1

I am trying snorts file inspect preprocessor for blocking incoming files from their sha256sums. I am using snort version 2.9.9.0 with daq nfq inline mode any my file_inspect preprocessor configs are shown below:

config file: \
file_signature_depth 0, \
file_capture_memcap 1000, \
file_capture_max 4294967295, \
file_capture_block_size 500000000, \
file_capture_min 0

preprocessor file_inspect: \
    signature, \
    capture_disk /root/file_capture 1024, \
    blacklist sha_blacklist

After I run snort and downloaded 11 same files(648 bytes) snort exit stats outputs like that:

File Preprocessor Statistics
  Total file type callbacks:            0
  Total file signature callbacks:       2
  Total files would saved to disk:      2
  Total files saved to disk:            0
  Total file data saved to disk:        0         bytes
  Total files duplicated:               2
  Total files reserving failed:         0
  Total file capture min:               0
  Total file capture max:               0
  Total file capture memcap:            0
  Total files reading failed:           0
  Total file agent memcap failures:     0
  Total files sent:                     0
  Total file data sent:                 0
  Total file transfer failures:         0
============================================
File type stats:
         Type              Download   (Bytes)      Upload     (Bytes)
            Total          0          0            0          0

File signature stats:
         Type              Download   Upload
Undecided file type, continue...(  0)          2          0
            Total          2          0

File type verdicts:
        UNKNOWN:           0
            LOG:           0
           STOP:           0
          BLOCK:           0
         REJECT:           0
        PENDING:           0
   STOP CAPTURE:           0
          Total:           0

File signature verdicts:
        UNKNOWN:           0
            LOG:           0
           STOP:           0
          BLOCK:           2
         REJECT:           0
        PENDING:           0
   STOP CAPTURE:           0
          Total:           2

Total files processed:             11
Total files data processed:        7128      bytes
Total files buffered:              11
Total files released:              2
Total files freed:                 9
Total files captured:              2
Total files within one packet:     2
Total buffers allocated:           11
Total buffers freed:               9
Total buffers released:            2
Maximum file buffers used:         1
Total buffers free errors:         0
Total buffers release errors:      0
Total memcap failures:             0
Total memcap failures at reserve:  0
Total reserve failures:            0
Total file capture size min:       0
Total file capture size max:       0
Total capture max before reserve:  0
Total file signature max:          0
Maximum buffers can allocate:      2
Number of buffers in use:          0
Number of buffers in free list:    1
Number of buffers in release list: 1
======================================

As seen above snort only blocked 2 of 11. I am little confused about this and any help would be appreciated.

To clarify what I am asking: I want to block files using snorts file_preprocessor. This preprocessor not working as i wanted. As I showed details above i have a blacklisted file which i have tried to download 11 times an snort only blocked 2 of them. And this is my question how can I configure snort to make it block all of blacklistlisted files without randomness.

  • With your edit, this question does not belong here but rather on super user, as it's an application support question, not a security question. I'm voting to leave this closed. – Tobi Nary Sep 12 '17 at 6:12

Browse other questions tagged or ask your own question.