Re: Snort reputation preprocessor is not generating alerts but is apparently processing traffic

--===============2039068024624889702==
Content-Type: multipart/alternative; boundary="000000000000a51ada063b4c117f"

--000000000000a51ada063b4c117f
Content-Type: text/plain; charset="UTF-8"

To answer my own question, turns out the file local.rules is wrong. It
would have been correct if I was using the non lightspd ruleset, but with
lightspd, it should just enable the said rules

```
alert ( gid:136; sid:1; enable:yes;)
alert ( gid:136; sid:4; enable:yes;)
```


On Fri, 1 Aug 2025 at 16:49, Dheeraj Gupta <[email protected]> wrote:

> Hi,
>
> We are using Snort v3.1.82.0 with Talos-LightSPD ruleset (based on earlier
> discussions in this list) in IDS mode.
>
> We are trying to implement ip blacklist alerting in our setup.
>
> The snort.lua is
>
> ```
>
> include('/etc/snort/lightspd/policies/3.1.0.0-0/balanced-security-and-connectivity.lua')
> ips.variables.nets.HOME_NET = 'any'
> ips.variables.nets.EXTERNAL_NET = 'any'
>
> packets.vlan_agnostic = true
> network.checksum_eval = 'none'
> ips.mode = tap
>
> daq = {
>     module_dirs = {
>         '/usr/lib64/daq',
>     },
>     modules = {
>         {
>             name = 'afpacket',
>             mode = 'passive',
>             variables = {
>                 'buffer_size_mb=512',
>                 'fanout_type=hash',
>                 'fanout_flag=rollover',
>             }
>         }
>     },
> }
>
> include 'threshold.lua'
>
> ssl.trust_servers = true
>
> alert_json =
> {
>     file = true,
>     limit = 10,
>     fields = 'seconds b64_data class src_addr src_port dst_addr dst_port
> gid msg sid rev proto priority service'
> }
>
> reputation = { blocklist = "/etc/snort/ip.blocklist" }
> ips.states = ips.states  .. 'include /etc/snort/local.rules\n'
>
> ```
>
> Where /etc/snort/ip.blocklist is the IP list file with one IP per line (or
> comment)
>
> The file /etc/snort/local.rules is
>
> ```
> alert ( gid:136; sid:1; msg:"(reputation) packets blocked based on
> source"; )
> alert ( gid:136; sid:4; msg:"(reputation) packets blocked based on
> destination"; )
> ```
>
> Snort is running correctly but when I connect to an IP in blocklist, no
> alert is generated.
> I can confirm that the SYN packet for same IP is there in packet dump as
> firewall drops the outgoing connection so no handshake can be performed.
>
> However, dumping the stats using signal usr1 shows reputation preprocessor
> stats with non 0 "blocked" value.
>
> ```
> --------------------------------------------------
> reputation
>                   packets: 15
>                   blocked: 1
> --------------------------------------------------
> ```
>
> Additional possibly relevant startup output
>
> ```
> Loading /etc/snort/local.rules:
> Finished /etc/snort/local.rules:
> Finished ips.states:
> --------------------------------------------------
> pcre counts
>                pcre_rules: 13771
>               pcre_native: 13771
> --------------------------------------------------
> ips policies rule stats
>               id  loaded  shared enabled    file
>                0   51804       2   10211    /etc/snort/snort.lua
> --------------------------------------------------
> rule counts
>        total rules loaded: 51804
>           duplicate rules: 2
>                text rules: 46886
>             builtin rules: 637
>                  so rules: 4281
>             option chains: 51804
>             chain headers: 38655
>                  flowbits: 729
>      flowbits not checked: 62
> --------------------------------------------------
> ```
>
> Can anybody point me to what may be wrong?
>
> Thanks
>

