Re: Steam5 configuration with Windows, and Linux

[Rafael Leiva-Ochoa <spawn () rloteck net>]

Any idea why I am getting the

"Initializing rule chains...

ERROR: /etc/snort/snort.conf(281) Unknown rule type: track_udp."

Error?

Thanks,

Rafael

On Thu, Nov 19, 2015 at 1:09 PM, Rafael Leiva-Ochoa <spawn () rloteck net>
wrote:

> Perfect, it is giving me more information about the problem. Here is the
> output:
>
> root@snort-sensor1 ~]# snort -i eth1 -c /etc/snort/snort.conf -A console
>
> Running in IDS mode
>
>
>         --== Initializing Snort ==--
>
> Initializing Output Plugins!
>
> Initializing Preprocessors!
>
> Initializing Plug-ins!
>
> Parsing Rules file "/etc/snort/snort.conf"
>
> PortVar 'HTTP_PORTS' defined :  [ 36 80:90 311 383 555 591 593 631 801 808
> 818 901 972 1158 1220 1414 1533 1741 1830 1942 2231 2301 2381 2578 2809
> 2980 3029 3037 3057 3128 3443 3702 4000 4343 4848 5000 5117 5250 5600 5814
> 6080 6173 6988 7000:7001 7005 7071 7144:7145 7510 7770 7777:7779 8000:8001
> 8008 8014:8015 8020 8028 8040 8080:8082 8085 8088 8090 8118 8123 8180:8182
> 8222 8243 8280 8300 8333 8344 8400 8443 8500 8509 8787 8800 8888 8899 8983
> 9000 9002 9060 9080 9090:9091 9111 9290 9443 9447 9710 9788 9999:10000
> 11371 12601 13014 15489 19980 29991 33300 34412 34443:34444 40007 41080
> 44449 50000 50002 51423 53331 55252 55555 56712 ]
>
> PortVar 'SHELLCODE_PORTS' defined :  [ 0:79 81:65535 ]
>
> PortVar 'ORACLE_PORTS' defined :  [ 1024:65535 ]
>
> PortVar 'SSH_PORTS' defined :  [ 22 ]
>
> PortVar 'FTP_PORTS' defined :  [ 21 2100 3535 ]
>
> PortVar 'SIP_PORTS' defined :  [ 5060:5061 5600 ]
>
> PortVar 'FILE_DATA_PORTS' defined :  [ 36 80:90 110 143 311 383 555 591
> 593 631 801 808 818 901 972 1158 1220 1414 1533 1741 1830 1942 2231 2301
> 2381 2578 2809 2980 3029 3037 3057 3128 3443 3702 4000 4343 4848 5000 5117
> 5250 5600 5814 6080 6173 6988 7000:7001 7005 7071 7144:7145 7510 7770
> 7777:7779 8000:8001 8008 8014:8015 8020 8028 8040 8080:8082 8085 8088 8090
> 8118 8123 8180:8182 8222 8243 8280 8300 8333 8344 8400 8443 8500 8509 8787
> 8800 8888 8899 8983 9000 9002 9060 9080 9090:9091 9111 9290 9443 9447 9710
> 9788 9999:10000 11371 12601 13014 15489 19980 29991 33300 34412 34443:34444
> 40007 41080 44449 50000 50002 51423 53331 55252 55555 56712 ]
>
> PortVar 'GTP_PORTS' defined :  [ 2123 2152 3386 ]
>
> Detection:
>
>    Search-Method = AC-Full-Q
>
>     Split Any/Any group = enabled
>
>     Search-Method-Optimizations = enabled
>
>     Maximum pattern length = 20
>
> Tagged Packet Limit: 256
>
> Loading dynamic engine
> /usr/local/lib/snort_dynamicengine/libsf_engine.so... done
>
> Loading all dynamic detection libs from
> /usr/local/lib/snort_dynamicrules...
