For example, flow:established is detecting only for packets with sessions connected.

Then, the server is rejecting packets to received after the session is disconnected?

Simply, flow is a non-payload detection rule option utilizing the Stream preprocessor (formerly Stream5, Stream4). I recommend reading the following documentation:


To answer your question:

For example, flow:established is detecting only for packets with sessions connected.

I'd like to expand on this. TCP connections use a 3-way handshake (3WHS). The client sends a SYN, the server responds with a SYN+ACK, and then the client replies with an ACK.

TCP 3-way handshake

Image from: http://blog.wangyizhe.net/2015/10/TCP-3-way-Handshake/

When using flow:established in a rule, you're telling Snort not to bother looking at [typically] the first three packets in a TCP stream. This is done because normally there is no content (Application Data) inside.

When not to use established in your flow option:

  1. When writing a signature that does not use TCP (e.g. UDP, ICMP, IP)

  2. When writing a signature that is designed to target packets inside the 3WHS.


Then, the server is rejecting packets to received after the session is disconnected?

Remember, Snort is not a server; it is a Network Intrusion Prevention/Detection System (NIPS/NIDS). The only way it will reject packets is if you have it configured and running in an inline configuration (NIPS). If not, it can only observe traffic and cannot actively reject or drop packets.

Assuming you had Snort configured and running in inline mode, if you were to write a rule like:

drop tcp any any -> any any (msg:"Dropping packets"; flow:established; sid:1; rev:1; )

... The rule would fire on any TCP packet that was seen after the initial 3WHS. This would appear to both the client and server as a successful connection, but no data would be transferred, because Snort would be dropping packets.

Remember that Snort is a detection engine, so don't think of it in terms of sending/receiving data or initiating/establishing connections. Think of it as a passive observer (or in the case of an IPS, a bouncer at a nightclub).

For more information on flow or the Stream preprocessor, please read the documentation I linked to above.

Hope this answers your question!

flow option choose the syn sender as the client. And just tell snort which direction the traffic is going.

And Snort does not affect traffic behavior, it inspect only in ids mode.

flow option is useful for simple network.

enter image description here

But it may be useless for complex network.

enter image description here

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.