Re: duplicated answer with afpacket on docker
Luca Cazzaniga via Snort-users <[email protected]> Wed, 29 Jan 2025 21:36:59 +0100
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <CAPz4CszWT8Dy0xOqij+D0Wc8UV1=9kBV-My8sHgwWTR5z8P6yQ@mail.gmail.com> |
--===============1789527376840456587== Content-Type: multipart/alternative; boundary="000000000000f77038062cde4502" --000000000000f77038062cde4502 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Joel I made some test sniffing packet outside the host on the path towards internet and I detected duplicated icmp echo request with the same sequence number, and corresponding echo reply.. then I tried the same test in passive mode and I got no dups also using the container. So the problem regards the inline mode using a single interface. It seems using the same interface when the packet is received is processed and send over the ongoing interface (the same where it receives and processes new packages) this could cause a duplication or loop, not sure about the details and why this happens only using the container. Anyway a solution could be create a second virtual interface a tap and a bridge or a tun and sort out the routing, and then using the inline with the couple.. tomorrow I will give it a go.. have this any sense? On Wed, Jan 29, 2025, 17:59 Joel Esler <[email protected]> wrote: > Hi Luca, > > > Duplicate packets can sometimes happen when you=E2=80=99re using packet c= apture in > a containerized environment. When you use the afpacket DAQ with Snort, it > captures packets at the data link layer. In Docker, packets can sometimes > get duplicated because of how network namespaces are set up, especially > when you use the =E2=80=94network=3D=E2=80=9Chost=E2=80=9D mode. This mod= e tells the container to use > the host=E2=80=99s network stack, which can sometimes lead to unexpected = things > like packet duplication if you=E2=80=99re not careful. > > > Here are a few suggestions that might help resolve or further diagnose th= e > issue: > > 1. *Check Ethernet Interface*: Make sure Snort is not inadvertently > capturing packets from multiple interfaces. Specifying the exact inter= face > (e.g., -i eth0) should help, but double-check that your container and = host > setups are consistent. > 2. *DAQ Module Behavior*: Different DAQ modules can handle packet > capturing differently. As you've observed, the nfq DAQ doesn't produce > duplicate packets, likely because it's leveraging netfilter hooks, whi= ch > operate differently from afpacket. If nfq works without duplication, i= t > might be a more stable choice. > 3. > > *So*, you said that running Snort directly on the host doesn=E2=80=99t= cause > duplication issues. That means the problem might be specific to the > container environment. Let=E2=80=99s try comparing packet captures usi= ng tools like > tcpdump on both the host and container interfaces. > > > On Jan 28, 2025, at 11:44, fusillator via Snort-users < > [email protected]> wrote: > > Hi all I'm pretty new to snort (not yet read all the doc) and I've a > stupid question, I launch snort in a docker container in the network > namespace of the host like so (I will arrange the cap in a second moment) > > $ docker run --name snort -h snort3 -u root --network=3D"host" --privileg= ed > -d -it snort3 bash > > I've the test rule: > > $ docker exec -it snort cat /usr/local/etc/rules/local.rules > alert icmp any any -> any any ( msg:"ICMP Traffic Detected"; sid: > 10000001; metadata: policy security-ips alert; ) > > Try to using the afpacket daq (so the socket AFPACKET to clone the layer = 2 > packets?) I get duplicated packets in response when I ping from or toward= s > the host for example: > > $ docker exec -it snort snort -Q --daq afpacket -i eth0 -c > /usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules -A FAS= T > -s 65535 -k none -q > 01/28-16:22:24.517667 [**] [1:10000001:0] "ICMP Traffic Detected" [**] > [Priority: 0] {ICMP} *** -> 142.251.209.35 > 01/28-16:22:24.536163 [**] [1:10000001:0] "ICMP Traffic Detected" [**] > [Priority: 0] {ICMP} 