Re: How to Reassemble the Whole TCP Stream

Yichen Liu via Snort-users <[email protected]> Fri, 1 Aug 2025 17:59:43 -0400
Newsgroups gmane.comp.security.ids.snort.general
Message-ID <DM6PR12MB30989AA937CCCB2251C1F4FD9E26A@DM6PR12MB3098.namprd12.prod.outlook.com>
--===============7916906073097645501==
Content-Type: multipart/alternative;
 boundary="------------59Bc00XxUJ6ZrJDuFwE7DfdT"
Content-Language: en-US

--------------59Bc00XxUJ6ZrJDuFwE7DfdT
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Dear All,

Sorry that my previous email have formatting mess up in some email 
clients. This might because I used plain text formatting. I am going to 
send it again in HTML format.

Thanks
Yichen Liu

------------------------------------------------------------------------
On 2025-07-30 20:12, Yichen Liu <[email protected]> wrote 
to Snort-users <[email protected]>

    Dear All:

    Hello, I am new to Snort and would appreciate your assistance.

    In each session, our client will send up to 10kB TCP data to our
    server at once. However, when dealing with these data, Snort
    combines the packets into several fragments of sizes from 0.5kB to
    6kB instead of reassembling the whole 10kB data. The logs from the
    Stream5 and our instrumented PCRE library all confirmed the size of
    fragments. If a vulnerable command appear across 2 such fragments,
    Snort will miss it.

    Is these any method to let snort reassemble the data of the whole
    session?

    Here is my configuration file:

    |``` preprocessor stream5_global: track_tcp yes, max_tcp 2621440,
    memcap 83886080, show_rebuilt_packets preprocessor stream5_tcp:
    timeout 30, \ policy first, \ max_queued_bytes 10485760, \
    max_queued_segs 26210, \ ports server 22 10002 include test.rules ```|

    Here is my rules file:

    |``` alert tcp any any -> any 10002 (msg:"MKDIR at root detected";
    stream_reassemble:enable,both; content:"MKDIR";
    pcre:"/MKDIR\s+\/[^\/]+\s/smi"; sid:11451; rev:2;) ```|

    To avoid packet loss, I have configured `ethtool` according to
    https://www.snort.org/documents/possible-packet-loss-during-reassembly-for-snort-ids-ips-sensors

    And my command to run Snort:

    |``` snort -i eth0 -c test.conf -l log -A full -k none --snaplen
    65535 ```|

    Thanks
    Yichen Liu

--------------59Bc00XxUJ6ZrJDuFwE7DfdT
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit

<!DOCTYPE html><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  </head>
  <body>
    <p>Dear All,</p>
    <p>Sorry that my previous email have formatting mess up in some
      email clients. This might because I used plain text formatting. I
      am going to send it again in HTML format.</p>
    <p>Thanks<br>
      Yichen Liu</p>
    <hr>
    <div>On 2025-07-30 20:12, Yichen Liu &lt;<a href="mailto:[email protected]" class="moz-txt-link-freetext">[email protected]</a>&gt;
      wrote to Snort-users &lt;<a href="mailto:[email protected]" class="moz-txt-link-freetext">[email protected]</a>&gt;</div>
    <blockquote>
      <p>Dear All:</p>
      <p>Hello, I am new to Snort and would appreciate your assistance.</p>
      <p>In each session, our client will send up to 10kB TCP data to
        our server at once. However, when dealing with these data, Snort
        combines the packets into several fragments of sizes from 0.5kB
        to 6kB instead of reassembling the whole 10kB data. The logs
        from the Stream5 and our instrumented PCRE library all confirmed
        the size of fragments. If a vulnerable command appear across 2
        such fragments, Snort will miss it.</p>
      <p>Is these any method to let snort reassemble the data of the
        whole session?</p>
      <p>Here is my configuration file:</p>
      <pre><code>```
preprocessor stream5_global: track_tcp yes, max_tcp 2621440, memcap 83886080, show_rebuilt_packets
preprocessor stream5_tcp: timeout 30, \
    policy first, \
    max_queued_bytes 10485760, \
    max_queued_segs 26210, \
    ports server 22 10002
    include test.rules
```</code></pre>
      <p>Here is my rules file:</p>
      <pre><code>```
alert tcp any any -&gt; any 10002 (msg:&quot;MKDIR at root detected&quot;; stream_reassemble:enable,both; content:&quot;MKDIR&quot;; pcre:&quot;/MKDIR\s+\/[^\/]+\s/smi&quot;; sid:11451; rev:2;)
```</code></pre>
      <p>To avoid packet loss, I have configured `ethtool` according to
<a class="moz-txt-link-freetext" href="https://www.snort.org/documents/possible-packet-loss-during-reassembly-for-snort-ids-ips-sensors">https://www.snort.org/documents/possible-packet-loss-during-reassembly-for-snort-ids-ips-sensors</a></p>
      <p>And my command to run Snort:</p>
      <pre><code>```
snort -i eth0 -c test.conf -l log -A full -k none --snaplen 65535
```</code></pre>
      <p>Thanks<br>
        Yichen Liu</p>
    </blockquote>
    <p><span style="white-space: pre-wrap">
</span></p>
  </body>
</html>

--------------59Bc00XxUJ6ZrJDuFwE7DfdT--

--===============7916906073097645501==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

--===============7916906073097645501==--