Re: duplicated answer with afpacket on docker

--===============3174352274804308351==
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_1566FB07-6B27-46D6-A80E-B815C00D0670"


--Apple-Mail=_1566FB07-6B27-46D6-A80E-B815C00D0670
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

Hi Luca,

Duplicate packets can sometimes happen when you=E2=80=99re using packet =
capture in a containerized environment. When you use the afpacket DAQ =
with Snort, it captures packets at the data link layer. In Docker, =
packets can sometimes get duplicated because of how network namespaces =
are set up, especially when you use the =E2=80=94network=3D=E2=80=9Chost=E2=
=80=9D mode. This mode tells the container to use the host=E2=80=99s =
network stack, which can sometimes lead to unexpected things like packet =
duplication if you=E2=80=99re not careful.

Here are a few suggestions that might help resolve or further diagnose =
the issue:
Check Ethernet Interface: Make sure Snort is not inadvertently capturing =
packets from multiple interfaces. Specifying the exact interface (e.g., =
-i eth0) should help, but double-check that your container and host =
setups are consistent.
DAQ Module Behavior: Different DAQ modules can handle packet capturing =
differently. As you've observed, the nfq DAQ doesn't produce duplicate =
packets, likely because it's leveraging netfilter hooks, which operate =
differently from afpacket. If nfq works without duplication, it might be =
a more stable choice.
So, you said that running Snort directly on the host doesn=E2=80=99t =
cause duplication issues. That means the problem might be specific to =
the container environment. Let=E2=80=99s try comparing packet captures =
using tools like tcpdump on both the host and container interfaces.=20

