Re: Regarding dynamic (so_rules) rules

[Joel Esler <jesler () sourcefire com>]

There's a couple blog posts and snort.org I could point you to, but the easiest way, really, to get Shared Object rules 
running (which is what you are referring to below "dynamic", in this context) is to use pulledpork.

Pulledpork will download, compile, and generally take care of everything you need for shared object rules to function.

J

On May 12, 2011, at 5:41 AM, Dheeraj Gupta wrote:

> Hi,
> I am sorry if this has been answered before, but I really couldn't find an appropriate answer to a host pf troubles I 
> am having.
> I can't seem to trigger dynamic rules for my snort installation.
> I configure snort with  ./configure –with-mysql --enable-zlib --enable-decoder-preprocessor-rules
>
> The snort.conf file has all include so_rules/ lines at the end uncommented, so it should be picking up those rules.
> I think I am missing something about the dynamic rules
>
> Relevant Sections of snort.conf are
> # Path to your rules files (this can be a relative path)
> # Note for Windows users:  You are advised to make this an absolute path,
> # such as:  c:\snort\rules
> var RULE_PATH /home/dheeraj/installs/snort-2.9.0.5/etc/rules
> var SO_RULE_PATH /home/dheeraj/installs/snort-2.9.0.5/etc/so_rules
> var PREPROC_RULE_PATH /home/dheeraj/installs/snort-2.9.0.5/etc/preproc_rules
>
> # path to dynamic preprocessor libraries
> dynamicpreprocessor directory /usr/local/lib/snort_dynamicpreprocessor/
>
> # path to base preprocessor engine
> dynamicengine /usr/local/lib/snort_dynamicengine/libsf_engine.so
>
> # path to dynamic rules libraries
> dynamicdetection directory /usr/local/lib/snort_dynamicrules
>
> I look into my /var/log/messages and see the following (relevant) entries
>
> May 12 14:46:58 redbaronpc snort[20793]: Loading dynamic engine /usr/local/lib/snort_dynamicengine/libsf_engine.so... 
> May 12 14:46:58 redbaronpc snort[20793]: done 
> May 12 14:46:58 redbaronpc snort[20793]: Loading all dynamic detection libs from /usr/local/lib/snort_dynamicrules... 
> May 12 14:46:58 redbaronpc snort[20793]: Warning: No dynamic libraries found in directory 
> /usr/local/lib/snort_dynamicrules! 
> May 12 14:46:58 redbaronpc snort[20793]:   Finished Loading all dynamic detection libs from 
> /usr/local/lib/snort_dynamicrules 
> May 12 14:46:58 redbaronpc snort[20793]: Loading all dynamic preprocessor libs from 
> /usr/local/lib/snort_dynamicpreprocessor/... 
> May 12 14:46:58 redbaronpc snort[20793]:   Loading dynamic preprocessor library 
> /usr/local/lib/snort_dynamicpreprocessor//libsf_dce2_preproc.so... 
> May 12 14:46:58 redbaronpc snort[20793]: done 
> May 12 14:46:58 redbaronpc snort[20793]:   Loading dynamic preprocessor library 
> /usr/local/lib/snort_dynamicpreprocessor//libsf_ssl_preproc.so... 
> May 12 14:46:58 redbaronpc snort[20793]: done 
> May 12 14:46:58 redbaronpc snort[20793]:   Loading dynamic preprocessor library 
> /usr/local/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so... 
> May 12 14:46:58 redbaronpc snort[20793]: done 
> May 12 14:46:58 redbaronpc snort[20793]:   Loading dynamic preprocessor library 
> /usr/local/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so... 
> May 12 14:46:58 redbaronpc snort[20793]: done 
> May 12 14:46:58 redbaronpc snort[20793]:   Loading dynamic preprocessor library 
> /usr/local/lib/snort_dynamicpreprocessor//libsf_sdf_preproc.so... 
> May 12 14:46:58 redbaronpc snort[20793]: done 
> May 12 14:46:58 redbaronpc snort[20793]:   Loading dynamic preprocessor library 
> /usr/local/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so... 
> May 12 14:46:58 redbaronpc snort[20793]: done 
> May 12 14:46:58 redbaronpc snort[20793]:   Loading dynamic preprocessor library 
> /usr/local/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so... 
> May 12 14:46:58 redbaronpc snort[20793]: done 
> May 12 14:46:58 redbaronpc snort[20793]:   Finished Loading all dynamic preprocessor libs from 
> /usr/local/lib/snort_dynamicpreprocessor/ 
>
> May 12 14:46:59 redbaronpc snort[20793]: +++++++++++++++++++++++++++++++++++++++++++++++++++ 
> May 12 14:46:59 redbaronpc snort[20793]: Initializing rule chains... 
> May 12 14:47:00 redbaronpc snort[20793]: 5360 Snort rules read 
> May 12 14:47:00 redbaronpc snort[20793]:     5360 detection rules 
> May 12 14:47:00 redbaronpc snort[20793]:     0 decoder rules 
> May 12 14:47:00 redbaronpc snort[20793]:     0 preprocessor rules 
> May 12 14:47:00 redbaronpc snort[20793]: 5360 Option Chains linked into 479 Chain Headers 
> May 12 14:47:00 redbaronpc snort[20793]: 0 Dynamic rules 
> May 12 14:47:00 redbaronpc snort[20793]: +++++++++++++++++++++++++++++++++++++++++++++++++++ 
>
> May 12 14:47:01 redbaronpc snort[20793]: Encoded Rule Plugin SID: 15210, GID: 3 not registered properly.  Disabling 
> this rule.  
> (The above message is repated about 700 times for different SIDs. COuld someone also explain why this message comes?)
>
> How do I remove No dynamic libraries found in directory /usr/local/lib/snort_dynamicrules! warning? and get the 
> dynamic rules t fire on this installation
>
>
>
> Regards,
> Dheeraj
>
> ------------------------------------------------------------------------------
> Achieve unprecedented app performance and reliability
> What every C/C++ and Fortran developer should know.
> Learn how Intel has extended the reach of its next-generation tools
> to help boost performance applications - inlcuding clusters.
> http://p.sf.net/sfu/intel-dev2devmay_______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

------------------------------------------------------------------------------
Achieve unprecedented app performance and reliability
What every C/C++ and Fortran developer should know.
Learn how Intel has extended the reach of its next-generation tools
to help boost performance applications - inlcuding clusters.
http://p.sf.net/sfu/intel-dev2devmay

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users