142.251.209.35 -> *** > 01/28-16:22:24.536163 [**] [1:10000001:0] "ICMP Traffic Detected" [**] > [Priority: 0] {ICMP} 142.251.209.35 -> *** > 01/28-16:22:25.518846 [**] [1:10000001:0] "ICMP Traffic Detected" [**] > [Priority: 0] {ICMP} *** -> 142.251.209.35 > 01/28-16:22:25.527230 [**] [1:10000001:0] "ICMP Traffic Detected" [**] > [Priority: 0] {ICMP} 142.251.209.35 -> *** > 01/28-16:22:25.527230 [**] [1:10000001:0] "ICMP Traffic Detected" [**] > [Priority: 0] {ICMP} 142.251.209.35 -> *** > 01/28-16:22:26.520845 [**] [1:10000001:0] "ICMP Traffic Detected" [**] > [Priority: 0] {ICMP} *** -> 142.251.209.35 > 01/28-16:22:26.526877 [**] [1:10000001:0] "ICMP Traffic Detected" [**] > [Priority: 0] {ICMP} 142.251.209.35 -> *** > 01/28-16:22:26.526878 [**] [1:10000001:0] "ICMP Traffic Detected" [**] > [Priority: 0] {ICMP} 142.251.209.35 -> *** > > $ ping -c 3 www.google.it > PING www.google.it (142.251.209.35) 56(84) bytes of data. > 64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D1 > ttl=3D115 time=3D18.7 ms > 64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D1 > ttl=3D115 time=3D18.7 ms (DUP!) > 64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D2 > ttl=3D115 time=3D8.46 ms > 64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D2 > ttl=3D115 time=3D8.46 ms (DUP!) > 64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D3 > ttl=3D115 time=3D6.09 ms > > but not with the daq nfq (so attaching to netfilter hooks?) > > $ sudo iptables -A INPUT -j NFQUEUE -i eth0 --queue-num 8 --queue-bypass > $ sudo iptables -A OUTPUT -j NFQUEUE -o eth0 --queue-num 8 --queue-bypass > > > $ docker exec -it snort snort -Q --daq nfq -i 8 -c > /usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules -A FAS= T > -s 65535 -k none -q > 01/28-16:27:17.258335 [**] [1:10000001:0] "ICMP Traffic Detected" [**] > [Priority: 0] {ICMP} *** -> 142.251.209.35 > 01/28-16:27:17.264648 [**] [1:10000001:0] "ICMP Traffic Detected" [**] > [Priority: 0] {ICMP} 142.251.209.35 -> *** > 01/28-16:27:18.259990 [**] [1:10000001:0] "ICMP Traffic Detected" [**] > [Priority: 0] {ICMP} *** -> 142.251.209.35 > 01/28-16:27:18.268708 [**] [1:10000001:0] "ICMP Traffic Detected" [**] > [Priority: 0] {ICMP} 142.251.209.35 -> *** > 01/28-16:27:19.262007 [**] [1:10000001:0] "ICMP Traffic Detected" [**] > [Priority: 0] {ICMP} *** -> 142.251.209.35 > 01/28-16:27:19.271043 [**] [1:10000001:0] "ICMP Traffic Detected" [**] > [Priority: 0] {ICMP} 142.251.209.35 -> *** > > $ ping -c 3 www.google.it > PING www.google.it (142.251.209.35) 56(84) bytes of data. > 64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D1 > ttl=3D115 time=3D6.72 ms > 64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D2 > ttl=3D115 time=3D8.83 ms > 64 bytes from mil04s51-in-f3.1e100.net (142.251.209.35): icmp_seq=3D3 > ttl=3D115 time=3D9.08 ms > > > If I try the same test directly on the host (with the distro package) I > don't get the duplicated packet with the afpacket module (so there's not > loop at least outside the host) > I double check that the container is using the same net namespace of the > host.. and I flushed the docker default network rules of iptables with -F > and -X on all the tables (filter, mangle, nat) just in case (also if not > used). > My question is why this happening > Thanks a lot > > Luca > > > _______________________________________________ > Snort-users mailing list > [email protected] > Go to this URL to change user options or unsubscribe: > https://lists.snort.org/mailman/listinfo/snort-users > > To unsubscribe, send an email to: > [email protected] > > Please visit http://blog.snort.org to stay current on all the latest > Snort news! > > Please follow these rules: > https://snort.org/faq/what-is-the-mailing-list-etiquette > > > --000000000000f77038062cde4502 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <p dir=3D"ltr">Hi Joel I made some test sniffing packet outside the host on= the path towards internet and I detected duplicated icmp echo request with= the same sequence number, and corresponding echo reply.. then I tried the = same test in