I have a python code on Linux to create a raw packet:

import socket

s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP)
s.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)

ip_header  = b'\x45\x00\x00\x28'
ip_header += b'\xab\xcd\x00\x00'
ip_header += b'\x40\x06\xa6\xec'
ip_header += b'\x0a\x0a\x0a\x02'
ip_header += b'\x0a\x0a\x0a\x01'

tcp_header  = b'\x13\x97\x00\x50'
tcp_header += b'\x00\x00\x00\x00'
tcp_header += b'\x00\x00\x00\x00'
tcp_header += b'\x50\x02\x71\x10'
tcp_header += b'\xe6\x32\x00\x00'
tcp_header += b'GGG' # Data

packet = ip_header + tcp_header

s.sendto(packet, ('', 1))

When I run Snort without any rule sudo snort it captures created packet with the code mentioned above.

Commencing packet processing (pid=11114)
12/30-16:01:53.900763 ->
TCP TTL:64 TOS:0x0 ID:43981 IpLen:20 DgmLen:43
******S* Seq: 0x0  Ack: 0x0  Win: 0x7110  TcpLen: 20

but Snort does not capture anything when I run this command:

sudo snort -c local.rules -A console

My ‍‍‍‍‍‍local.rules contains this rule:

alert tcp any any -> any any (msg:"TCP CAPTURED"; sid:1000001;)

This rule captures all tcp packets successfully, and alert with massage TCP CAPTURED but does not capture the packet created by the above code.


You must log in to answer this question.

Browse other questions tagged .