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/file-pdf.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/policy-social.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/browser-ie.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/server-iis.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/exploit-kit.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/protocol-tftp.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/file-other.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/protocol-other.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/file-multimedia.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/server-webapp.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/protocol-dns.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/os-other.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/server-other.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/browser-other.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/file-office.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/file-java.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/malware-other.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/protocol-snmp.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/pua-p2p.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/os-windows.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/malware-cnc.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/file-flash.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/protocol-nntp.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/indicator-shellcode.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/server-mail.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/netbios.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/file-image.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/os-linux.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/server-mysql.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/server-apache.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/protocol-voip.so... done
>
>   Loading dynamic detection library
> /usr/local/lib/snort_dynamicrules/server-oracle.so... done
>
>   Finished Loading all dynamic detection libs from
> /usr/local/lib/snort_dynamicrules
>
> Loading all dynamic preprocessor libs from
> /usr/local/lib/snort_dynamicpreprocessor/...
>
>   Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_imap_preproc.so... done
>
>   Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_gtp_preproc.so... done
>
>   Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so... done
>
>   Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_pop_preproc.so... done
>
>   Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_sdf_preproc.so... done
>
>   Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_dnp3_preproc.so... done
>
>   Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_sip_preproc.so... done
>
>   Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_modbus_preproc.so... done
>
>   Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so... done
>
>   Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_ssl_preproc.so... done
>
>   Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so... done
>
>   Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_reputation_preproc.so...
> done
>
>   Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so... done
>
>   Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_dce2_preproc.so... done
>
>   Finished Loading all dynamic preprocessor libs from