passive mode and I got no dups also using the container. So th= e problem regards the inline mode using a single interface. It seems using = the same interface when the packet is received is processed and send over t= he ongoing interface (the same where it receives and processes new packages= ) this could cause=C2=A0 a duplication or=C2=A0 loop, not sure about the de= tails and why this happens only using the container. Anyway a solution=C2= =A0 could be create a second virtual interface a tap and a bridge or a tun = and sort out the routing, and then using the inline with the couple.. tomor= row I will give it a go.. have this any sense? </p> <br><div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class= =3D"gmail_attr">On Wed, Jan 29, 2025, 17:59 Joel Esler <<a href=3D"mailt= o:[email protected]">[email protected]</a>> wrote:<br></div><blockquote cl= ass=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;p= adding-left:1ex"><div style=3D"line-break:after-white-space"><p style=3D"co= lor:rgb(0,0,0);margin:0px;font-stretch:normal;font-size:13px;line-height:no= rmal;font-size-adjust:none;font-kerning:auto;font-variant-alternates:normal= ;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-eas= t-asian:normal;font-feature-settings:normal">Hi Luca,</p><p style=3D"color:= rgb(0,0,0);margin:0px;min-height:14px"><br><span style=3D"font-stretch:norm= al;line-height:normal;font-size-adjust:none;font-kerning:auto;font-variant-= alternates:normal;font-variant-ligatures:normal;font-variant-numeric:normal= ;font-variant-east-asian:normal;font-feature-settings:normal"></span></p><p= style=3D"margin:0px;font-stretch:normal;font-size:13px;line-height:normal;= font-size-adjust:none;font-kerning:auto;font-variant-alternates:normal;font= -variant-ligatures:normal;font-variant-numeric:normal;font-variant-east-asi= an:normal;font-feature-settings:normal;color:rgb(0,0,0)">Duplicate packets = can sometimes happen when you=E2=80=99re using packet capture in a containe= rized environment. When you use the afpacket DAQ with Snort, it captures pa= ckets at the data link layer. In Docker, packets can sometimes get duplicat= ed because of how network namespaces are set up, especially when you use th= e =E2=80=94network=3D=E2=80=9Chost=E2=80=9D mode. This mode tells the conta= iner to use the host=E2=80=99s network stack, which can sometimes lead to u= nexpected things like packet duplication if you=E2=80=99re not careful.</p>= <p style=3D"color:rgb(0,0,0);margin:0px;min-height:14px"><span style=3D"fon= t-stretch:normal;line-height:normal;font-size-adjust:none;font-kerning:auto= ;font-variant-alternates:normal;font-variant-ligatures:normal;font-variant-= numeric:normal;font-variant-east-asian:normal;font-feature-settings:normal"= ></span><br></p><p style=3D"color:rgb(0,0,0);margin:0px;font-stretch:normal= ;font-size:13px;line-height:normal;font-size-adjust:none;font-kerning:auto;= font-variant-alternates:normal;font-variant-ligatures:normal;font-variant-n= umeric:normal;font-variant-east-asian:normal;font-feature-settings:normal">= Here are a few suggestions that might help resolve or further diagnose the = issue:</p><ol style=3D"color:rgb(0,0,0)"><li style=3D"margin:0px;font-stret= ch:normal;font-size:13px;line-height:normal;font-size-adjust:none;font-kern= ing:auto;font-variant-alternates:normal;font-variant-ligatures:normal;font-= variant-numeric:normal;font-variant-east-asian:normal;font-feature-settings= :normal"><b>Check Ethernet Interface</b>: Make sure Snort is not inadverten= tly capturing packets from multiple interfaces. Specifying the exact interf= ace (e.g., -i eth0) should help, but double-check that your container and h= ost setups are consistent.</li><li style=3D"margin:0px;font-stretch:normal;= font-size:13px;line-height:normal;font-size-adjust:none;font-kerning:auto;f= ont-variant-alternates:normal;font-variant-ligatures:normal;font-variant-nu= meric:normal;font-variant-east-asian:normal;font-feature-settings:normal"><= b>DAQ Module Behavior</b>: Different DAQ modules can handle packet capturin= g differently. As you've observed, the nfq DAQ doesn't produce dupl= icate packets, likely because it's leveraging netfilter hooks, which op= erate differently from afpacket. If nfq works without duplication, it might= be a more stable choice.