1

I am trying snorts file inspect preprocessor for blocking incoming files from their sha256sums. I am using snort version 2.9.9.0 with daq nfq inline mode any my file_inspect preprocessor configs are shown below:

config file: \
file_signature_depth 0, \
file_capture_memcap 1000, \
file_capture_max 4294967295, \
file_capture_block_size 500000000, \
file_capture_min 0

preprocessor file_inspect: \
    signature, \
    capture_disk /root/file_capture 1024, \
    blacklist sha_blacklist

After I run snort and downloaded 11 same files(648 bytes) snort exit stats outputs like that:

File Preprocessor Statistics
  Total file type callbacks:            0
  Total file signature callbacks:       2
  Total files would saved to disk:      2
  Total files saved to disk:            0
  Total file data saved to disk:        0         bytes
  Total files duplicated:               2
  Total files reserving failed:         0
  Total file capture min:               0
  Total file capture max:               0
  Total file capture memcap:            0
  Total files reading failed:           0
  Total file agent memcap failures:     0
  Total files sent:                     0
  Total file data sent:                 0
  Total file transfer failures:         0
============================================
File type stats:
         Type              Download   (Bytes)      Upload     (Bytes)
            Total          0          0            0          0

File signature stats:
         Type              Download   Upload
Undecided file type, continue...(  0)          2          0
            Total          2          0

File type verdicts:
        UNKNOWN:           0
            LOG:           0
           STOP:           0
          BLOCK:           0
         REJECT:           0
        PENDING:           0
   STOP CAPTURE:           0
          Total:           0

File signature verdicts:
        UNKNOWN:           0
            LOG:           0
           STOP:           0
          BLOCK:           2
         REJECT:           0
        PENDING:           0
   STOP CAPTURE:           0
          Total:           2

Total files processed:             11
Total files data processed:        7128      bytes
Total files buffered:              11
Total files released:              2
Total files freed:                 9
Total files captured:              2
Total files within one packet:     2
Total buffers allocated:           11
Total buffers freed:               9
Total buffers released:            2
Maximum file buffers used:         1
Total buffers free errors:         0
Total buffers release errors:      0
Total memcap failures:             0
Total memcap failures at reserve:  0
Total reserve failures:            0
Total file capture size min:       0
Total file capture size max:       0
Total capture max before reserve:  0
Total file signature max:          0
Maximum buffers can allocate:      2
Number of buffers in use:          0
Number of buffers in free list:    1
Number of buffers in release list: 1
======================================

As seen above snort only blocked 2 of 11. I am little confused about this and any help would be appreciated.

To clarify what I am asking: I want to block files using snorts file_preprocessor. This preprocessor not working as i wanted. As I showed details above i have a blacklisted file which i have tried to download 11 times an snort only blocked 2 of them. And this is my question how can I configure snort to make it block all of blacklistlisted files without randomness.

closed as unclear what you're asking by Tobi Nary, Xander, Steve, CaffeineAddiction, Bacon Brad Sep 11 '17 at 21:57

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • With your edit, this question does not belong here but rather on super user, as it's an application support question, not a security question. I'm voting to leave this closed. – Tobi Nary Sep 12 '17 at 6:12

Browse other questions tagged or ask your own question.