From whatever I have read of Snort, it can analyse a single packet at a time and raise an alert based on its rules.

What if I wish to have a rule based on multiple packets such as analysis of a protocol situation that can maintain its states, e.g. TCP or TLS?

I am curious to know if I can select a group of packets that is part of a specific session using snort rules. I would like to analyse the contents of the packets with respect to the packets already received in order to prove or reject certain assumptions. E.g. Did the packets arrive with correct parameters and in order as expected by the protocol template?

Thanks to some feedback, I am trying to put out a detailed sketch of the problem. Here it is :

Let's assume a three-step protocol :

Message 1: Client -> Server : Hello, CS1

Message 2: Server -> Client : Hi, CS2, SS1

Message 3: Client -> Server : Wow, SS2

where :

CS1 is Client Secret encrypted with Server public key

CS2 is Client Secret encrypted with client public key

SS1 is Server Secret encrypted with client public key

SS2 is Server Secret encrypted with Server public key

After the protocol run, both the parties are assured that they are talking to the legitimate partners. For now, I am ruling out the attacks.

Using Snort, I want to check the contents of the packets in order to see if any of the messages e.g. CS1/CS2/SS1/SS2 etc are ever replayed or check if all the messages followed the given ordered sequence (1,2,3) or not etc.

  • 2
    In general snort is not restricted to analyzing a single packet out of any context but can analyze TCP flows and also pick up at which state some application protocols are. It is unclear though if one can implement rules for your specific use cases since practically no detail is known about these use cases. I suggest you edit the answer to detail a specific rule you would like to have. – Steffen Ullrich Jun 8 '19 at 20:07
  • Thanks, Steffen. I have edited the question now. I believe that's what you meant :-) – Raj Jun 10 '19 at 19:05
  • I think this is still a too broad description. Don't you have a specific problem you want to solve? In general you can apply rules not only against single packets on the wire but against reassembled streams - see snort.org/faq/readme-stream5. – Steffen Ullrich Jun 10 '19 at 19:21
  • it would help if you could provide a pcap file and explain what you wan to detect. – camp0 Jun 10 '19 at 19:32
  • You might like to investigate what Snort and Suricata call flowbits. These allow you to combine multiple rules In creative ways. However, to fully answer this question needs some more details. – David Jun 10 '19 at 21:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.