> /usr/local/lib/snort_dynamicpreprocessor/
>
> Log directory = /var/log/snort
>
> WARNING: ip4 normalizations disabled because not inline.
>
> WARNING: tcp normalizations disabled because not inline.
>
> WARNING: icmp4 normalizations disabled because not inline.
>
> WARNING: ip6 normalizations disabled because not inline.
>
> WARNING: icmp6 normalizations disabled because not inline.
>
> Frag3 global config:
>
>     Max frags: 65536
>
>     Fragment memory cap: 4194304 bytes
>
> Frag3 engine config:
>
>     Bound Address: default
>
>     Target-based policy: LINUX
>
>     Fragment timeout: 180 seconds
>
>     Fragment min_ttl:   1
>
>     Fragment Anomalies: Alert
>
>     Overlap Limit:     10
>
>     Min fragment Length:     100
>
>       Max Expected Streams: 768
>
> Stream global config:
>
>     Track TCP sessions: ACTIVE
>
>     Max TCP sessions: 262144
>
>     TCP cache pruning timeout: 30 seconds
>
>     TCP cache nominal timeout: 3600 seconds
>
>     Memcap (for reassembly packet storage): 8388608
>
>     Track UDP sessions: ACTIVE
>
>     Max UDP sessions: 131072
>
>     UDP cache pruning timeout: 30 seconds
>
>     UDP cache nominal timeout: 180 seconds
>
>     Track ICMP sessions: INACTIVE
>
>     Track IP sessions: INACTIVE
>
>     Log info if session memory consumption exceeds 1048576
>
>     Send up to 0 active responses
>
>     Protocol Aware Flushing: ACTIVE
>
>         Maximum Flush Point: 16000
>
> Stream TCP Policy config:
>
>     Bound Addresses: 192.168.1.28
>
>     Reassembly Policy: WINDOWS
>
>     Timeout: 30 seconds
>
>     Maximum number of bytes to queue per session: 1048576
>
>     Maximum number of segs to queue per session: 2621
>
>     Reassembly Ports:
>
> Stream TCP Policy config:
>
>     Bound Addresses: 192.168.1.30
>
>     Reassembly Policy: WINDOWS
>
>     Timeout: 30 seconds
>
>     Maximum number of bytes to queue per session: 1048576
>
>     Maximum number of segs to queue per session: 2621
>
>     Reassembly Ports:
>
> Stream TCP Policy config:
>
>     Bound Address: default
>
>     Reassembly Policy: LINUX
>
>     Timeout: 30 seconds
>
>     Maximum number of bytes to queue per session: 1048576
>
>     Maximum number of segs to queue per session: 2621
>
>     Reassembly Ports:
>
> Stream UDP Policy config:
>
>     Timeout: 180 seconds
>
> HttpInspect Config:
>
>     GLOBAL CONFIG
>
>       Detect Proxy Usage:       NO
>
>       IIS Unicode Map Filename: /etc/snort/unicode.map
>
>       IIS Unicode Map Codepage: 1252
>
>       Memcap used for logging URI and Hostname: 150994944
>
>       Max Gzip Memory: 838860
>
>       Max Gzip Sessions: 1807
>
>       Gzip Compress Depth: 65535
>
>       Gzip Decompress Depth: 65535
>
>     DEFAULT SERVER CONFIG:
>
>       Server profile: All
>
>       Ports (PAF): 36 80 81 82 83 84 85 86 87 88 89 90 311 383 555 591 593
> 631 801 808 818 901 972 1158 1220 1414 1533 1741 1830 1942 2231 2301 2381
> 2578 2809 2980 3029 3037 3057 3128 3443 3702 4000 4343 4848 5000 5117 5250
> 5600 5814 6080 6173 6988 7000 7001 7005 7071 7144 7145 7510 7770 7777 7778
> 7779 8000 8001 8008 8014 8015 8020 8028 8040 8080 8081 8082 8085 8088 8090
> 8118 8123 8180 8181 8182 8222 8243 8280 8300 8333 8344 8400 8443 8500 8509
> 8787 8800 8888 8899 8983 9000 9002 9060 9080 9090 9091 9111 9290 9443 9447
> 9710 9788 9999 10000 11371 12601 13014 15489 19980 29991 33300 34412 34443
> 34444 40007 41080 44449 50000 50002 51423 53331 55252 55555 56712
>
>       Server Flow Depth: 0
>
>       Client Flow Depth: 0