> On Jan 28, 2025, at 11:44, fusillator via Snort-users =
<[email protected]> wrote:
>=20
> Hi all I'm pretty new to snort (not yet read all the doc) and I've a =
stupid question, I launch snort in a docker container in the network =
namespace of the host like so (I will arrange the cap in a second =
moment)
>=20
> $ docker run --name snort -h snort3 -u root --network=3D"host" =
--privileged -d -it snort3 bash
>=20
> I've the test rule:
>=20
> $ docker exec -it snort cat /usr/local/etc/rules/local.rules
> alert icmp any any -> any any ( msg:"ICMP Traffic Detected"; sid: =
10000001; metadata: policy security-ips alert; )
>=20
> Try to using the afpacket daq (so the socket AFPACKET to clone the =
layer 2 packets?) I get duplicated packets in response when I ping from =
or towards the host for example:
>=20
> $ docker exec -it snort snort -Q --daq afpacket -i eth0 -c =
/usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules -A =
FAST -s 65535 -k none -q
> 01/28-16:22:24.517667 [**] [1:10000001:0] "ICMP Traffic Detected" [**] =
[Priority: 0] {ICMP} *** -> 142.251.209.35
> 01/28-16:22:24.536163 [**] [1:10000001:0] "ICMP Traffic Detected" [**] =
[Priority: 0] {ICMP} 142.251.209.35 -> ***
> 01/28-16:22:24.536163 [**] [1:10000001:0] "ICMP Traffic Detected" [**] =
[Priority: 0] {ICMP} 142.251.209.35 -> ***
> 01/28-16:22:25.518846 [**] [1:10000001:0] "ICMP Traffic Detected" [**] =
[Priority: 0] {ICMP} *** -> 142.251.209.35
> 01/28-16:22:25.527230 [**] [1:10000001:0] "ICMP Traffic Detected" [**] =
[Priority: 0] {ICMP} 142.251.209.35 -> ***
> 01/28-16:22:25.527230 [**] [1:10000001:0] "ICMP Traffic Detected" [**] =
[Priority: 0] {ICMP} 142.251.209.35 -> ***
> 01/28-16:22:26.520845 [**] [1:10000001:0] "ICMP Traffic Detected" [**] =
[Priority: 0] {ICMP} *** -> 142.251.209.35
> 01/28-16:22:26.526877 [**] [1:10000001:0] "ICMP Traffic Detected" [**] =
[Priority: 0] {ICMP} 142.251.209.35 -> ***
> 01/28-16:22:26.526878 [**] [1:10000001:0] "ICMP Traffic Detected" [**] =
[Priority: 0] {ICMP} 142.251.209.35 -> ***
>=20
> $ ping -c 3 www.google.it
> PING www.google.it (142.251.209.35) 56(84) bytes of data.
> 64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D1 =
ttl=3D115 time=3D18.7 ms
> 64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D1 =
ttl=3D115 time=3D18.7 ms (DUP!)
> 64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D2 =
ttl=3D115 time=3D8.46 ms
> 64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D2 =
ttl=3D115 time=3D8.46 ms (DUP!)
> 64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D3 =
ttl=3D115 time=3D6.09 ms
>=20
> but not with the daq nfq (so attaching to netfilter hooks?)
>=20
> $ sudo iptables -A INPUT -j NFQUEUE -i eth0 --queue-num 8 =
--queue-bypass
> $ sudo iptables -A OUTPUT -j NFQUEUE -o eth0 --queue-num 8 =
--queue-bypass
>=20
>=20
> $ docker exec -it snort snort -Q --daq nfq -i 8 -c =
/usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules -A =
FAST -s 65535 -k none -q
> 01/28-16:27:17.258335 [**] [1:10000001:0] "ICMP Traffic Detected" [**] =
[Priority: 0] {ICMP} *** -> 142.251.209.35
> 01/28-16:27:17.264648 [**] [1:10000001:0] "ICMP Traffic Detected" [**] =
[Priority: 0] {ICMP} 142.251.209.35 -> ***
> 01/28-16:27:18.259990 [**] [1:10000001:0] "ICMP Traffic Detected" [**] =
[Priority: 0] {ICMP} *** -> 142.251.209.35
> 01/28-16:27:18.268708 [**] [1:10000001:0] "ICMP Traffic Detected" [**] =
[Priority: 0] {ICMP} 142.251.209.35 -> ***
> 01/28-16:27:19.262007 [**] [1:10000001:0] "ICMP Traffic Detected" [**] =
[Priority: 0] {ICMP} *** -> 142.251.209.35
> 01/28-16:27:19.271043 [**] [1:10000001:0] "ICMP Traffic Detected" [**] =
[Priority: 0] {ICMP} 142.251.209.35 -> ***
>=20
> $ ping -c 3 www.google.it
> PING www.google.it (142.251.209.35) 56(84) bytes of data.
> 64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D1 =
ttl=3D115 time=3D6.72 ms
> 64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D2 =
ttl=3D115 time=3D8.83 ms
> 64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D3 =
ttl=3D115 time=3D9.08 ms
>=20
>=20
> If I try the same test directly on the host (with the distro package) =
I don't get the duplicated packet with the afpacket module (so there's =
not loop at least outside the host)
> I double check that the container is using the same net namespace of =
the host.. and I flushed the docker default network rules of iptables =
with -F and -X on all the tables (filter, mangle, nat) just in case =
(also if not used).
> My question is why this happening
> Thanks a lot
>=20
> Luca
>=20
>=20
> _______________________________________________
> Snort-users mailing list
> [email protected]
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>=20
> 	To unsubscribe, send an email to:
> 	[email protected]
>=20
> Please visit http://blog.snort.org to stay current on all the latest =
Snort news!
>=20
> Please follow these rules: =
https://snort.org/faq/what-is-the-mailing-list-etiquette


--Apple-Mail=_1566FB07-6B27-46D6-A80E-B815C00D0670
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=utf-8