</li><li style=3D"margin:0px;font-stretch:normal;f= ont-size:13px;line-height:normal;font-size-adjust:none;font-kerning:auto;fo= nt-variant-alternates:normal;font-variant-ligatures:normal;font-variant-num= eric:normal;font-variant-east-asian:normal;font-feature-settings:normal"><p= style=3D"margin:0px;font-stretch:normal;line-height:normal;font-size-adjus= t:none;font-kerning:auto;font-variant-alternates:normal;font-variant-ligatu= res:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-= feature-settings:normal"><b>So</b>, you said that running Snort directly on= the host doesn=E2=80=99t cause duplication issues. That means the problem = might be specific to the container environment. Let=E2=80=99s try comparing= packet captures using tools like tcpdump on both the host and container in= terfaces.=C2=A0</p></li></ol><div><br><blockquote type=3D"cite"><div>On Jan= 28, 2025, at 11:44, fusillator via Snort-users <<a href=3D"mailto:snort= [email protected]" target=3D"_blank" rel=3D"noreferrer">snort-users@li= sts.snort.org</a>> wrote:</div><br><div><div>Hi all I'm pretty new t= o snort (not yet read all the doc) and I've a stupid question, I launch= snort in a docker container in the network namespace of the host like so (= I will arrange the cap in a second moment)<br><br>$ docker run --name snort= -h snort3 -u root --network=3D"host" --privileged -d -it snort3 = bash<br><br>I've the test rule:<br><br>$ docker exec -it snort cat /usr= /local/etc/rules/local.rules<br>alert icmp any any -> any any ( msg:&quo= t;ICMP Traffic Detected"; sid: 10000001; metadata: policy security-ips= alert; )<br><br>Try to using the afpacket daq (so the socket AFPACKET to c= lone the layer 2 packets?) I get duplicated packets in response when I ping= from or towards the host for example:<br><br>$ docker exec -it snort snort= -Q --daq afpacket -i eth0 -c /usr/local/etc/snort/snort.lua -R /usr/local/= etc/rules/local.rules -A FAST -s 65535 -k none -q<br>01/28-16:22:24.517667 = [**] [1:10000001:0] "ICMP Traffic Detected" [**] [Priority: 0] {I= CMP} *** -> 142.251.209.35<br>01/28-16:22:24.536163 [**] [1:10000001:0] = "ICMP Traffic Detected" [**] [Priority: 0] {ICMP} 142.251.209.35 = -> ***<br>01/28-16:22:24.536163 [**] [1:10000001:0] "ICMP Traffic D= etected" [**] [Priority: 0] {ICMP} 142.251.209.35 -> ***<br>01/28-1= 6:22:25.518846 [**] [1:10000001:0] "ICMP Traffic Detected" [**] [= Priority: 0] {ICMP} *** -> 142.251.209.35<br>01/28-16:22:25.527230 [**] = [1:10000001:0] "ICMP Traffic Detected" [**] [Priority: 0] {ICMP} = 142.251.209.35 -> ***<br>01/28-16:22:25.527230 [**] [1:10000001:0] "= ;ICMP Traffic Detected" [**] [Priority: 0] {ICMP} 142.251.209.35 ->= ***<br>01/28-16:22:26.520845 [**] [1:10000001:0] "ICMP Traffic Detect= ed" [**] [Priority: 0] {ICMP} *** -> 142.251.209.35<br>01/28-16:22:= 26.526877 [**] [1:10000001:0] "ICMP Traffic Detected" [**] [Prior= ity: 0] {ICMP} 142.251.209.35 -> ***<br>01/28-16:22:26.526878 [**] [1:10= 000001:0] "ICMP Traffic Detected" [**] [Priority: 0] {ICMP} 142.2= 51.209.35 -> ***<br><br>$ ping -c 3 <a href=3D"http://www.google.it" tar= get=3D"_blank" rel=3D"noreferrer">www.google.it</a><br>PING <a href=3D"http= ://www.google.it" target=3D"_blank" rel=3D"noreferrer">www.google.it</a> (1= 42.251.209.35) 56(84) bytes of data.<br>64 bytes from <a href=3D"http://mil= 04s51-in-f3.1e100.net" target=3D"_blank" rel=3D"noreferrer">mil04s51-in-f3.= 1e100.net</a> (142.251.209.35): icmp_seq=3D1 ttl=3D115 time=3D18.7 ms<br>64= bytes from <a href=3D"http://mil04s51-in-f3.1e100.net" target=3D"_blank" r= el=3D"noreferrer">mil04s51-in-f3.1e100.net</a> (142.251.209.35): icmp_seq= =3D1 ttl=3D115 time=3D18.7 ms (DUP!)<br>64 bytes from <a href=3D"http://mil= 04s51-in-f3.1e100.net" target=3D"_blank" rel=3D"noreferrer">mil04s51-in-f3.