>
>       Max Chunk Length: 500000
>
>       Small Chunk Length Evasion: chunk size <= 10, threshold >= 5 times
>
>       Max Header Field Length: 750
>
>       Max Number Header Fields: 100
>
>       Max Number of WhiteSpaces allowed with header folding: 200
>
>       Inspect Pipeline Requests: YES
>
>       URI Discovery Strict Mode: NO
>
>       Allow Proxy Usage: NO
>
>       Disable Alerting: NO
>
>       Oversize Dir Length: 500
>
>       Only inspect URI: NO
>
>       Normalize HTTP Headers: NO
>
>       Inspect HTTP Cookies: YES
>
>       Inspect HTTP Responses: YES
>
>       Extract Gzip from responses: YES
>
>       Decompress response files:
>
>       Unlimited decompression of gzip data from responses: YES
>
>       Normalize Javascripts in HTTP Responses: YES
>
>       Max Number of WhiteSpaces allowed with Javascript Obfuscation in
> HTTP responses: 200
>
>       Normalize HTTP Cookies: NO
>
>       Enable XFF and True Client IP: NO
>
>       Log HTTP URI data: NO
>
>       Log HTTP Hostname data: NO
>
>       Extended ASCII code support in URI: NO
>
>       Ascii: YES alert: NO
>
>       Double Decoding: YES alert: NO
>
>       %U Encoding: YES alert: YES
>
>       Bare Byte: YES alert: NO
>
>       UTF 8: YES alert: NO
>
>       IIS Unicode: YES alert: NO
>
>       Multiple Slash: YES alert: NO
>
>       IIS Backslash: YES alert: NO
>
>       Directory Traversal: YES alert: NO
>
>       Web Root Traversal: YES alert: NO
>
>       Apache WhiteSpace: YES alert: NO
>
>       IIS Delimiter: YES alert: NO
>
>       IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
>
>       Non-RFC Compliant Characters: 0x00 0x01 0x02 0x03 0x04 0x05 0x06
> 0x07
>
>       Whitespace Characters: 0x09 0x0b 0x0c 0x0d
>
> rpc_decode arguments:
>
>     Ports to decode RPC on: 111 32770 32771 32772 32773 32774 32775 32776
> 32777 32778 32779
>
>     alert_fragments: INACTIVE
>
>     alert_large_fragments: INACTIVE
>
>     alert_incomplete: INACTIVE
>
>     alert_multiple_requests: INACTIVE
>
> FTPTelnet Config:
>
>     GLOBAL CONFIG
>
>       Inspection Type: stateful
>
>       Check for Encrypted Traffic: YES alert: NO
>
>       Continue to check encrypted data: YES
>
>     TELNET CONFIG:
>
>       Ports: 23
>
>       Are You There Threshold: 20
>
>       Normalize: YES
>
>       Detect Anomalies: YES
>
>     FTP CONFIG:
>
>       FTP Server: default
>
>         Ports (PAF): 21 2100 3535
>
>         Check for Telnet Cmds: YES alert: YES
>
>         Ignore Telnet Cmd Operations: YES alert: YES
>
>         Ignore open data channels: NO
>
>       FTP Client: default
>
>         Check for Bounce Attacks: YES alert: YES
>
>         Check for Telnet Cmds: YES alert: YES
>
>         Ignore Telnet Cmd Operations: YES alert: YES
>
>         Max Response Length: 256
>
> SMTP Config:
>
>     Ports: 25 465 587 691
>
>     Inspection Type: Stateful
>
>     Normalize: ATRN AUTH BDAT DATA DEBUG EHLO EMAL ESAM ESND ESOM ETRN
> EVFY EXPN HELO HELP IDENT MAIL NOOP ONEX QUEU QUIT RCPT RSET SAML SEND
> STARTTLS SOML TICK TIME TURN TURNME VERB VRFY X-EXPS XADR XAUTH XCIR
> XEXCH50 XGEN XLICENSE X-LINK2STATE XQUE XSTA XTRN XUSR CHUNKING X-ADAT
> X-DRCP X-ERCP X-EXCH50
>
>     Ignore Data: No
>
>     Ignore TLS Data: No
>
>     Ignore SMTP Alerts: No
>
>     Max Command Line Length: 512
>
>     Max Specific Command Line Length:
>
>        ATRN:255 AUTH:246 BDAT:255 DATA:246 DEBUG:255
>
>        EHLO:500 EMAL:255 ESAM:255 ESND:255 ESOM:255
>
>        ETRN:246 EVFY:255 EXPN:255 HELO:500 HELP:500