<html><head><meta http-equiv=3D"content-type" content=3D"text/html; =
charset=3Dutf-8"></head><body style=3D"overflow-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;"><p =
style=3D"caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); margin: 0px; =
font-stretch: normal; font-size: 13px; line-height: normal; =
font-size-adjust: none; font-kerning: auto; font-variant-alternates: =
normal; font-variant-ligatures: normal; font-variant-numeric: normal; =
font-variant-east-asian: normal; font-variant-position: normal; =
font-feature-settings: normal; font-optical-sizing: auto; =
font-variation-settings: normal;">Hi Luca,</p><p style=3D"caret-color: =
rgb(0, 0, 0); color: rgb(0, 0, 0); margin: 0px; min-height: =
14px;"><br><span style=3D"font-stretch: normal; line-height: normal; =
font-size-adjust: none; font-kerning: auto; font-variant-alternates: =
normal; font-variant-ligatures: normal; font-variant-numeric: normal; =
font-variant-east-asian: normal; font-variant-position: normal; =
font-feature-settings: normal; font-optical-sizing: auto; =
font-variation-settings: normal;"></span></p><p style=3D"margin: 0px; =
font-stretch: normal; font-size: 13px; line-height: normal; =
font-size-adjust: none; font-kerning: auto; font-variant-alternates: =
normal; font-variant-ligatures: normal; font-variant-numeric: normal; =
font-variant-east-asian: normal; font-variant-position: normal; =
font-feature-settings: normal; font-optical-sizing: auto; =
font-variation-settings: normal; color: rgb(0, 0, 0);">Duplicate packets =
can sometimes happen when you=E2=80=99re using packet capture in a =
containerized environment. When you use the afpacket DAQ with Snort, it =
captures packets at the data link layer. In Docker, packets can =
sometimes get duplicated because of how network namespaces are set up, =
especially when you use the =E2=80=94network=3D=E2=80=9Chost=E2=80=9D =
mode. This mode tells the container to use the host=E2=80=99s network =
stack, which can sometimes lead to unexpected things like packet =
duplication if you=E2=80=99re not careful.</p><p style=3D"caret-color: =
rgb(0, 0, 0); color: rgb(0, 0, 0); margin: 0px; min-height: 14px;"><span =
style=3D"font-stretch: normal; line-height: normal; font-size-adjust: =
none; font-kerning: auto; font-variant-alternates: normal; =
font-variant-ligatures: normal; font-variant-numeric: normal; =
font-variant-east-asian: normal; font-variant-position: normal; =
font-feature-settings: normal; font-optical-sizing: auto; =
font-variation-settings: normal;"></span><br></p><p style=3D"caret-color: =
rgb(0, 0, 0); color: rgb(0, 0, 0); margin: 0px; font-stretch: normal; =
font-size: 13px; line-height: normal; font-size-adjust: none; =
font-kerning: auto; font-variant-alternates: normal; =
font-variant-ligatures: normal; font-variant-numeric: normal; =
font-variant-east-asian: normal; font-variant-position: normal; =
font-feature-settings: normal; font-optical-sizing: auto; =
font-variation-settings: normal;">Here are a few suggestions that might =
help resolve or further diagnose the issue:</p><ol style=3D"caret-color: =
rgb(0, 0, 0); color: rgb(0, 0, 0);"><li style=3D"margin: 0px; =
font-stretch: normal; font-size: 13px; line-height: normal; =
font-size-adjust: none; font-kerning: auto; font-variant-alternates: =
normal; font-variant-ligatures: normal; font-variant-numeric: normal; =
font-variant-east-asian: normal; font-variant-position: normal; =
font-feature-settings: normal; font-optical-sizing: auto; =
font-variation-settings: normal;"><b>Check Ethernet Interface</b>: Make =
sure Snort is not inadvertently capturing packets from multiple =
interfaces. Specifying the exact interface (e.g., -i eth0) should help, =
but double-check that your container and host setups are =
