1

I have a python code on Linux to create a raw packet:

import socket

s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP)
s.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)

ip_header  = b'\x45\x00\x00\x28'
ip_header += b'\xab\xcd\x00\x00'
ip_header += b'\x40\x06\xa6\xec'
ip_header += b'\x0a\x0a\x0a\x02'
ip_header += b'\x0a\x0a\x0a\x01'

tcp_header  = b'\x13\x97\x00\x50'
tcp_header += b'\x00\x00\x00\x00'
tcp_header += b'\x00\x00\x00\x00'
tcp_header += b'\x50\x02\x71\x10'
tcp_header += b'\xe6\x32\x00\x00'
tcp_header += b'GGG' # Data

packet = ip_header + tcp_header


s.sendto(packet, ('10.10.10.1', 1))

When I run Snort without any rule sudo snort it captures created packet with the code mentioned above.

Commencing packet processing (pid=11114)
12/30-16:01:53.900763 10.10.10.2:5015 -> 10.10.10.1:80
TCP TTL:64 TOS:0x0 ID:43981 IpLen:20 DgmLen:43
******S* Seq: 0x0  Ack: 0x0  Win: 0x7110  TcpLen: 20

but Snort does not capture anything when I run this command:

sudo snort -c local.rules -A console

My ‍‍‍‍‍‍local.rules contains this rule:

alert tcp any any -> any any (msg:"TCP CAPTURED"; sid:1000001;)

This rule captures all tcp packets successfully, and alert with massage TCP CAPTURED but does not capture the packet created by the above code.

0

You must log in to answer this question.

Browse other questions tagged .