I am trying snorts file inspect preprocessor for blocking incoming files from their sha256sums. I am using snort version 18.104.22.168 with daq nfq inline mode any my file_inspect preprocessor configs are shown below:
config file: \ file_signature_depth 0, \ file_capture_memcap 1000, \ file_capture_max 4294967295, \ file_capture_block_size 500000000, \ file_capture_min 0 preprocessor file_inspect: \ signature, \ capture_disk /root/file_capture 1024, \ blacklist sha_blacklist
After I run snort and downloaded 11 same files(648 bytes) snort exit stats outputs like that:
File Preprocessor Statistics Total file type callbacks: 0 Total file signature callbacks: 2 Total files would saved to disk: 2 Total files saved to disk: 0 Total file data saved to disk: 0 bytes Total files duplicated: 2 Total files reserving failed: 0 Total file capture min: 0 Total file capture max: 0 Total file capture memcap: 0 Total files reading failed: 0 Total file agent memcap failures: 0 Total files sent: 0 Total file data sent: 0 Total file transfer failures: 0 ============================================ File type stats: Type Download (Bytes) Upload (Bytes) Total 0 0 0 0 File signature stats: Type Download Upload Undecided file type, continue...( 0) 2 0 Total 2 0 File type verdicts: UNKNOWN: 0 LOG: 0 STOP: 0 BLOCK: 0 REJECT: 0 PENDING: 0 STOP CAPTURE: 0 Total: 0 File signature verdicts: UNKNOWN: 0 LOG: 0 STOP: 0 BLOCK: 2 REJECT: 0 PENDING: 0 STOP CAPTURE: 0 Total: 2 Total files processed: 11 Total files data processed: 7128 bytes Total files buffered: 11 Total files released: 2 Total files freed: 9 Total files captured: 2 Total files within one packet: 2 Total buffers allocated: 11 Total buffers freed: 9 Total buffers released: 2 Maximum file buffers used: 1 Total buffers free errors: 0 Total buffers release errors: 0 Total memcap failures: 0 Total memcap failures at reserve: 0 Total reserve failures: 0 Total file capture size min: 0 Total file capture size max: 0 Total capture max before reserve: 0 Total file signature max: 0 Maximum buffers can allocate: 2 Number of buffers in use: 0 Number of buffers in free list: 1 Number of buffers in release list: 1 ======================================
As seen above snort only blocked 2 of 11. I am little confused about this and any help would be appreciated.
To clarify what I am asking: I want to block files using snorts file_preprocessor. This preprocessor not working as i wanted. As I showed details above i have a blacklisted file which i have tried to download 11 times an snort only blocked 2 of them. And this is my question how can I configure snort to make it block all of blacklistlisted files without randomness.