consistent.</li><li style=3D"margin: 0px; font-stretch: normal; =
font-size: 13px; line-height: normal; font-size-adjust: none; =
font-kerning: auto; font-variant-alternates: normal; =
font-variant-ligatures: normal; font-variant-numeric: normal; =
font-variant-east-asian: normal; font-variant-position: normal; =
font-feature-settings: normal; font-optical-sizing: auto; =
font-variation-settings: normal;"><b>DAQ Module Behavior</b>: Different =
DAQ modules can handle packet capturing differently. As you've observed, =
the nfq DAQ doesn't produce duplicate packets, likely because it's =
leveraging netfilter hooks, which operate differently from afpacket. If =
nfq works without duplication, it might be a more stable choice.</li><li =
style=3D"margin: 0px; font-stretch: normal; font-size: 13px; =
line-height: normal; font-size-adjust: none; font-kerning: auto; =
font-variant-alternates: normal; font-variant-ligatures: normal; =
font-variant-numeric: normal; font-variant-east-asian: normal; =
font-variant-position: normal; font-feature-settings: normal; =
font-optical-sizing: auto; font-variation-settings: normal;"><p =
style=3D"margin: 0px; font-stretch: normal; line-height: normal; =
font-size-adjust: none; font-kerning: auto; font-variant-alternates: =
normal; font-variant-ligatures: normal; font-variant-numeric: normal; =
font-variant-east-asian: normal; font-variant-position: normal; =
font-feature-settings: normal; font-optical-sizing: auto; =
font-variation-settings: normal;"><b>So</b>, you said that running Snort =
directly on the host doesn=E2=80=99t cause duplication issues. That =
means the problem might be specific to the container environment. =
Let=E2=80=99s try comparing packet captures using tools like tcpdump on =
both the host and container =
interfaces.&nbsp;</p></li></ol><div><br><blockquote type=3D"cite"><div>On =
Jan 28, 2025, at 11:44, fusillator via Snort-users =
&lt;[email protected]&gt; wrote:</div><br =
class=3D"Apple-interchange-newline"><div><div>Hi all I'm pretty new to =
snort (not yet read all the doc) and I've a stupid question, I launch =
snort in a docker container in the network namespace of the host like so =
(I will arrange the cap in a second moment)<br><br>$ docker run --name =
snort -h snort3 -u root --network=3D"host" --privileged -d -it snort3 =
bash<br><br>I've the test rule:<br><br>$ docker exec -it snort cat =
/usr/local/etc/rules/local.rules<br>alert icmp any any -&gt; any any ( =
msg:"ICMP Traffic Detected"; sid: 10000001; metadata: policy =
security-ips alert; )<br><br>Try to using the afpacket daq (so the =
socket AFPACKET to clone the layer 2 packets?) I get duplicated packets =
in response when I ping from or towards the host for example:<br><br>$ =
docker exec -it snort snort -Q --daq afpacket -i eth0 -c =
/usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules -A =
FAST -s 65535 -k none -q<br>01/28-16:22:24.517667 [**] [1:10000001:0] =
"ICMP Traffic Detected" [**] [Priority: 0] {ICMP} *** -&gt; =
142.251.209.35<br>01/28-16:22:24.536163 [**] [1:10000001:0] "ICMP =
Traffic Detected" [**] [Priority: 0] {ICMP} 142.251.209.35 -&gt; =
***<br>01/28-16:22:24.536163 [**] [1:10000001:0] "ICMP Traffic Detected" =
[**] [Priority: 0] {ICMP} 142.251.209.35 -&gt; =
***<br>01/28-16:22:25.518846 [**] [1:10000001:0] "ICMP Traffic Detected" =
[**] [Priority: 0] {ICMP} *** -&gt; =
142.251.209.35<br>01/28-16:22:25.527230 [**] [1:10000001:0] "ICMP =
Traffic Detected" [**] [Priority: 0] {ICMP} 142.251.209.35 -&gt; =
***<br>01/28-16:22:25.527230 [**] [1:10000001:0] "ICMP Traffic Detected" =
[**] [Priority: 0] {ICMP} 142.251.209.35 -&gt; =
***<br>01/28-16:22:26.520845 [**] [1:10000001:0] "ICMP Traffic Detected" =
[**] [Priority: 0] {ICMP} *** -&gt; =
