Re: snort3: reject rule problem

["Russ Combs \(rucombs\) via Snort-devel" <snort-devel () lists snort org>]

What happens if you disable the active responses?  Do you get multiple alerts?  It seems like the active response is 
working.

From: Snort-devel <snort-devel-bounces () lists snort org> on behalf of Meridoff via Snort-devel <snort-devel () lists 
snort org>
Reply-To: Meridoff <oagvozd () gmail com>
Date: Tuesday, October 1, 2019 at 12:07 PM
To: "snort-devel () lists snort org" <snort-devel () lists snort org>
Subject: Re: [Snort-devel] snort3: reject rule problem

> > That is per design – the alert kicks off the active responses.  The alert is logged, but the responses are not.
I have many pings so it must be many alerts, but it's only one alert for pings, when active response is ON.
Is it normanl ?

вт, 1 окт. 2019 г. в 17:42, Meridoff <oagvozd () gmail com<mailto:oagvozd () gmail com>>:
I have many pings so it must be many alerts, but it's only one, when active response is ON.
Is it normanl ?

чт, 26 сент. 2019 г. в 17:41, Russ Combs (rucombs) <rucombs () cisco com<mailto:rucombs () cisco com>>:
That is per design – the alert kicks off the active responses.  The alert is logged, but the responses are not.

From: Meridoff <oagvozd () gmail com<mailto:oagvozd () gmail com>>
Date: Thursday, September 26, 2019 at 10:25 AM
To: "Russ Combs (rucombs)" <rucombs () cisco com<mailto:rucombs () cisco com>>
Subject: Re: [Snort-devel] snort3: reject rule problem

Thanks, it's became better - Host/Port Unreachable sent for each ping packet now.

BUT in log goes only 1st ping packet. For other ping packets - no alerts in log..

I use active.min_interval = 1
So this settings fix problem with Active response pacekts, but in log only 1st alert for all cases..

чт, 26 сент. 2019 г. в 14:36, Russ Combs (rucombs) <rucombs () cisco com<mailto:rucombs () cisco com>>:
Take a look at the active module.  Try configuring active.min_interval.

Russ

From: Snort-devel <snort-devel-bounces () lists snort org<mailto:snort-devel-bounces () lists snort org>> on behalf of 
Meridoff via Snort-devel <snort-devel () lists snort org<mailto:snort-devel () lists snort org>>
Reply-To: Meridoff <oagvozd () gmail com<mailto:oagvozd () gmail com>>
Date: Wednesday, September 25, 2019 at 5:39 PM
To: "snort-devel () lists snort org<mailto:snort-devel () lists snort org>" <snort-devel () lists snort 
org<mailto:snort-devel () lists snort org>>
Subject: [Snort-devel] snort3: reject rule problem


Hello

I have reject rule that send Port unreachable for ping.



It's Ok, but only for 1st packet.



The next ping packets are silently dropped and not detected and not logged.



reject icmp 192.168.0.1 any -> any any ( gid:8000; sid:1; msg:"ping";  )



This happens when stream and stream_icmp inspectors are in config.



If I remove stream {} and/or stream_icmp {} inspectors from snort lua config, then ALL OK: each packet is

dropped, logged and ICMP Port unreach is sending on each dropped packet.





Part of config:



stream={}

stream_icmp={}

reject={control="port"}



Thanks.

_______________________________________________
Snort-devel mailing list
Snort-devel () lists snort org
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!