>
>        IDENT:255 MAIL:260 NOOP:255 ONEX:246 QUEU:246
>
>        QUIT:246 RCPT:300 RSET:246 SAML:246 SEND:246
>
>        SIZE:255 STARTTLS:246 SOML:246 TICK:246 TIME:246
>
>        TURN:246 TURNME:246 VERB:246 VRFY:255 X-EXPS:246
>
>        XADR:246 XAUTH:246 XCIR:246 XEXCH50:246 XGEN:246
>
>        XLICENSE:246 X-LINK2STATE:246 XQUE:246 XSTA:246 XTRN:246
>
>        XUSR:246
>
>     Max Header Line Length: 1000
>
>     Max Response Line Length: 512
>
>     X-Link2State Alert: Yes
>
>     Drop on X-Link2State Alert: No
>
>     Alert on commands: None
>
>     Alert on unknown commands: No
>
>     SMTP Memcap: 838860
>
>     MIME Max Mem: 838860
>
>     Base64 Decoding: Enabled
>
>     Base64 Decoding Depth: Unlimited
>
>     Quoted-Printable Decoding: Enabled
>
>     Quoted-Printable Decoding Depth: Unlimited
>
>     Unix-to-Unix Decoding: Enabled
>
>     Unix-to-Unix Decoding Depth: Unlimited
>
>     Non-Encoded MIME attachment Extraction: Enabled
>
>     Non-Encoded MIME attachment Extraction Depth: Unlimited
>
>     Log Attachment filename: Enabled
>
>     Log MAIL FROM Address: Enabled
>
>     Log RCPT TO Addresses: Enabled
>
>     Log Email Headers: Enabled
>
>     Email Hdrs Log Depth: 1464
>
> SSH config:
>
>     Autodetection: ENABLED
>
>     Challenge-Response Overflow Alert: ENABLED
>
>     SSH1 CRC32 Alert: ENABLED
>
>     Server Version String Overflow Alert: ENABLED
>
>     Protocol Mismatch Alert: ENABLED
>
>     Bad Message Direction Alert: DISABLED
>
>     Bad Payload Size Alert: DISABLED
>
>     Unrecognized Version Alert: DISABLED
>
>     Max Encrypted Packets: 20
>
>     Max Server Version String Length: 100
>
>     MaxClientBytes: 19600 (Default)
>
>     Ports:
>
> 22
>
> DCE/RPC 2 Preprocessor Configuration
>
>   Global Configuration
>
>     DCE/RPC Defragmentation: Enabled
>
>     Memcap: 102400 KB
>
>     Events: co
>
>     SMB Fingerprint policy: Disabled
>
>   Server Default Configuration
>
>     Policy: WinXP
>
>     Detect ports (PAF)
>
>       SMB: 139 445
>
>       TCP: 135
>
>       UDP: 135
>
>       RPC over HTTP server: 593
>
>       RPC over HTTP proxy: None
>
>     Autodetect ports (PAF)
>
>       SMB: None
>
>       TCP: 1025-65535
>
>       UDP: 1025-65535
>
>       RPC over HTTP server: 1025-65535
>
>       RPC over HTTP proxy: None
>
>     Invalid SMB shares: C$ D$ ADMIN$
>
>     Maximum SMB command chaining: 3 commands
>
>     SMB file inspection: Disabled
>
> DNS config:
>
>     DNS Client rdata txt Overflow Alert: ACTIVE
>
>     Obsolete DNS RR Types Alert: INACTIVE
>
>     Experimental DNS RR Types Alert: INACTIVE
>
>     Ports: 53
>
> SSLPP config:
>
>     Encrypted packets: not inspected
>
>     Ports:
>
>       443      465      563      636      989
>
>       992      993      994      995     5061
>
>      7801     7802     7900     7901     7902
>
>      7903     7904     7905     7906     7907
>
>      7908     7909     7910     7911     7912
>
>      7913     7914     7915     7916     7917
>
>      7918     7919     7920
>
>     Server side data is trusted
>
>     Maximum SSL Heartbeat length: 0
>
> Sensitive Data preprocessor config:
>
>     Global Alert Threshold: 25
>
>     Masked Output: DISABLED
>
> SIP config:
>
>     Max number of sessions: 40000
>
>     Max number of dialogs in a session: 4 (Default)
>
>     Status: ENABLED
>
>     Ignore media channel: DISABLED
>
>     Max URI length: 512
>
>     Max Call ID length: 80
>
>     Max Request name length: 20 (Default)
>
>     Max From length: 256 (Default)
