Re: How to Reassemble the Whole TCP Stream
Yichen Liu via Snort-users <[email protected]> Fri, 1 Aug 2025 17:59:43 -0400
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <DM6PR12MB30989AA937CCCB2251C1F4FD9E26A@DM6PR12MB3098.namprd12.prod.outlook.com> |
--===============7916906073097645501== Content-Type: multipart/alternative; boundary="------------59Bc00XxUJ6ZrJDuFwE7DfdT" Content-Language: en-US --------------59Bc00XxUJ6ZrJDuFwE7DfdT Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Dear All, Sorry that my previous email have formatting mess up in some email clients. This might because I used plain text formatting. I am going to send it again in HTML format. Thanks Yichen Liu ------------------------------------------------------------------------ On 2025-07-30 20:12, Yichen Liu <[email protected]> wrote to Snort-users <[email protected]> Dear All: Hello, I am new to Snort and would appreciate your assistance. In each session, our client will send up to 10kB TCP data to our server at once. However, when dealing with these data, Snort combines the packets into several fragments of sizes from 0.5kB to 6kB instead of reassembling the whole 10kB data. The logs from the Stream5 and our instrumented PCRE library all confirmed the size of fragments. If a vulnerable command appear across 2 such fragments, Snort will miss it. Is these any method to let snort reassemble the data of the whole session? Here is my configuration file: |``` preprocessor stream5_global: track_tcp yes, max_tcp 2621440, memcap 83886080, show_rebuilt_packets preprocessor stream5_tcp: timeout 30, \ policy first, \ max_queued_bytes 10485760, \ max_queued_segs 26210, \ ports server 22 10002 include test.rules ```| Here is my rules file: |``` alert tcp any any -> any 10002 (msg:"MKDIR at root detected"; stream_reassemble:enable,both; content:"MKDIR"; pcre:"/MKDIR\s+\/[^\/]+\s/smi"; sid:11451; rev:2;) ```| To avoid packet loss, I have configured `ethtool` according to https://www.snort.org/documents/possible-packet-loss-during-reassembly-for-snort-ids-ips-sensors And my command to run Snort: |``` snort -i eth0 -c test.conf -l log -A full -k none --snaplen 65535 ```| Thanks Yichen Liu --------------59Bc00XxUJ6ZrJDuFwE7DfdT Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit <!DOCTYPE html><html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> <body> <p>Dear All,</p> <p>Sorry that my previous email have formatting mess up in some email clients. This might because I used plain text formatting. I am going to send it again in HTML format.</p> <p>Thanks<br> Yichen Liu</p> <hr> <div>On 2025-07-30 20:12, Yichen Liu <<a href="mailto:[email protected]" class="moz-txt-link-freetext">[email protected]</a>> wrote to Snort-users <<a href="mailto:[email protected]" class="moz-txt-link-freetext">[email protected]</a>></div> <blockquote> <p>Dear All:</p> <p>Hello, I am new to Snort and would appreciate your assistance.</p> <p>In each session, our client will send up to 10kB TCP data to our server at once. However, when dealing with these data, Snort combines the packets into several fragments of sizes from 0.5kB to 6kB instead of reassembling the whole 10kB data. The logs from the Stream5 and our instrumented PCRE library all confirmed the size of fragments. If a vulnerable command appear across 2 such fragments, Snort will miss it.</p> <p>Is these any method to let snort reassemble the data of the whole session?</p> <p>Here is my configuration file:</p> <pre><code>``` preprocessor stream5_global: track_tcp yes, max_tcp 2621440, memcap 83886080, show_rebuilt_packets preprocessor stream5_tcp: timeout 30, \ policy first, \ max_queued_bytes 10485760, \ max_queued_segs 26210, \ ports server 22 10002 include test.rules ```</code></pre> <p>Here is my rules file:</p> <pre><code>``` alert tcp any any -> any 10002 (msg:"MKDIR at root detected"; stream_reassemble:enable,both; content:"MKDIR"; pcre:"/MKDIR\s+\/[^\/]+\s/smi"; sid:11451; rev:2;) ```</code></pre> <p>To avoid packet loss, I have configured `ethtool` according to <a class="moz-txt-link-freetext" href="https://www.snort.org/documents/possible-packet-loss-during-reassembly-for-snort-ids-ips-sensors">https://www.snort.org/documents/possible-packet-loss-during-reassembly-for-snort-ids-ips-sensors</a></p> <p>And my command to run Snort:</p> <pre><code>``` snort -i eth0 -c test.conf -l log -A full -k none --snaplen 65535 ```</code></pre> <p>Thanks<br> Yichen Liu</p> </blockquote> <p><span style="white-space: pre-wrap"> </span></p> </body> </html> --------------59Bc00XxUJ6ZrJDuFwE7DfdT-- --===============7916906073097645501== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette --===============7916906073097645501==--