Questions on snort generating too many events and not sending to syslog

Question

New to snort here. I downloaded snort (2.9.6.0 GRE Build 47) on my Ubuntu 14.04, also downloaded emergingthreat rules.

I ran the following command

root@myhp:~/pkgs/emergeThreats/snortRules# snort -vi tap0  -A fast -s -y -c emerging.conf

and got the following when I replayed a pcap with a malicious HTTP session

Commencing packet processing (pid=8379)
07/05/16-10:07:27.349104 192.168.1.11:16958 -> 192.168.3.1:80
TCP TTL:64 TOS:0x0 ID:24197 IpLen:20 DgmLen:60 DF
******S* Seq: 0x3E9E4D75  Ack: 0x0  Win: 0x7210  TcpLen: 40
TCP Options (5) => MSS: 1460 SackOK TS: 1094521840 0 NOP WS: 7 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

07/05/16-10:07:27.358086 192.168.3.1:80 -> 192.168.1.11:16958
TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:44
***A**S* Seq: 0x79E2AA84  Ack: 0xAFF057C3  Win: 0xFFFF  TcpLen: 24
TCP Options (1) => MSS: 1460 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

07/05/16-10:07:27.358190 192.168.1.11:16958 -> 192.168.3.1:80
TCP TTL:64 TOS:0x0 ID:27976 IpLen:20 DgmLen:40 DF
*****R** Seq: 0xAFF057C3  Ack: 0x0  Win: 0x0  TcpLen: 20
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

07/05/16-10:07:28.346259 192.168.1.11:16958 -> 192.168.3.1:80
TCP TTL:64 TOS:0x0 ID:24198 IpLen:20 DgmLen:60 DF
******S* Seq: 0x3E9E4D75  Ack: 0x0  Win: 0x7210  TcpLen: 40
TCP Options (5) => MSS: 1460 SackOK TS: 1094522090 0 NOP WS: 7 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

07/05/16-10:07:28.354186 192.168.3.1:80 -> 192.168.1.11:16958
TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:44
***A**S* Seq: 0x7545E146  Ack: 0x3E9E4D76  Win: 0xFFFF  TcpLen: 24
TCP Options (1) => MSS: 1460 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

07/05/16-10:07:28.354454 192.168.1.11:16958 -> 192.168.3.1:80
TCP TTL:64 TOS:0x0 ID:24199 IpLen:20 DgmLen:40 DF
***A**** Seq: 0x3E9E4D76  Ack: 0x7545E147  Win: 0x7210  TcpLen: 20
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

07/05/16-10:07:28.355903 192.168.1.11:16958 -> 192.168.3.1:80
TCP TTL:64 TOS:0x0 ID:24200 IpLen:20 DgmLen:79 DF
***AP*** Seq: 0x3E9E4D76  Ack: 0x7545E147  Win: 0x7210  TcpLen: 20
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

07/05/16-10:07:28.366111 192.168.3.1:80 -> 192.168.1.11:16958

The issues I have:

• Why do the events for each TCP packet show up here? how do I disable it? I just need to see the event for actual malware matches
• why don't the events get sent to syslog server? I have a wireshark monitoring "lo" interface for udp packets to port 514 but I am not seeing any.

Here is the link for emerging.conf: http://pastebin.com/raw/dUVgysTi

Any ideas? Thanks.

Answer 1

Turned out the verbose events (about each packets) is because of the "-v" option. After removing it, I don't see them.

The alert shows up in a file "alert" in the default directory /var/log/snort. One can change it by the command line option -l <new directory>.

I don't know why snort is not sending the syslog using UDP socket. "strace" command showed me it's actually using UNIX socket. Specifying the destination in configure file (emerging.conf) output alert_syslog: host=192.168.181.1:514, LOG_AUTH LOG_ALERT didn't help. Had to put a workaround by using a script that listens on unix socket and send it using UDP socket.