>
>     Max To length: 256 (Default)
>
>     Max Via length: 1024 (Default)
>
>     Max Contact length: 512
>
>     Max Content length: 2048
>
>     Ports:
>
> 5060 5061 5600
>
>     Methods:
>
>   invite cancel ack bye register options refer subscribe update join info
> message notify benotify do qauth sprack publish service unsubscribe prack
>
> IMAP Config:
>
>     Ports: 143
>
>     IMAP Memcap: 838860
>
>     MIME Max Mem: 838860
>
>     Base64 Decoding: Enabled
>
>     Base64 Decoding Depth: Unlimited
>
>     Quoted-Printable Decoding: Enabled
>
>     Quoted-Printable Decoding Depth: Unlimited
>
>     Unix-to-Unix Decoding: Enabled
>
>     Unix-to-Unix Decoding Depth: Unlimited
>
>     Non-Encoded MIME attachment Extraction: Enabled
>
>     Non-Encoded MIME attachment Extraction Depth: Unlimited
>
> POP Config:
>
>     Ports: 110
>
>     POP Memcap: 838860
>
>     MIME Max Mem: 838860
>
>     Base64 Decoding: Enabled
>
>     Base64 Decoding Depth: Unlimited
>
>     Quoted-Printable Decoding: Enabled
>
>     Quoted-Printable Decoding Depth: Unlimited
>
>     Unix-to-Unix Decoding: Enabled
>
>     Unix-to-Unix Decoding Depth: Unlimited
>
>     Non-Encoded MIME attachment Extraction: Enabled
>
>     Non-Encoded MIME attachment Extraction Depth: Unlimited
>
> Modbus config:
>
>     Ports:
>
> 502
>
> DNP3 config:
>
>     Memcap: 262144
>
>     Check Link-Layer CRCs: ENABLED
>
>     Ports:
>
> 20000
>
> Reputation config:
>
> WARNING: Can't find any whitelist/blacklist entries. Reputation
> Preprocessor disabled.
>
>
> +++++++++++++++++++++++++++++++++++++++++++++++++++
>
> Initializing rule chains...
>
> ERROR: /etc/snort/snort.conf(281) Unknown rule type: track_udp.
>
> Fatal Error, Quitting..
>
>
> Any ideas?
>
> On Thu, Nov 19, 2015 at 1:01 PM, James Lay <jlay () slave-tothe-box net>
> wrote:
>
> > Comment out:
> >
> > $RepeatedMsgReduction on
> >
> > in your rsyslog.conf if you want to see all the messages.
> >
> > Or just start it without the -D and run it in the foreground.
> >
> > James
> >
> > On 2015-11-19 13:58, Rafael Leiva-Ochoa wrote:
> > > Where do I look for the rate-limited messages? That is what is
> > > confusing me.
> > >
> > > Thanks,
> > >
> > > Rafael
> > >
> > > On Thu, Nov 19, 2015 at 12:52 PM, James Lay <jlay () slave-tothe-box net>
> > > wrote:
> > >
> > > > On 2015-11-19 13:47, Rafael Leiva-Ochoa wrote:
> > > >
> > > > > Thanks for the reply James. Snort was working fine, but when I
> > > > > added
> > > > > the following entries:
> > > > >
> > > > > preprocessor stream5_global: track_tcp yes
> > > > >
> > > > > preprocessor stream5_tcp: bind_to 192.168.1.28/32 [1] [1], policy
> > > > > windows
> > > > >
> > > > > preprocessor stream5_tcp: bind_to 192.168.1.30/32 [2] [2], policy
> > > > > windows
> > > > >
> > > > > preprocessor stream5_tcp: policy linux
> > > > >
> > > > > It gives me that "rsyslog-limitting" error. I have no idea what
> > > > > that
> > > > > has to do with the changes I made. All I want to do is to support
> > > > > reassembly for both Linux, and Windows system. I only have 2
> > > > > Windows
> > > > > system, I thought it was by easy to define them explicitly on the
> > > > > configuration as you see above, but it is not working on the snort
> > > > > configuration.
> > > > >
> > > > > Thanks,
> > > > >
> > > > > Rafael
> > > >
> > > > Ya that looks good...though you can most likely drop the "/32" since
> > > > these are just single IP's.  I'd be curious to see what the
> > > > rate-limited messages are.
