Snort mailing list archives
Re: prepossesors (fsportscan) not working
From: "Rodrigo Montoro(Sp0oKeR)" <spooker () gmail com>
Date: Thu, 28 Nov 2013 04:29:00 -0600
sfportscan alerts are inside preprocessor.rules that based on snort.conf isn't enable #var PREPROC_RULE_PATH ../preproc_rules .... # include $PREPROC_RULE_PATH/preprocessor.rules This file is inside a snort tarball and you need to include this file to be load. Regards, On Thu, Nov 28, 2013 at 3:03 AM, Mustafa Karci <mk () theipcompany nl> wrote:
i have some problems with snort. The case is : I set up a snort-2.9.5.5-1.x86_64 on a CentOS 6 64 bit. This is working correctly, when i add a test rule like below, this is working oke. I can see the that the snort is writing to the snort-unified2.log. test.rules: alert icmp any any -> any any (msg:"ICMP test"; sid:200001; rev:100001;) I also configurated the fsportscan in the snort.conf # Portscan detection. For more information, see README.sfportscan preprocessor sfportscan: proto { all } \ scan_type { all } \ sense_level { high } #logfile { pscan1.log } But when i do a nmap -sS xxx.xxxx.xxx.xxx, nmap -rR xxx.xxx.xxx.xxx or nmap -A -v xxx.xxx.xxx.xxx to the snort machine it will not generated any alerts!!! but when i enable the "logfile { pscan1.log }" I will get an out put to the pscan1.log in the /var.log/snort/pscan1.log...But until now i saw it working with only the nmap -sS commando. So my question is what am i doing wrong. And on other thing i don`t get it is, is there an dynamic predecessor library for the port-scan?? This couldn't be it because it will not generate a portscan alert in the pscan1.log... here are the results of the config: *snort.conf:* # Setup the network addresses you are protecting ipvar HOME_NET xxx.xxx.xxx.xxx/22 # Set up the external network addresses. Leave as "any" in most situations ipvar EXTERNAL_NET !$HOME_NET # Portscan detection. For more information, see README.sfportscan preprocessor sfportscan: proto { all } \ scan_type { all } \ sense_level { high } #logfile { pscan1.log } var RULE_PATH /etc/snort/rules #var SO_RULE_PATH /etc/snort/rules/so_rules #var PREPROC_RULE_PATH ../preproc_rules # path to dynamic preprocessor libraries dynamicpreprocessor directory /usr/lib64/snort-2.9.5.5_dynamicpreprocessor/ # path to base preprocessor engine dynamicengine /usr/lib64/snort-2.9.5.5_dynamicengine/libsf_engine.so # path to dynamic rules libraries #dynamicdetection directory /usr/local/lib/snort_dynamicrules # Inline packet normalization. For more information, see README.normalize # Does nothing in IDS mode preprocessor normalize_ip4 preprocessor normalize_tcp: ips ecn stream preprocessor normalize_icmp4 preprocessor normalize_ip6 preprocessor normalize_icmp6 # unified2 output unified2: filename snort-unified2.log, limit 128 # syslog # output alert_syslog: LOG_ALERT # pcap # output log_tcpdump: tcpdump.log # metadata reference data. do not modify these lines include classification.config include reference.config include $RULE_PATH/test.rules include $RULE_PATH/local.rules include $RULE_PATH/scan.rules include $RULE_PATH/server-mssql.rules include $RULE_PATH/server-mysql.rule # decoder and preprocessor event rules # include $PREPROC_RULE_PATH/preprocessor.rules # include $PREPROC_RULE_PATH/decoder.rules # include $PREPROC_RULE_PATH/sensitive-data.rules include threshold.conf */etc/sysconfig/snort* INTERFACE=eth1 CONF=/etc/snort/snort.confCONF=/etc/snort/snort.conf # ALERTMODE=fastq # BINARY_LOG=1 *start snort + barnyard* /etc/init.d/snortd start *output /var/log/message* Detection: Nov 26 11:16:30 NFS1-1 snort[11083]: Search-Method = AC-Full-Q Nov 26 11:16:30 NFS1-1 snort[11083]: Split Any/Any group = enabled Nov 26 11:16:30 NFS1-1 snort[11083]: Search-Method-Optimizations = enabled Nov 26 11:16:30 NFS1-1 snort[11083]: Maximum pattern length = 20 Nov 26 11:16:30 NFS1-1 snort[11083]: Tagged Packet Limit: 256 Nov 26 11:16:30 NFS1-1 snort[11083]: Loading dynamic engine /usr/lib64/snort-2.9.5.5_dynamicengine/libsf_engine.so... Nov 26 11:16:30 NFS1-1 snort[11083]: done Nov 26 11:16:30 NFS1-1 snort[11083]: Loading all dynamic preprocessor libs from /usr/lib64/snort-2.9.5.5_dynamicpreprocessor/... Nov 26 11:16:30 NFS1-1 snort[11083]: Loading dynamic preprocessor library /usr/lib64/snort-2.9.5.5_dynamicpreprocessor//libsf_gtp_preproc.so... Nov 26 11:16:30 NFS1-1 snort[11083]: done Nov 26 11:16:30 NFS1-1 snort[11083]: Loading dynamic preprocessor library /usr/lib64/snort-2.9.5.5_dynamicpreprocessor//libsf_ftptelnet_preproc.so... Nov 26 11:16:30 NFS1-1 snort[11083]: done Nov 26 11:16:30 NFS1-1 snort[11083]: Loading dynamic preprocessor library /usr/lib64/snort-2.9.5.5_dynamicpreprocessor//libsf_sdf_preproc.so... Nov 26 11:16:30 NFS1-1 snort[11083]: done Nov 26 11:16:30 NFS1-1 snort[11083]: Loading dynamic preprocessor library /usr/lib64/snort-2.9.5.5_dynamicpreprocessor//libsf_smtp_preproc.so... Nov 26 11:16:30 NFS1-1 snort[11083]: done Nov 26 11:16:30 NFS1-1 snort[11083]: Loading dynamic preprocessor library /usr/lib64/snort-2.9.5.5_dynamicpreprocessor//libsf_dce2_preproc.so... Nov 26 11:16:30 NFS1-1 snort[11083]: done Nov 26 11:16:30 NFS1-1 snort[11083]: Loading dynamic preprocessor library /usr/lib64/snort-2.9.5.5_dynamicpreprocessor//libsf_dns_preproc.so... Nov 26 11:16:30 NFS1-1 snort[11083]: done Nov 26 11:16:30 NFS1-1 snort[11083]: Loading dynamic preprocessor library /usr/lib64/snort-2.9.5.5_dynamicpreprocessor//libsf_ssh_preproc.so... Nov 26 11:16:30 NFS1-1 snort[11083]: done Nov 26 11:16:30 NFS1-1 snort[11083]: Loading dynamic preprocessor library /usr/lib64/snort-2.9.5.5_dynamicpreprocessor//libsf_reputation_preproc.so... Nov 26 11:16:30 NFS1-1 snort[11083]: done Nov 26 11:16:30 NFS1-1 snort[11083]: Loading dynamic preprocessor library /usr/lib64/snort-2.9.5.5_dynamicpreprocessor//libsf_pop_preproc.so... Nov 26 11:16:30 NFS1-1 snort[11083]: done Nov 26 11:16:30 NFS1-1 snort[11083]: Loading dynamic preprocessor library /usr/lib64/snort-2.9.5.5_dynamicpreprocessor//libsf_dnp3_preproc.so... Nov 26 11:16:30 NFS1-1 snort[11083]: done Nov 26 11:16:30 NFS1-1 snort[11083]: Loading dynamic preprocessor library /usr/lib64/snort-2.9.5.5_dynamicpreprocessor//libsf_sip_preproc.so... Nov 26 11:16:30 NFS1-1 snort[11083]: done Nov 26 11:16:30 NFS1-1 snort[11083]: Loading dynamic preprocessor library /usr/lib64/snort-2.9.5.5_dynamicpreprocessor//libsf_imap_preproc.so... Nov 26 11:16:30 NFS1-1 snort[11083]: done Nov 26 11:16:30 NFS1-1 snort[11083]: Loading dynamic preprocessor library /usr/lib64/snort-2.9.5.5_dynamicpreprocessor//libsf_modbus_preproc.so... Nov 26 11:16:30 NFS1-1 snort[11083]: done Nov 26 