Snort: Arpspoof preprocessor events not showing up in BASE UI

Question

I have followed this guide to install Snort, using Barnyard2, BASE, IIS, and MySql.

My Snort is up & running and loads of events are being logged. After weeding out some false positives, I wanted to test the arpspoof preprocessor.

So I enabled:

preprocessor arpspoof
preprocessor arpspoof_detect_host: 192.168.1.1 58:6d:8f:a0:40:7f
preprocessor arpspoof_detect_host: 192.168.1.3 d4:3d:7e:38:37:4d

And ran an arp attack using ettercap. The problem is that these events do not show up in my winids (and neither in mysql database). It seems to be a similar problem to this one.

Now, Ive checked my barnyard output window, and the ettercap events DO show up there (see screenshot), they are just not shown in the BASE UI. My feeling is thus that it is a formatting issue: the arpspoof preprocessor outputs the events in a format which barnyard cannot log to mySQL OR which is incompatible with the BASE interface. Does anyone have an idea how to solve this?

Answer 1

After some debugging, I've found that the issue is due to the BASE caching code. It looks (among others) for '(spp_%' instead of 'spp_%', which is the correct start of the arpspoof preprocessor signature name. So i changed the part of the query that is created from line 234 in base_cache.inc.php:

  /* Preprocessor events only */
  # The original "(sig_name LIKE '(spp_%')" is too limited. Cf.
  # /usr/local/src/snort-2.8.3.1_unpatched/etc/gen-msg.map
  # /usr/local/src/snort-2.8.3.1_unpatched/src/generators.h
  # Currently I have included all the names that I have found in 
  # these files.
  # Note: Do always add '%' in LIKE-statements. Otherwise the entries
  #       won't match.
  if ( $db->baseGetDBversion() >= 100 ) {
    $schema_specific[3] = " ( " . 
                          "(sig_name LIKE '(spp_%') OR " . 
                          "(sig_name LIKE '(spo_%') OR " . 
                          "(sig_name LIKE '(snort_decoder)%') OR " .
                          "(sig_name LIKE '(http_decode)%') OR " . 
                          "(sig_name LIKE '(http_inspect)%') OR " . 
                          "(sig_name LIKE '(portscan)%') OR " . 
                          "(sig_name LIKE '(flow-portscan)%') OR " . 
                          "(sig_name LIKE '(frag3)%') OR " . 
                          "(sig_name LIKE '(smtp)%') OR " .
                          "(sig_name LIKE '(ftp_pp)%') OR " . 
                          "(sig_name LIKE '(telnet_pp)%') OR " .
                          "(sig_name LIKE '(ssh)%') OR " .
                          "(sig_name LIKE '(stream5)%') OR " . 
                          "(sig_name LIKE '(dcerpc)%') OR " .
                          "(sig_name LIKE '(dns)%') OR " . 
                          "(sig_name LIKE '(ppm)%') OR " .
                          "(sig_name LIKE 'spp_%') OR " . 
                          "(sig_name LIKE 'spo_%') OR " . 
                          "(sig_name LIKE 'snort_decoder%') OR " .
                          "(sig_name LIKE 'http_decode%') OR " . 
                          "(sig_name LIKE 'http_inspect%') OR " . 
                          "(sig_name LIKE 'portscan%') OR " . 
                          "(sig_name LIKE 'flow-portscan%') OR " . 
                          "(sig_name LIKE 'frag3%') OR " . 
                          "(sig_name LIKE 'smtp%') OR " .
                          "(sig_name LIKE 'ftp_pp%') OR " . 
                          "(sig_name LIKE 'telnet_pp%') OR " .
                          "(sig_name LIKE 'ssh%') OR " .
                          "(sig_name LIKE 'stream5%') OR " . 
                          "(sig_name LIKE 'dcerpc%') OR " .
                          "(sig_name LIKE 'dns%') OR " . 
                          "(sig_name LIKE 'ppm%') " .
                          " ) ";    

And all events are logged now.