> > > >
> > > > James
> > > >
> > > > On Thu, Nov 19, 2015 at 12:39 PM, James Lay
> > > > <jlay () slave-tothe-box net>
> > > > wrote:
> > > >
> > > > On 2015-11-19 12:26, Rafael Leiva-Ochoa wrote:
> > > > Hi All,
> > > >
> > > > I am trying to configure the Stream5 preprocessor to do
> > > > reassembly
> > > > for both Windows and Linux using the following configuration:
> > > >
> > > > # Target-Based stateful inspection/stream reassembly.  For more
> > > > inforation, see README.stream5
> > > >
> > > > preprocessor stream5_global: track_tcp yes
> > > >
> > > > preprocessor stream5_tcp: bind_to 192.168.1.28/32 [1] [1] [1],
> > > > policy
> > > > windows
> > > >
> > > > preprocessor stream5_tcp: bind_to 192.168.1.30/32 [2] [2] [2],
> > > > policy
> > > >
> > > > windows
> > > >
> > > > preprocessor stream5_tcp: policy linux
> > > >
> > > > track_udp yes, \
> > > >
> > > > track_icmp no, \
> > > >
> > > > max_tcp 262144, \
> > > >
> > > > max_udp 131072, \
> > > >
> > > > max_active_responses 2, \
> > > >
> > > > min_response_seconds 5
> > > >
> > > > detect_anomalies, require_3whs 180, \
> > > >
> > > > overlap_limit 10, small_segments 0 bytes 150, timeout 180, \
> > > >
> > > > ports client 21 22 23 25 42 53 70 79 109 110 111 113 119 135
> > > > 136
> > > > 137 139 143 \
> > > >
> > > > 161 445 513 514 587 593 691 1433 1521 1741 2100 3306 6070
> > > > 6665
> > > > 6666 6667 6668 6669 \
> > > >
> > > > 7000 8181 32770 32771 32772 32773 32774 32775 32776 32777
> > > > 32778 32779, \
> > > >
> > > > ports both 36 80 81 82 83 84 85 86 87 88 89 90 110 311 383 443
> > > > 465
> > > > 563 555 591 593 631 636 801 808 818 901 972 989 992 993 994 995
> > > > 1158
> > > > 1220 1414 1533 1741 1830 1942 2231 2301 2381 2578 2809 2980 3029
> > > > 3037
> > > > 3057 3128 3443 3702 4000 4343 4848 5000 5117 5250 5600 5814 6080
> > > > 6173
> > > > 6988 7907 7000 7001 7005 7071 7144 7145 7510 7802 7770 7777 7778
> > > > 7779
> > > > \
> > > >
> > > > 7801 7900 7901 7902 7903 7904 7905 7906 7908 7909 7910
> > > > 7911
> > > > 7912 7913 7914 7915 7916 \
> > > >
> > > > 7917 7918 7919 7920 8000 8001 8008 8014 8015 8020 8028
> > > > 8040
> > > > 8080 8081 8082 8085 8088 8090 8118 8123 8180 8181 8182 8222 8243
> > > > 8280
> > > > 8300 8333 8344 8400 8443 8500 8509 8787 8800 8888 8899 8983 9000
> > > > 9002
> > > > 9060 9080 9090 9091 9111 9290 9443 9447 9710 9788 9999 10000 11371
> > > > 12601 13014 15489 19980 29991 33300 34412 34443 34444 40007 41080
> > > > 44449 50000 50002 51423 53331 55252 55555 56712
> > > >
> > > > But, I only get this error when trying to run it.