11:16:30 NFS1-1 snort[11083]: Loading dynamic preprocessor library /usr/lib64/snort-2.9.5.5_dynamicpreprocessor//libsf_ssl_preproc.so... Nov 26 11:16:30 NFS1-1 snort[11083]: done Nov 26 11:16:30 NFS1-1 snort[11083]: Finished Loading all dynamic preprocessor libs from /usr/lib64/snort-2.9.5.5_dynamicpreprocessor/ Nov 26 11:16:30 NFS1-1 snort[11083]: Log directory = /var/log/snort Nov 26 11:16:30 NFS1-1 snort[11083]: WARNING: ip4 normalizations disabled because not inline. Nov 26 11:16:30 NFS1-1 snort[11083]: WARNING: tcp normalizations disabled because not inline. Nov 26 11:16:30 NFS1-1 snort[11083]: WARNING: icmp4 normalizations disabled because not inline. Nov 26 11:16:30 NFS1-1 snort[11083]: WARNING: ip6 normalizations disabled because not inline. Nov 26 11:16:30 NFS1-1 snort[11083]: WARNING: icmp6 normalizations disabled because not inline. Nov 26 11:16:30 NFS1-1 snort[11084]: Daemon initialized, signaled parent pid: 11083 Nov 26 11:16:30 NFS1-1 snort[11084]: Reload thread starting... Nov 26 11:16:30 NFS1-1 snort[11084]: Reload thread started, thread 0x7fb89afd5700 (11086) Nov 26 11:16:30 NFS1-1 snort[11084]: Decoding Ethernet Nov 26 11:16:30 NFS1-1 snort[11084]: Checking PID path... Nov 26 11:16:30 NFS1-1 snort[11084]: PID path stat checked out ok, PID path set to /var/run/ Nov 26 11:16:30 NFS1-1 snort[11084]: Writing PID "11084" to file "/var/run//snort_eth1.pid" Nov 26 11:16:30 NFS1-1 snort[11084]: Set gid to 500 Nov 26 11:16:30 NFS1-1 snort[11084]: Set uid to 500 Nov 26 11:16:30 NFS1-1 snort[11084]: Nov 26 11:16:30 NFS1-1 snort[11084]: --== Initialization Complete ==-- Nov 26 11:16:30 NFS1-1 snort[11084]: Commencing packet processing (pid=11084) Nov 26 11:16:31 NFS1-1 barnyard2[7020]: Closing spool file '/var/log/snort/snort-unified2.log.1385467902'. Read 0 records Nov 26 11:16:31 NFS1-1 barnyard2[7020]: Opened spool file '/var/log/snort/snort-unified2.log.1385468190' Nov 26 11:16:31 NFS1-1 barnyard2[7020]: Waiting for new data kind regards -- Mustafa Karci ------------------------------------------------------------------------------ Rapidly troubleshoot problems before they affect your business. Most IT organizations don't have a clear picture of how application performance affects their revenue. With AppDynamics, you get 100% visibility into your Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro! http://pubads.g.doubleclick.net/gampad/clk?id=84349351&iu=/4140/ostg.clktrk _______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel Please visit http://blog.snort.org for the latest news about Snort!
-- Rodrigo Montoro (Sp0oKeR) http://spookerlabs.blogspot.com http://www.twitter.com/spookerlabs http://www.linkedin.com/in/spooker
------------------------------------------------------------------------------ Rapidly troubleshoot problems before they affect your business. Most IT organizations don't have a clear picture of how application performance affects their revenue. With AppDynamics, you get 100% visibility into your Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro! http://pubads.g.doubleclick.net/gampad/clk?id=84349351&iu=/4140/ostg.clktrk
_______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- prepossesors (fsportscan) not working Mustafa Karci (Nov 28)
- Re: prepossesors (fsportscan) not working Rodrigo Montoro(Sp0oKeR) (Nov 28)