Snort reputation preprocessor is not generating alerts but is apparently processing traffic

--===============7798958068269459430==
Content-Type: multipart/alternative; boundary="0000000000006de3d1063b4bef7a"

--0000000000006de3d1063b4bef7a
Content-Type: text/plain; charset="UTF-8"

Hi,

We are using Snort v3.1.82.0 with Talos-LightSPD ruleset (based on earlier
discussions in this list) in IDS mode.

We are trying to implement ip blacklist alerting in our setup.

The snort.lua is

```
include('/etc/snort/lightspd/policies/3.1.0.0-0/balanced-security-and-connectivity.lua')
ips.variables.nets.HOME_NET = 'any'
ips.variables.nets.EXTERNAL_NET = 'any'

packets.vlan_agnostic = true
network.checksum_eval = 'none'
ips.mode = tap

daq = {
    module_dirs = {
        '/usr/lib64/daq',
    },
    modules = {
        {
            name = 'afpacket',
            mode = 'passive',
            variables = {
                'buffer_size_mb=512',
                'fanout_type=hash',
                'fanout_flag=rollover',
            }
        }
    },
}

include 'threshold.lua'

ssl.trust_servers = true

alert_json =
{
    file = true,
    limit = 10,
    fields = 'seconds b64_data class src_addr src_port dst_addr dst_port
gid msg sid rev proto priority service'
}

reputation = { blocklist = "/etc/snort/ip.blocklist" }
ips.states = ips.states  .. 'include /etc/snort/local.rules\n'

```

Where /etc/snort/ip.blocklist is the IP list file with one IP per line (or
comment)

The file /etc/snort/local.rules is

```
alert ( gid:136; sid:1; msg:"(reputation) packets blocked based on source";
)
alert ( gid:136; sid:4; msg:"(reputation) packets blocked based on
destination"; )
```

Snort is running correctly but when I connect to an IP in blocklist, no
alert is generated.
I can confirm that the SYN packet for same IP is there in packet dump as
firewall drops the outgoing connection so no handshake can be performed.

However, dumping the stats using signal usr1 shows reputation preprocessor
stats with non 0 "blocked" value.

```
--------------------------------------------------
reputation
                  packets: 15
                  blocked: 1
--------------------------------------------------
```

Additional possibly relevant startup output

```
Loading /etc/snort/local.rules:
Finished /etc/snort/local.rules:
Finished ips.states:
--------------------------------------------------
pcre counts
               pcre_rules: 13771
              pcre_native: 13771
--------------------------------------------------
ips policies rule stats
              id  loaded  shared enabled    file
               0   51804       2   10211    /etc/snort/snort.lua
--------------------------------------------------
rule counts
       total rules loaded: 51804
          duplicate rules: 2
               text rules: 46886
            builtin rules: 637
                 so rules: 4281
            option chains: 51804
            chain headers: 38655
                 flowbits: 729
     flowbits not checked: 62
--------------------------------------------------
```

Can anybody point me to what may be wrong?

