2

New to snort here. I downloaded snort (2.9.6.0 GRE Build 47) on my Ubuntu 14.04, also downloaded emergingthreat rules.

I ran the following command

root@myhp:~/pkgs/emergeThreats/snortRules# snort -vi tap0  -A fast -s -y -c emerging.conf

and got the following when I replayed a pcap with a malicious HTTP session

Commencing packet processing (pid=8379)
07/05/16-10:07:27.349104 192.168.1.11:16958 -> 192.168.3.1:80
TCP TTL:64 TOS:0x0 ID:24197 IpLen:20 DgmLen:60 DF
******S* Seq: 0x3E9E4D75  Ack: 0x0  Win: 0x7210  TcpLen: 40
TCP Options (5) => MSS: 1460 SackOK TS: 1094521840 0 NOP WS: 7 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

07/05/16-10:07:27.358086 192.168.3.1:80 -> 192.168.1.11:16958
TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:44
***A**S* Seq: 0x79E2AA84  Ack: 0xAFF057C3  Win: 0xFFFF  TcpLen: 24
TCP Options (1) => MSS: 1460 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

07/05/16-10:07:27.358190 192.168.1.11:16958 -> 192.168.3.1:80
TCP TTL:64 TOS:0x0 ID:27976 IpLen:20 DgmLen:40 DF
*****R** Seq: 0xAFF057C3  Ack: 0x0  Win: 0x0  TcpLen: 20
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

07/05/16-10:07:28.346259 192.168.1.11:16958 -> 192.168.3.1:80
TCP TTL:64 TOS:0x0 ID:24198 IpLen:20 DgmLen:60 DF
******S* Seq: 0x3E9E4D75  Ack: 0x0  Win: 0x7210  TcpLen: 40
TCP Options (5) => MSS: 1460 SackOK TS: 1094522090 0 NOP WS: 7 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

07/05/16-10:07:28.354186 192.168.3.1:80 -> 192.168.1.11:16958
TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:44
***A**S* Seq: 0x7545E146  Ack: 0x3E9E4D76  Win: 0xFFFF  TcpLen: 24
TCP Options (1) => MSS: 1460 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

07/05/16-10:07:28.354454 192.168.1.11:16958 -> 192.168.3.1:80
TCP TTL:64 TOS:0x0 ID:24199 IpLen:20 DgmLen:40 DF
***A**** Seq: 0x3E9E4D76  Ack: 0x7545E147  Win: 0x7210  TcpLen: 20
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

07/05/16-10:07:28.355903 192.168.1.11:16958 -> 192.168.3.1:80
TCP TTL:64 TOS:0x0 ID:24200 IpLen:20 DgmLen:79 DF
***AP*** Seq: 0x3E9E4D76  Ack: 0x7545E147  Win: 0x7210  TcpLen: 20
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

07/05/16-10:07:28.366111 192.168.3.1:80 -> 192.168.1.11:16958

The issues I have:

  • Why do the events for each TCP packet show up here? how do I disable it? I just need to see the event for actual malware matches
  • why don't the events get sent to syslog server? I have a wireshark monitoring "lo" interface for udp packets to port 514 but I am not seeing any.

Here is the link for emerging.conf: http://pastebin.com/raw/dUVgysTi

Any ideas? Thanks.

1

Turned out the verbose events (about each packets) is because of the "-v" option. After removing it, I don't see them.

The alert shows up in a file "alert" in the default directory /var/log/snort. One can change it by the command line option -l <new directory>.

I don't know why snort is not sending the syslog using UDP socket. "strace" command showed me it's actually using UNIX socket. Specifying the destination in configure file (emerging.conf) output alert_syslog: host=192.168.181.1:514, LOG_AUTH LOG_ALERT didn't help. Had to put a workaround by using a script that listens on unix socket and send it using UDP socket.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.