142.251.209.35<br>01/28-16:22:26.526877 [**] [1:10000001:0] "ICMP =
Traffic Detected" [**] [Priority: 0] {ICMP} 142.251.209.35 -&gt; =
***<br>01/28-16:22:26.526878 [**] [1:10000001:0] "ICMP Traffic Detected" =
[**] [Priority: 0] {ICMP} 142.251.209.35 -&gt; ***<br><br>$ ping -c 3 =
www.google.it<br>PING www.google.it (142.251.209.35) 56(84) bytes of =
data.<br>64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): =
icmp_seq=3D1 ttl=3D115 time=3D18.7 ms<br>64 bytes from =
mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D1 ttl=3D115 =
time=3D18.7 ms (DUP!)<br>64 bytes from mil04s51-in-f3.1e100.net =
(142.251.209.35): icmp_seq=3D2 ttl=3D115 time=3D8.46 ms<br>64 bytes from =
mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D2 ttl=3D115 =
time=3D8.46 ms (DUP!)<br>64 bytes from mil04s51-in-f3.1e100.net =
(142.251.209.35): icmp_seq=3D3 ttl=3D115 time=3D6.09 ms<br><br>but not =
with the daq nfq (so attaching to netfilter hooks?)<br><br>$ sudo =
iptables -A INPUT -j NFQUEUE -i eth0 --queue-num 8 --queue-bypass<br>$ =
sudo iptables -A OUTPUT -j NFQUEUE -o eth0 --queue-num 8 =
--queue-bypass<br><br><br>$ docker exec -it snort snort -Q --daq nfq -i =
8 -c /usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules =
-A FAST -s 65535 -k none -q<br>01/28-16:27:17.258335 [**] [1:10000001:0] =
"ICMP Traffic Detected" [**] [Priority: 0] {ICMP} *** -&gt; =
142.251.209.35<br>01/28-16:27:17.264648 [**] [1:10000001:0] "ICMP =
Traffic Detected" [**] [Priority: 0] {ICMP} 142.251.209.35 -&gt; =
***<br>01/28-16:27:18.259990 [**] [1:10000001:0] "ICMP Traffic Detected" =
[**] [Priority: 0] {ICMP} *** -&gt; =
142.251.209.35<br>01/28-16:27:18.268708 [**] [1:10000001:0] "ICMP =
Traffic Detected" [**] [Priority: 0] {ICMP} 142.251.209.35 -&gt; =
***<br>01/28-16:27:19.262007 [**] [1:10000001:0] "ICMP Traffic Detected" =
[**] [Priority: 0] {ICMP} *** -&gt; =
142.251.209.35<br>01/28-16:27:19.271043 [**] [1:10000001:0] "ICMP =
Traffic Detected" [**] [Priority: 0] {ICMP} 142.251.209.35 -&gt; =
***<br><br>$ ping -c 3 www.google.it<br>PING www.google.it =
(142.251.209.35) 56(84) bytes of data.<br>64 bytes from =
mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D1 ttl=3D115 =
time=3D6.72 ms<br>64 bytes from mil04s51-in-f3.1e100.net =
(142.251.209.35): icmp_seq=3D2 ttl=3D115 time=3D8.83 ms<br>64 bytes from =
mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D3 ttl=3D115 =
time=3D9.08 ms<br><br><br>If I try the same test directly on the host =
(with the distro package) I don't get the duplicated packet with the =
afpacket module (so there's not loop at least outside the host)<br>I =
double check that the container is using the same net namespace of the =
host.. and I flushed the docker default network rules of iptables with =
-F and -X on all the tables (filter, mangle, nat) just in case (also if =
not used).<br>My question is why this happening<br>Thanks a =
lot<br><br>Luca<br><br><br>_______________________________________________=
<br>Snort-users mailing list<br>[email protected]<br>Go to =
this URL to change user options or =
unsubscribe:<br>https://lists.snort.org/mailman/listinfo/snort-users<br><b=
r><span class=3D"Apple-tab-span" style=3D"white-space:pre">	=
</span>To unsubscribe, send an email to:<br><span class=3D"Apple-tab-span"=
 style=3D"white-space:pre">	=
</span>[email protected]<br><br>Please visit =
http://blog.snort.org to stay current on all the latest Snort =
news!<br><br>Please follow these rules: =
https://snort.org/faq/what-is-the-mailing-list-etiquette<br></div></div></=
blockquote></div><br></body></html>=

--Apple-Mail=_1566FB07-6B27-46D6-A80E-B815C00D0670--

--===============3174352274804308351==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

--===============3174352274804308351==--