--000000000000a51ada063b4c117f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>To answer my own question, turns out the file local.r=
ules is wrong. It would have been correct if I was using the non lightspd r=
uleset, but with lightspd, it should just enable the said rules</div><div><=
br></div><div>```</div><div>alert ( gid:136; sid:1; enable:yes;)<br>alert (=
 gid:136; sid:4; enable:yes;)<br></div><div>```<br></div></div><div dir=3D"=
ltr"><br></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gma=
il_attr">On Fri, 1 Aug 2025 at 16:49, Dheeraj Gupta &lt;<a href=3D"mailto:d=
[email protected]" target=3D"_blank">[email protected]</a>&gt;=
 wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px =
0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=
=3D"ltr"><div>Hi,</div><div><br></div><div>We are using Snort v3.1.82.0 wit=
h Talos-LightSPD ruleset (based on earlier discussions in this list) in IDS=
 mode.<br></div><div><br></div><div>We are trying to implement ip blacklist=
 alerting in our setup.</div><div><br></div><div>The snort.lua is</div><div=
><br></div><div>```<br></div><div>include(&#39;/etc/snort/lightspd/policies=
/3.1.0.0-0/balanced-security-and-connectivity.lua&#39;)<br>ips.variables.ne=
ts.HOME_NET =3D &#39;any&#39;<br>ips.variables.nets.EXTERNAL_NET =3D &#39;a=
ny&#39;<br><br>packets.vlan_agnostic =3D true<br>network.checksum_eval =3D =
&#39;none&#39;<br>ips.mode =3D tap<br><br>daq =3D {<br>=C2=A0 =C2=A0 module=
_dirs =3D {<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 &#39;/usr/lib64/daq&#39;,<br>=C2=
=A0 =C2=A0 },<br>=C2=A0 =C2=A0 modules =3D {<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0=
 {<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 name =3D &#39;afpacket&#39;=
,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 mode =3D &#39;passive&#39;,<=
br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 variables =3D {<br>=C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 &#39;buffer_size_mb=3D512&#39=
;,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 &#39;fanout_t=
ype=3Dhash&#39;,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
 &#39;fanout_flag=3Drollover&#39;,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 }<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 }<br>=C2=A0 =C2=A0 },<br>}<br><br>i=
nclude &#39;threshold.lua&#39;<br><br>ssl.trust_servers =3D true<br><br>ale=
rt_json =3D<br>{<br>=C2=A0 =C2=A0 file =3D true,<br>=C2=A0 =C2=A0 limit =3D=
 10,<br>=C2=A0 =C2=A0 fields =3D &#39;seconds b64_data class src_addr src_p=
ort dst_addr dst_port gid msg sid rev proto priority service&#39;<br>}<br><=
br>reputation =3D { blocklist =3D &quot;/etc/snort/ip.blocklist&quot; }<br>=
ips.states =3D ips.states =C2=A0.. &#39;include /etc/snort/local.rules\n&#3=
9;</div><div><br></div><div>```</div><div><br></div><div>Where /etc/snort/i=
p.blocklist is the IP list file with one IP per line (or comment)</div><div=
><br></div><div>The file  /etc/snort/local.rules is</div><div><br></div><di=
v>```</div><div>alert ( gid:136; sid:1; msg:&quot;(reputation) packets bloc=
ked based on source&quot;; )<br>alert ( gid:136; sid:4; msg:&quot;(reputati=
on) packets blocked based on destination&quot;; )</div><div>```</div><div><=
br></div><div>Snort is running correctly but when I connect to an IP in blo=
cklist, no alert is generated.</div><div> I can confirm that the SYN packet=
 for same IP is there in packet dump as firewall drops the outgoing connect=
ion so no handshake can
 be performed.</div><div><br></div><div>However, dumping the stats using si=
gnal usr1 shows reputation preprocessor stats with non 0 &quot;blocked&quot=
; value.<br></div><div><br></div><div>```</div><div>-----------------------=
---------------------------<br>reputation<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 packets: 15<br>=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 blocked: 1<br>----------------------=
----------------------------</div><div>```<br></div><div><br></div><div>Add=
itional possibly relevant startup output</div><div><br></div><div>```</div>=
<div>Loading /etc/snort/local.rules:<br>Finished /etc/snort/local.rules:<br=
>Finished ips.states:<br>--------------------------------------------------=
<br>pcre counts<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0p=
cre_rules: 13771<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 pcre_n=
ative: 13771<br>--------------------------------------------------<br>ips p=
olicies rule stats<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 id =
=C2=A0loaded =C2=A0shared enabled =C2=A0 =C2=A0file<br>=C2=A0 =C2=A0 =C2=A0=
 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A00 =C2=A0 51804 =C2=A0 =C2=A0 =C2=A0 2 =
=C2=A0 10211 =C2=A0 =C2=A0/etc/snort/snort.lua<br>-------------------------=
-------------------------<br>rule counts<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0tota=
l rules loaded: 51804<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 duplicate rules=
: 2<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0text rules: 4=
6886<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 builtin rules: 637<br>=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0so rules: 4281<b=
r>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 option chains: 51804<br>=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 chain headers: 38655<br>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0flowbits: 729<br>=C2=A0 =C2=
=A0 =C2=A0flowbits not checked: 62<br>-------------------------------------=
-------------<br></div><div>```<br></div><div><br></div><div>Can anybody po=
int me to what may be wrong?<br></div><div><br></div><div>Thanks<br></div><=
/div>
</blockquote></div>

--000000000000a51ada063b4c117f--

--===============2039068024624889702==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

--===============2039068024624889702==--