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]: Frag3 global config:
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Max frags: 65536
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Fragment memory
> > > > cap:
> > > > 4194304 bytes
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]: Frag3 engine config:
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Bound Address:
> > > > default
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Target-based
> > > > policy:
> > > > LINUX
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Fragment timeout:
> > > > 180
> > > > seconds
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Fragment min_ttl:
> > > > 1
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Fragment
> > > > Anomalies:
> > > > Alert
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Overlap Limit:
> > > > 10
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Min fragment
> > > > Length:
> > > > 100
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:       Max Expected
> > > > Streams: 768
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]: Stream global config:
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Track TCP
> > > > sessions:
> > > > ACTIVE
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Max TCP sessions:
> > > > 262144
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     TCP cache pruning
> > > > timeout: 30 seconds
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     TCP cache nominal
> > > > timeout: 3600 seconds
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Memcap (for
> > > > reassembly
> > > > packet storage): 8388608
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Track UDP
> > > > sessions:
> > > > ACTIVE
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Max UDP sessions:
> > > > 131072
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     UDP cache pruning
> > > > timeout: 30 seconds
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     UDP cache nominal
> > > > timeout: 180 seconds
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Track ICMP
> > > > sessions:
> > > > INACTIVE
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Track IP sessions:
> > > > INACTIVE
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Log info if
> > > > session
> > > > memory consumption exceeds 1048576
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Send up to 0
> > > > active
> > > > responses
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Protocol Aware
> > > > Flushing: ACTIVE
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:         Maximum Flush
> > > > Point: 16000
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]: Stream TCP Policy
> > > > config:
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Bound Addresses:
> > > > 192.168.1.28
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Reassembly Policy:
> > > > WINDOWS
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Timeout: 30
> > > > seconds
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Maximum number of
> > > > bytes to queue per session: 1048576
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Maximum number of
> > > > segs
> > > > to queue per session: 2621
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Reassembly Ports:
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]: Stream TCP Policy
> > > > config:
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Bound Addresses:
> > > > 192.168.1.30
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Reassembly Policy:
> > > > WINDOWS
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Timeout: 30
> > > > seconds
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Maximum number of
> > > > bytes to queue per session: 1048576
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Maximum number of
> > > > segs
> > > > to queue per session: 2621
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Reassembly Ports:
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]: Stream TCP Policy
> > > > config:
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Bound Address:
> > > > default
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Reassembly Policy:
> > > > LINUX
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Timeout: 30
> > > > seconds
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Maximum number of
> > > > bytes to queue per session: 1048576
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Maximum number of
> > > > segs
> > > > to queue per session: 2621
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Reassembly Ports:
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]: Stream UDP Policy
> > > > config:
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     Timeout: 180
> > > > seconds
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]: HttpInspect Config:
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:     GLOBAL CONFIG
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:       Detect Proxy
> > > > Usage:
> > > > NO
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:       IIS Unicode Map
> > > > Filename: /etc/snort/unicode.map
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:       IIS Unicode Map
> > > > Codepage: 1252
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:       Memcap used for
> > > > logging URI and Hostname: 150994944
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:       Max Gzip Memory:
> > > > 838860
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 snort[24078]:       Max Gzip
> > > > Sessions:
> > > > 1807
> > > >
> > > > Nov 19 11:24:25 snort-sensor1 rsyslogd-2177: imuxsock begins to
> > > > drop
> > > > messages from pid 24078 due to rate-limiting
> > > > Any ideas on how to fix this?
> > > >
> > > > Thanks,
> > > >
> > > > Rafael
> > > >
> > > > What's the issue?  The syslog entry?  Normal at startup with Snort
> > > > if
> > > > you have rsyslog rate-limiting on.  Comment out:
> > > >
> > > > $RepeatedMsgReduction on
> > > >
> > > > in your rsyslog.conf if you want to see all the messages.
> > > >
> > > > James
> > ------------------------------------------------------------------------------
> > > > _______________________________________________
> > > > Snort-users mailing list
> > > > Snort-users () lists sourceforge net
> > > > Go to this URL to change user options or unsubscribe:
> > > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > > Snort-users list archive:
> > > > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> > > >
> > > > Please visit http://blog.snort.org to stay current on all the latest
> > > > Snort news!
> > >
> > >  Links:
> > > ------
> > > [1] http://192.168.1.28/32
> > > [2] http://192.168.1.30/32
> > >
> > >
> > >
> > > Links:
> > > ------
> > > [1] http://192.168.1.28/32
> > > [2] http://192.168.1.30/32
> >
> >
> > ------------------------------------------------------------------------------
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> >
> > Please visit http://blog.snort.org to stay current on all the latest
> > Snort news!
------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!