0

I've captured on my wifi some days ago and now I want snort to analyse the capture to detect any problem. However, when I run snort -l ./snort-log -b -c /etc/snort/snort.conf -r captura-analisar.pcapng it stops with

ERROR: Cannot decode data link type 127

Fatal Error, Quitting..

I guess this is happening because there is some encrypted 802.11 data in the file. Not all packets are encrypted though. If it is the case, how to set snort to ignore the encrypted data and analyse only the decrypted? Or if it isn't the case, what is the problem?

  • The problem is that you did not capture at the ethernet layer. See bhumishgajjar.wordpress.com/tag/enable-non-ether-decoders for more information on this. – Steffen Ullrich Aug 27 '17 at 4:57
  • in my case, the wifi interface captured was called wlp6s0, I added the option -i wlp6s0 and still had the same error – Fabiotk Aug 27 '17 at 18:29
  • The -i option is only for live capture and does not affect the interpretation of the pcap. Did you actually read the article I've linked to? – Steffen Ullrich Aug 27 '17 at 18:37
  • yes, i've read, correct me if I get something wrong but if I live capture on the wifi interface, wouldn't snort then need the EAPOL handshakes to decrypt the packets? According to this: wiki.wireshark.org/HowToDecrypt802.11 – Fabiotk Aug 27 '17 at 18:55
  • 1
    The main point is that the you've sniffed at the wrong data link layer, i.e. a layer unsupported by snort. The used data link layer is not a per packet setting but is global for the whole pcap file. For processing with snort you should sniff at the ethernet layer, i.e. plain interface with no monitor mode or anything like this. – Steffen Ullrich Aug 27 '17 at 19:30
1

from what you described, I understood:

  • You already have PCAP files to analyse with Snort (so you are not running in live mode but reading back previously created captures). Therefore the switch -i does not apply in this case.
  • Snort aborts with the message: ERROR: Cannot decode data link type 127
  • When you mention "detect any problem", I assume you are specifically looking for malware communication (and not investigation network issues, eg. layer-2 issues with your Wifi!).

First, you need to remove radiotap link encapsulation by rewriting the layer-2 link type into something Snort can easily cope with, eg. link-type ether

For that you can use editcap tool from Wireshark project.

editcap captura-analisar.pcapng -T ether captura-1.pcap, where:

  • -T ether: sets the encapsulation type of the output file to ether.

By the way, if your version of Snort does not read PCAPNG files, you can also convert it with editcap adding parameter -F pcap

editcap captura-analisar.pcapng -F pcap -T ether captura-1.pcap

From now on you can run snort over your PCAPs files with a command such as:

snort -A console -k none -K none -c snort.conf -r captura-1.pcap

where:

  • -A: issues alerts to the console
  • -K: logging-mode, none will not create PCAPs from the alerts, while pcap will do so. Use accordingly.
  • -k: checksum mode, ignore checksum validation.
  • -c: your snort config file containing variables, pre-process options, rules.
  • -r: read PCAP. be aware of other options to read bunch of pcap files, such as --pcap-dir=/home/foo/pcaps or --pcap-list="foo1.pcap foo2.pcap foo3.pcap"

Does it make sense?

Kind regards J.C.

PS: you can inspect the properties of PCAP files with capinfos -M captura.pcap. This shows information on encapsulation, amount of packets captured, start/end date of capture, duration, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.