= 1e100.net</a> (142.251.209.35): icmp_seq=3D2 ttl=3D115 time=3D8.46 ms<br>64= bytes from <a href=3D"http://mil04s51-in-f3.1e100.net" target=3D"_blank" r= el=3D"noreferrer">mil04s51-in-f3.1e100.net</a> (142.251.209.35): icmp_seq= =3D2 ttl=3D115 time=3D8.46 ms (DUP!)<br>64 bytes from <a href=3D"http://mil= 04s51-in-f3.1e100.net" target=3D"_blank" rel=3D"noreferrer">mil04s51-in-f3.= 1e100.net</a> (142.251.209.35): icmp_seq=3D3 ttl=3D115 time=3D6.09 ms<br><b= r>but not with the daq nfq (so attaching to netfilter hooks?)<br><br>$ sudo= iptables -A INPUT -j NFQUEUE -i eth0 --queue-num 8 --queue-bypass<br>$ sud= o iptables -A OUTPUT -j NFQUEUE -o eth0 --queue-num 8 --queue-bypass<br><br= ><br>$ docker exec -it snort snort -Q --daq nfq -i 8 -c /usr/local/etc/snor= t/snort.lua -R /usr/local/etc/rules/local.rules -A FAST -s 65535 -k none -q= <br>01/28-16:27:17.258335 [**] [1:10000001:0] "ICMP Traffic Detected&q= uot; [**] [Priority: 0] {ICMP} *** -> 142.251.209.35<br>01/28-16:27:17.2= 64648 [**] [1:10000001:0] "ICMP Traffic Detected" [**] [Priority:= 0] {ICMP} 142.251.209.35 -> ***<br>01/28-16:27:18.259990 [**] [1:100000= 01:0] "ICMP Traffic Detected" [**] [Priority: 0] {ICMP} *** ->= 142.251.209.35<br>01/28-16:27:18.268708 [**] [1:10000001:0] "ICMP Tra= ffic Detected" [**] [Priority: 0] {ICMP} 142.251.209.35 -> ***<br>0= 1/28-16:27:19.262007 [**] [1:10000001:0] "ICMP Traffic Detected" = [**] [Priority: 0] {ICMP} *** -> 142.251.209.35<br>01/28-16:27:19.271043= [**] [1:10000001:0] "ICMP Traffic Detected" [**] [Priority: 0] {= ICMP} 142.251.209.35 -> ***<br><br>$ ping -c 3 <a href=3D"http://www.goo= gle.it" target=3D"_blank" rel=3D"noreferrer">www.google.it</a><br>PING <a h= ref=3D"http://www.google.it" target=3D"_blank" rel=3D"noreferrer">www.googl= e.it</a> (142.251.209.35) 56(84) bytes of data.<br>64 bytes from <a href=3D= "http://mil04s51-in-f3.1e100.net" target=3D"_blank" rel=3D"noreferrer">mil0= 4s51-in-f3.1e100.net</a> (142.251.209.35): icmp_seq=3D1 ttl=3D115 time=3D6.= 72 ms<br>64 bytes from <a href=3D"http://mil04s51-in-f3.1e100.net" target= =3D"_blank" rel=3D"noreferrer">mil04s51-in-f3.1e100.net</a> (142.251.209.35= ): icmp_seq=3D2 ttl=3D115 time=3D8.83 ms<br>64 bytes from <a href=3D"http:/= /mil04s51-in-f3.1e100.net" target=3D"_blank" rel=3D"noreferrer">mil04s51-in= -f3.1e100.net</a> (142.251.209.35): icmp_seq=3D3 ttl=3D115 time=3D9.08 ms<b= r><br><br>If I try the same test directly on the host (with the distro pack= age) I don't get the duplicated packet with the afpacket module (so the= re's not loop at least outside the host)<br>I double check that the con= tainer is using the same net namespace of the host.. and I flushed the dock= er default network rules of iptables with -F and -X on all the tables (filt= er, mangle, nat) just in case (also if not used).<br>My question is why thi= s happening<br>Thanks a lot<br><br>Luca<br><br><br>________________________= _______________________<br>Snort-users mailing list<br><a href=3D"mailto:Sn= [email protected]" target=3D"_blank" rel=3D"noreferrer">Snort-users= @lists.snort.org</a><br>Go to this URL to change user options or unsubscrib= e:<br><a href=3D"https://lists.snort.org/mailman/listinfo/snort-users" targ= et=3D"_blank" rel=3D"noreferrer">https://lists.snort.org/mailman/listinfo/s= nort-users</a><br><br><span style=3D"white-space:pre-wrap"> </span>To unsub= scribe, send an email to:<br><span style=3D"white-space:pre-wrap"> </span><= a href=3D"mailto:[email protected]" target=3D"_blank" rel= =3D"noreferrer">[email protected]</a><br><br>Please visit <= a href=3D"http://blog.snort.org" target=3D"_blank" rel=3D"noreferrer">http:= //blog.snort.org</a> to stay current on all the latest Snort news!<br><br>P= lease follow these rules: <a href=3D"https://snort.org/faq/what-is-the-mail= ing-list-etiquette" target=3D"_blank" rel=3D"noreferrer">https://snort.org/= faq/what-is-the-mailing-list-etiquette</a><br></div></div></blockquote></di= v><br></div></blockquote></div> --000000000000f77038062cde4502-- --===============1789527376840456587== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette --===============1789527376840456587==--