Re: monitoring pflog0 on obsd

[Shawn Posthumus <posthums () yahoo com>]

Hmm, this could definately be the case.. I havnt changed the defaults for the
snaplen.  Thanks.

Shawn

--- MH <procana () insight rr com> wrote:
> Hi Shawn,
>
> One thing to point out is that pflogd has a snaplen of
> 96 by default.  You are not capturing enough of the packet
> to trip your snort rules.  Reset pflogd to a snaplen of 1500.
>
> Hope this helps,
> Mike
>  
> On Wed, Oct 08, 2003 at 03:41:31PM -0700, Shawn Posthumus wrote:
> > --- MH <procana () insight rr com> wrote:
> > > Hi Shawn,
> > >
> > > When you monitor pflogd, you use tcpdump.
> > >
> > > tcpdump -ni pflog0
> > >
> > > You will see a warning about an ip address not being 
> > > assigned, that's normal because there isn't. :)
> > >
> > > Hope this helps,
> > > Mike
> >
> > I realize this. But the snort faq states the following:
> >
> > > > > In general it sees everything the network adapter driver sees before the
> > > > > network stack munges it. Linux IPTables, Linux IPChains, BSD PF and IPF
> and
> > > > > other packet filters do not prevent snort from seeing a packet that is
> > > > > present on the network wire.
> > > > > Even if an inbound packet is denied by the packet filter Snort will
> still
> > see >>>and analyze the packet if it is listening to that interface.
> Snort/pcap
> > sees >>>whatever comes out of or goes into the network adapter.
> > > > > ...
> > > > > ...
> > > > > Under OpenBSD you can snort just the PF rejects by using the /dev/pflogN
> > > > > interface.
> >
> > In this case I should be able to pick up the attacks pf dropped by snort. 
> From
> > a remote box I ran port scans and simple web based attacks that I knew
> snort is
> > configured for, but its not alerting, while tcpdump -netttr /var/log/pflog
> > shows everything.  
> >
> > I am now currently trying snort on my $ext_if, since the above section on
> faq
> > says that if snort and firewall are on same machine, it can pick up any
> packet
> > on the wire before pf takes action.
> >
> > Shawn
> >
> >   
> >
> > __________________________________
> > Do you Yahoo!?
> > The New Yahoo! Shopping - with improved product search
> > http://shopping.yahoo.com
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: SF.net Giveback Program.
> SourceForge.net hosts over 70,000 Open Source Projects.
> See the people who have HELPED US provide better services:
> Click here: http://sourceforge.net/supporters.php
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


__________________________________
Do you Yahoo!?
The New Yahoo! Shopping - with improved product search
http://shopping.yahoo.com


-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
SourceForge.net hosts over 70,000 Open Source Projects.
See the people who have HELPED US provide better services:
Click here: http://sourceforge.net/supporters.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users