0

I have built two simple rules

alert tcp any any -> any any (msg: "tcp detected"; sid: 2; rev: 1;)
alert udp any any -> any any (msg: "udp detected"; sid: 1; rev: 1;)

Then from the same machine I do an nmap

nmap -sU myipaddress

Issue is, I get alerts from all other traffic but for the nmap I do not get any alerts. Does suricata have a rule to ignore the kind of traffic that destination ip = origin ip?

  • That scan would be routed over the local loopback device. Is that device monitored? – Tobi Nary Nov 13 '17 at 4:50
1

Please check that you are sniffing the correct interface. nmap traffic may go on loopback one (using routing information) and you may sniffing the external iface.

If interface is correct and if you are using pcap capture you may want to add '-k none' option to avoid checksum offloading related problem. Missing alerts often comes because suricata will ignore packets with invalid checksum. And checksum offloading on the card will cause that for locally emitted packets. So when you are using local traffic to test traffic you should take care of that. Solution is to used modern capture method like af_packet or pass '-k none' to stop validating checksum.

  • That seems to be exactly my comment as an answer, but it does not answer the question. – Tobi Nary Nov 13 '17 at 8:52
  • Indeed on first part of answer, sorry to have missed that. – Regit Nov 13 '17 at 9:09
  • 1
    Could you elaborate on the second part as to how that is relevant to answering the question exactly? – Tobi Nary Nov 13 '17 at 9:12
  • Mising alerts often comes because suricata will ignore packets with invalid checksum. And checksum offloading on the card will cause that for locally emitted packets. So when you are using local traffic to test traffic you should take care of that. Solution is to used modern capture method like af_packet or pass '-k none' to stop vaiating checksum. – Regit Nov 13 '17 at 9:17
  • Could you edit that into the answer? security.stackexchange.com/posts/173358/edit – Tobi Nary Nov 13 '17 at 9:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.