Thanks

--0000000000006de3d1063b4bef7a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi,</div><div><br></div><div>We are using Snort v3.1.=
82.0 with Talos-LightSPD ruleset (based on earlier discussions in this list=
) in IDS mode.<br></div><div><br></div><div>We are trying to implement ip b=
lacklist alerting in our setup.</div><div><br></div><div>The snort.lua is</=
div><div><br></div><div>```<br></div><div>include(&#39;/etc/snort/lightspd/=
policies/3.1.0.0-0/balanced-security-and-connectivity.lua&#39;)<br>ips.vari=
ables.nets.HOME_NET =3D &#39;any&#39;<br>ips.variables.nets.EXTERNAL_NET =
=3D &#39;any&#39;<br><br>packets.vlan_agnostic =3D true<br>network.checksum=
_eval =3D &#39;none&#39;<br>ips.mode =3D tap<br><br>daq =3D {<br>=C2=A0 =C2=
=A0 module_dirs =3D {<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 &#39;/usr/lib64/daq&#3=
9;,<br>=C2=A0 =C2=A0 },<br>=C2=A0 =C2=A0 modules =3D {<br>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 {<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 name =3D &#39;afp=
acket&#39;,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 mode =3D &#39;pass=
ive&#39;,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 variables =3D {<br>=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 &#39;buffer_size_mb=
=3D512&#39;,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 &#3=
9;fanout_type=3Dhash&#39;,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 &#39;fanout_flag=3Drollover&#39;,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0=
 =C2=A0 =C2=A0 }<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 }<br>=C2=A0 =C2=A0 },<br>}<=
br><br>include &#39;threshold.lua&#39;<br><br>ssl.trust_servers =3D true<br=
><br>alert_json =3D<br>{<br>=C2=A0 =C2=A0 file =3D true,<br>=C2=A0 =C2=A0 l=
imit =3D 10,<br>=C2=A0 =C2=A0 fields =3D &#39;seconds b64_data class src_ad=
dr src_port dst_addr dst_port gid msg sid rev proto priority service&#39;<b=
r>}<br><br>reputation =3D { blocklist =3D &quot;/etc/snort/ip.blocklist&quo=
t; }<br>ips.states =3D ips.states =C2=A0.. &#39;include /etc/snort/local.ru=
les\n&#39;</div><div><br></div><div>```</div><div><br></div><div>Where /etc=
/snort/ip.blocklist is the IP list file with one IP per line (or comment)</=
div><div><br></div><div>The file  /etc/snort/local.rules is</div><div><br><=
/div><div>```</div><div>alert ( gid:136; sid:1; msg:&quot;(reputation) pack=
ets blocked based on source&quot;; )<br>alert ( gid:136; sid:4; msg:&quot;(=
reputation) packets blocked based on destination&quot;; )</div><div>```</di=
v><div><br></div><div>Snort is running correctly but when I connect to an I=
P in blocklist, no alert is generated.</div><div> I can confirm that the SY=
N packet for same IP is there in packet dump as firewall drops the outgoing=
 connection so no handshake can
 be performed.</div><div><br></div><div>However, dumping the stats using si=
gnal usr1 shows reputation preprocessor stats with non 0 &quot;blocked&quot=
; value.<br></div><div><br></div><div>```</div><div>-----------------------=
---------------------------<br>reputation<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 packets: 15<br>=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 blocked: 1<br>----------------------=
----------------------------</div><div>```<br></div><div><br></div><div>Add=
itional possibly relevant startup output</div><div><br></div><div>```</div>=
<div>Loading /etc/snort/local.rules:<br>Finished /etc/snort/local.rules:<br=
>Finished ips.states:<br>--------------------------------------------------=
<br>pcre counts<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0p=
cre_rules: 13771<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 pcre_n=
ative: 13771<br>--------------------------------------------------<br>ips p=
olicies rule stats<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 id =
=C2=A0loaded =C2=A0shared enabled =C2=A0 =C2=A0file<br>=C2=A0 =C2=A0 =C2=A0=
 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A00 =C2=A0 51804 =C2=A0 =C2=A0 =C2=A0 2 =
=C2=A0 10211 =C2=A0 =C2=A0/etc/snort/snort.lua<br>-------------------------=
-------------------------<br>rule counts<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0tota=
l rules loaded: 51804<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 duplicate rules=
: 2<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0text rules: 4=
6886<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 builtin rules: 637<br>=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0so rules: 4281<b=
r>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 option chains: 51804<br>=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 chain headers: 38655<br>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0flowbits: 729<br>=C2=A0 =C2=
=A0 =C2=A0flowbits not checked: 62<br>-------------------------------------=
-------------<br></div><div>```<br></div><div><br></div><div>Can anybody po=
int me to what may be wrong?<br></div><div><br></div><div>Thanks<br></div><=
/div>

--0000000000006de3d1063b4bef7a--

--===============7798958068269459430==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

--===============7798958068269459430==--