Re: stream4 - zero bytes records

[Martin Roesch <roesch () sourcefire com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Elias,

The number of bytes that are recorded are application layer bytes  
transferred, not total bytes in the packets.  What this typically  
indicates is scanning activity or closed ports rejecting  
connections.  I typically treat logs like this as evidence of scan  
activity or worms looking for openings in your network.

     -Marty

On May 25, 2006, at 10:12 AM, Elias Athanasopoulos wrote:

> Hello!
>
> I am using stream4 with the configuration below:
>
> preprocessor stream4: disable_evasion_alerts, keepstats machine
> preprocessor stream4_reassemble: both, ports:all
>
> However, in the session.log file I have a lot of records *but not all*
> with zero bytes in the Client side, in the Server side or both.
>
> For example:
>
> [*] Session => Start: 05/25/06-17:23:15 End Time: 05/25/06-17:23:15 
> [Server IP:
> 67.70.68.8  port: 63960  pkts: 1  bytes: 0] [Client IP:  
> 147.52.78.17  port: 2213  pkts: 1  bytes: 0]
> [*] Session => Start: 05/25/06-17:23:15 End Time: 05/25/06-17:23:15 
> [Server IP:
> 147.52.136.3  port: 4662  pkts: 2  bytes: 0] [Client IP:  
> 87.90.0.251  port: 27786  pkts: 2  bytes: 0]
> [*] Session => Start: 05/25/06-17:23:15 End Time: 05/25/06-17:23:15 
> [Server IP:
> 147.52.3.67  port: 4662  pkts: 2  bytes: 0] [Client IP:  
> 88.35.43.210  port: 4788  pkts: 2  bytes: 0]
> [*] Session => Start: 05/25/06-17:23:15 End Time: 05/25/06-17:23:15 
> [Server IP:
> 61.123.32.10  port: 13340  pkts: 1  bytes: 0] [Client IP:  
> 147.52.48.227  port: 1634  pkts: 1  bytes: 0]
> [*] Session => Start: 05/25/06-17:23:15 End Time: 05/25/06-17:23:15 
> [Server IP:
> 66.151.150.12  port: 2703  pkts: 4  bytes: 103] [Client IP:  
> 147.52.67.2  port: 47818  pkts: 2  bytes: 17]
> [*] Session => Start: 05/25/06-17:23:15 End Time: 05/25/06-17:23:15 
> [Server IP:
> 147.52.110.2  port: 1433  pkts: 4  bytes: 86] [Client IP:  
> 67.110.178.233  port: 43413  pkts: 5  bytes: 168]
>
> A snorter in #snort told me that there are cases that snort logs 0  
> bytes
> (especially in Web traffic). If this is the case, is there a place  
> that I can
> find the heuristics used by snort (or stream4) for that decision?
>
> PS. Please, 'cc' me as I am not subscribed.
>
> Regards,
> --
> Elias Athanasopoulos
> Distributed Computing Systems (DCS)
> Institute of Computer Science (ICS/FORTH)
> Heraklion, Crete
>
> A bug can become a feature by documenting it.
>
>
>
> -------------------------------------------------------
> All the advantages of Linux Managed Hosting--Without the Cost and  
> Risk!
> Fully trained technicians. The highest number of Red Hat  
> certifications in
> the hosting industry. Fanatical Support. Click to learn more
> http://sel.as-us.falkag.net/sel? 
> cmd=lnk&kid=107521&bid=248729&dat=121642
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

- --
Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
Sourcefire - Security for the Real World - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)

iD8DBQFEdwK3qj0FAQQ3KOARAod+AJ4qWnkcyXM2pQksf5RrGtrPDWH1DACdG7lW
tIHfBuZkEobmLLa20nPqEug=
=ywPn
-----END PGP SIGNATURE-----


-------------------------------------------------------
All the advantages of Linux Managed Hosting--Without the Cost and Risk!
Fully trained technicians. The highest number of Red Hat certifications in
the hosting industry. Fanatical Support. Click to learn more
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=107521&bid=248729&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users