMP Traffic Detected" [**] 
[Priority: 0] {ICMP} 142.251.209.35 -> ***
01/28-16:22:25.527230 [**] [1:10000001:0] "ICMP Traffic Detected" [**] 
[Priority: 0] {ICMP} 142.251.209.35 -> ***
01/28-16:22:26.520845 [**] [1:10000001:0] "ICMP Traffic Detected" [**] 
[Priority: 0] {ICMP} *** -> 142.251.209.35
01/28-16:22:26.526877 [**] [1:10000001:0] "ICMP Traffic Detected" [**] 
[Priority: 0] {ICMP} 142.251.209.35 -> ***
01/28-16:22:26.526878 [**] [1:10000001:0] "ICMP Traffic Detected" [**] 
[Priority: 0] {ICMP} 142.251.209.35 -> ***

$ ping -c 3 www.google.it
PING www.google.it (142.251.209.35) 56(84) bytes of data.
64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=1 
ttl=115 time=18.7 ms
64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=1 
ttl=115 time=18.7 ms (DUP!)
64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=2 
ttl=115 time=8.46 ms
64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=2 
ttl=115 time=8.46 ms (DUP!)
64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3 
ttl=115 time=6.09 ms

but not with the daq nfq (so attaching to netfilter hooks?)

$ sudo iptables -A INPUT -j NFQUEUE -i eth0 --queue-num 8 --queue-bypass
$ sudo iptables -A OUTPUT -j NFQUEUE -o eth0 --queue-num 8 --queue-bypass


$ docker exec -it snort snort -Q --daq nfq -i 8 -c 
/usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules -A 
FAST -s 65535 -k none -q
01/28-16:27:17.258335 [**] [1:10000001:0] "ICMP Traffic Detected" [**] 
[Priority: 0] {ICMP} *** -> 142.251.209.35
01/28-16:27:17.264648 [**] [1:10000001:0] "ICMP Traffic Detected" [**] 
[Priority: 0] {ICMP} 142.251.209.35 -> ***
01/28-16:27:18.259990 [**] [1:10000001:0] "ICMP Traffic Detected" [**] 
[Priority: 0] {ICMP} *** -> 142.251.209.35
01/28-16:27:18.268708 [**] [1:10000001:0] "ICMP Traffic Detected" [**] 
[Priority: 0] {ICMP} 142.251.209.35 -> ***
01/28-16:27:19.262007 [**] [1:10000001:0] "ICMP Traffic Detected" [**] 
[Priority: 0] {ICMP} *** -> 142.251.209.35
01/28-16:27:19.271043 [**] [1:10000001:0] "ICMP Traffic Detected" [**] 
[Priority: 0] {ICMP} 142.251.209.35 -> ***

$ ping -c 3 www.google.it
PING www.google.it (142.251.209.35) 56(84) bytes of data.
64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=1 
ttl=115 time=6.72 ms
64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=2 
ttl=115 time=8.83 ms
64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3 
ttl=115 time=9.08 ms


If I try the same test directly on the host (with the distro package) I 
don't get the duplicated packet with the afpacket module (so there's not 
loop at least outside the host)
I double check that the container is using the same net namespace of the 
host.. and I flushed the docker default network rules of iptables with 
-F and -X on all the tables (filter, mangle, nat) just in case (also if 
not used).
My question is why this happening
Thanks a lot

Luca


_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette