[Snort-devel] loopback network 127.0.0.0/8

Phil Wood cpw at ...86...
Fri Jul 27 15:25:07 EDT 2001


Folks,

I've been on a wild goose chase for about a week.  Snort (as recent as
yesterday) takes fragments of the interface tap, and, among other things,
changes the two "hi" order bytes of the source IP address from x.y to
127.?.  There are some other problems too.  

I came up with a hypothetical packet which I think snort should have generated
and should be compared to the snort generated packet 
(with exception of checksum) for corrected values.  It shows that the
Length, Ident, Offset, TTL, and Protocol are incorrect as well as the 
transport layer and data.

The "table" below is an interpretation of the real packets on the wire (w), 
snort generated packet (s), and my hypothetical packet (h).

The frag2 preprocessor was in use.

       V H TOS Length Ident Flg Off TTL Prot   CKS Source        Destination
w   ip:4 5   0   1500 16811 001   0 255 icmp 15539 192.16.20.241 128.165.194.27
       Type Code  CKS    Id sequence Data ...
  icmp:   0    0 1313   512    12845 00010203...bcbdbebf (1500-28) bytes

       V H TOS Length Ident Flg Off TTL Prot   CKS Source        Destination
w   ip:4 5   0     48 16811 000 185 255 icmp 24998 192.16.20.241 128.165.194.27
  data:c0c1c2c3...d8d9dadb (48-20) bytes

       V H TOS Length Ident Flg Off TTL Prot   CKS Source        Destination
s   ip:4 5   0     48  1528 000 185   0    0 24998 127.4.20.241  128.165.194.27
  junk: see below

       V H TOS Length Ident Flg Off TTL Prot   CKS Source        Destination
h   ip:4 5   0   1528 16811 000   0 255 icmp xxxxx 192.16.20.241 128.165.194.27
  icmp:Type Code  CKS    Id sequence Data ...
          0    0 xxxx   512   12845  00010203...d8d9dadb (1500) bytes

Below:

If you look close at the hex dumps you will see that the icmp header is
in the snort generated packet, shifted right  by 2 bytes leaving exposed the
beginning 2 bytes of data which were in the fragment.

Also, there are only 1,463 bytes of "data" in the packet starting with 00
and ending with b6.

Here is the hex for tcpdump packets on the wire and what snort generated
and recorded (-b) using the data.


TCPDUMP:

10:32:03.769712 P 192.16.20.241 > 128.165.194.27: icmp 1480 echo reply (frag 168
11:1480 at ...475...+)
  450005dc  41ab2000  ff013cb3  c01014f1  80a5c21b : E   A     <          :
  00000521  0200322d  00010203  04050607  08090a0b :    !  2-             :
  0c0d0e0f  10111213  14151617  18191a1b  1c1d1e1f :                      :
  20212223  24252627  28292a2b  2c2d2e2f  30313233 :  !"#$%&'()*+,-./0123 :
  34353637  38393a3b  3c3d3e3f  40414243  44454647 : 456789:;<=>?@ABCDEFG :
  48494a4b  4c4d4e4f  50515253  54555657  58595a5b : HIJKLMNOPQRSTUVWXYZ{ :
  5c5d5e5f  60616263  64656667  68696a6b  6c6d6e6f : \]^_`abcdefghijklmno :
  70717273  74757677  78797a7b  7c7d7e7f  80818283 : pqrstuvwxyz{|}~      :
  84858687  88898a8b  8c8d8e8f  90919293  94959697 :                      :
  98999a9b  9c9d9e9f  a0a1a2a3  a4a5a6a7  a8a9aaab :                      :
  acadaeaf  b0b1b2b3  b4b5b6b7  b8b9babb  bcbdbebf :                      :
  c0c1c2c3  c4c5c6c7  c8c9cacb  cccdcecf  d0d1d2d3 :                      :
  d4d5d6d7  d8d9dadb  dcdddedf  e0e1e2e3  e4e5e6e7 :                      :
  e8e9eaeb  ecedeeef  f0f1f2f3  f4f5f6f7  f8f9fafb :                      :
  fcfdfeff  00010203  04050607  08090a0b  0c0d0e0f :                      :
  10111213  14151617  18191a1b  1c1d1e1f  20212223 :                  !"# :
  24252627  28292a2b  2c2d2e2f  30313233  34353637 : $%&'()*+,-./01234567 :
  38393a3b  3c3d3e3f  40414243  44454647  48494a4b : 89:;<=>?@ABCDEFGHIJK :
  4c4d4e4f  50515253  54555657  58595a5b  5c5d5e5f : LMNOPQRSTUVWXYZ{\]^_ :
  60616263  64656667  68696a6b  6c6d6e6f  70717273 : `abcdefghijklmnopqrs :
  74757677  78797a7b  7c7d7e7f  80818283  84858687 : tuvwxyz{|}~          :
  88898a8b  8c8d8e8f  90919293  94959697  98999a9b :                      :
  9c9d9e9f  a0a1a2a3  a4a5a6a7  a8a9aaab  acadaeaf :                      :
  b0b1b2b3  b4b5b6b7  b8b9babb  bcbdbebf  c0c1c2c3 :                      :
  c4c5c6c7  c8c9cacb  cccdcecf  d0d1d2d3  d4d5d6d7 :                      :
  d8d9dadb  dcdddedf  e0e1e2e3  e4e5e6e7  e8e9eaeb :                      :
  ecedeeef  f0f1f2f3  f4f5f6f7  f8f9fafb  fcfdfeff :                      :
  00010203  04050607  08090a0b  0c0d0e0f  10111213 :                      :
  14151617  18191a1b  1c1d1e1f  20212223  24252627 :              !"#$%&' :
  28292a2b  2c2d2e2f  30313233  34353637  38393a3b : ()*+,-./0123456789:; :
  3c3d3e3f  40414243  44454647  48494a4b  4c4d4e4f : <=>?@ABCDEFGHIJKLMNO :
  50515253  54555657  58595a5b  5c5d5e5f  60616263 : PQRSTUVWXYZ{\]^_`abc :
  64656667  68696a6b  6c6d6e6f  70717273  74757677 : defghijklmnopqrstuvw :
  78797a7b  7c7d7e7f  80818283  84858687  88898a8b : xyz{|}~              :
  8c8d8e8f  90919293  94959697  98999a9b  9c9d9e9f :                      :
  a0a1a2a3  a4a5a6a7  a8a9aaab  acadaeaf  b0b1b2b3 :                      :
  b4b5b6b7  b8b9babb  bcbdbebf  c0c1c2c3  c4c5c6c7 :                      :
  c8c9cacb  cccdcecf  d0d1d2d3  d4d5d6d7  d8d9dadb :                      :
  dcdddedf  e0e1e2e3  e4e5e6e7  e8e9eaeb  ecedeeef :                      :
  f0f1f2f3  f4f5f6f7  f8f9fafb  fcfdfeff  00010203 :                      :
  04050607  08090a0b  0c0d0e0f  10111213  14151617 :                      :
  18191a1b  1c1d1e1f  20212223  24252627  28292a2b :          !"#$%&'()*+ :
  2c2d2e2f  30313233  34353637  38393a3b  3c3d3e3f : ,-./0123456789:;<=>? :
  40414243  44454647  48494a4b  4c4d4e4f  50515253 : @ABCDEFGHIJKLMNOPQRS :
  54555657  58595a5b  5c5d5e5f  60616263  64656667 : TUVWXYZ{\]^_`abcdefg :
  68696a6b  6c6d6e6f  70717273  74757677  78797a7b : hijklmnopqrstuvwxyz{ :
  7c7d7e7f  80818283  84858687  88898a8b  8c8d8e8f : |}~                  :
  90919293  94959697  98999a9b  9c9d9e9f  a0a1a2a3 :                      :
  a4a5a6a7  a8a9aaab  acadaeaf  b0b1b2b3  b4b5b6b7 :                      :
  b8b9babb  bcbdbebf  c0c1c2c3  c4c5c6c7  c8c9cacb :                      :
  cccdcecf  d0d1d2d3  d4d5d6d7  d8d9dadb  dcdddedf :                      :
  e0e1e2e3  e4e5e6e7  e8e9eaeb  ecedeeef  f0f1f2f3 :                      :
  f4f5f6f7  f8f9fafb  fcfdfeff  00010203  04050607 :                      :
  08090a0b  0c0d0e0f  10111213  14151617  18191a1b :                      :
  1c1d1e1f  20212223  24252627  28292a2b  2c2d2e2f :      !"#$%&'()*+,-./ :
  30313233  34353637  38393a3b  3c3d3e3f  40414243 : 0123456789:;<=>?@ABC :
  44454647  48494a4b  4c4d4e4f  50515253  54555657 : DEFGHIJKLMNOPQRSTUVW :
  58595a5b  5c5d5e5f  60616263  64656667  68696a6b : XYZ{\]^_`abcdefghijk :
  6c6d6e6f  70717273  74757677  78797a7b  7c7d7e7f : lmnopqrstuvwxyz{|}~  :
  80818283  84858687  88898a8b  8c8d8e8f  90919293 :                      :
  94959697  98999a9b  9c9d9e9f  a0a1a2a3  a4a5a6a7 :                      :
  a8a9aaab  acadaeaf  b0b1b2b3  b4b5b6b7  b8b9babb :                      :
  bcbdbebf  c0c1c2c3  c4c5c6c7  c8c9cacb  cccdcecf :                      :
  d0d1d2d3  d4d5d6d7  d8d9dadb  dcdddedf  e0e1e2e3 :                      :
  e4e5e6e7  e8e9eaeb  ecedeeef  f0f1f2f3  f4f5f6f7 :                      :
  f8f9fafb  fcfdfeff  00010203  04050607  08090a0b :                      :
  0c0d0e0f  10111213  14151617  18191a1b  1c1d1e1f :                      :
  20212223  24252627  28292a2b  2c2d2e2f  30313233 :  !"#$%&'()*+,-./0123 :
  34353637  38393a3b  3c3d3e3f  40414243  44454647 : 456789:;<=>?@ABCDEFG :
  48494a4b  4c4d4e4f  50515253  54555657  58595a5b : HIJKLMNOPQRSTUVWXYZ{ :
  5c5d5e5f  60616263  64656667  68696a6b  6c6d6e6f : \]^_`abcdefghijklmno :
  70717273  74757677  78797a7b  7c7d7e7f  80818283 : pqrstuvwxyz{|}~      :
  84858687  88898a8b  8c8d8e8f  90919293  94959697 :                      :
  98999a9b  9c9d9e9f  a0a1a2a3  a4a5a6a7  a8a9aaab :                      :
  acadaeaf  b0b1b2b3  b4b5b6b7  b8b9babb  bcbdbebf :                      :
10:32:03.769718 P 192.16.20.241 > 128.165.194.27: frag 28 (frag 16811:28 at ...575...)
  45000030  41ab00b9  ff0161a6  c01014f1  80a5c21b : E  0A     a          :
  c0c1c2c3  c4c5c6c7  c8c9cacb  cccdcecf  d0d1d2d3 :                      :
  d4d5d6d7  d8d9dadb 

SNORT:

10:32:03.769718 127.4.20.241 > 128.165.194.27: frag 28 (frag 1528:28 at ...575...) [ttl 0]
  45000030  05f800b9  000061a6  7f0414f1  80a5c21b : E  0      a          :
  c0c10000  05210200  322d0001  02030405  06070809 :      !  2-           :
  0a0b0c0d  0e0f1011  12131415  16171819  1a1b1c1d :                      :
  1e1f2021  22232425  26272829  2a2b2c2d  2e2f3031 :    !"#$%&'()*+,-./01 :
  32333435  36373839  3a3b3c3d  3e3f4041  42434445 : 23456789:;<=>?@ABCDE :
  46474849  4a4b4c4d  4e4f5051  52535455  56575859 : FGHIJKLMNOPQRSTUVWXY :
  5a5b5c5d  5e5f6061  62636465  66676869  6a6b6c6d : Z{\]^_`abcdefghijklm :
  6e6f7071  72737475  76777879  7a7b7c7d  7e7f8081 : nopqrstuvwxyz{|}~    :
  82838485  86878889  8a8b8c8d  8e8f9091  92939495 :                      :
  96979899  9a9b9c9d  9e9fa0a1  a2a3a4a5  a6a7a8a9 :                      :
  aaabacad  aeafb0b1  b2b3b4b5  b6b7b8b9  babbbcbd :                      :
  bebfc0c1  c2c3c4c5  c6c7c8c9  cacbcccd  cecfd0d1 :                      :
  d2d3d4d5  d6d7d8d9  dadbdcdd  dedfe0e1  e2e3e4e5 :                      :
  e6e7e8e9  eaebeced  eeeff0f1  f2f3f4f5  f6f7f8f9 :                      :
  fafbfcfd  feff0001  02030405  06070809  0a0b0c0d :                      :
  0e0f1011  12131415  16171819  1a1b1c1d  1e1f2021 :                    ! :
  22232425  26272829  2a2b2c2d  2e2f3031  32333435 : "#$%&'()*+,-./012345 :
  36373839  3a3b3c3d  3e3f4041  42434445  46474849 : 6789:;<=>?@ABCDEFGHI :
  4a4b4c4d  4e4f5051  52535455  56575859  5a5b5c5d : JKLMNOPQRSTUVWXYZ{\] :
  5e5f6061  62636465  66676869  6a6b6c6d  6e6f7071 : ^_`abcdefghijklmnopq :
  72737475  76777879  7a7b7c7d  7e7f8081  82838485 : rstuvwxyz{|}~        :
  86878889  8a8b8c8d  8e8f9091  92939495  96979899 :                      :
  9a9b9c9d  9e9fa0a1  a2a3a4a5  a6a7a8a9  aaabacad :                      :
  aeafb0b1  b2b3b4b5  b6b7b8b9  babbbcbd  bebfc0c1 :                      :
  c2c3c4c5  c6c7c8c9  cacbcccd  cecfd0d1  d2d3d4d5 :                      :
  d6d7d8d9  dadbdcdd  dedfe0e1  e2e3e4e5  e6e7e8e9 :                      :
  eaebeced  eeeff0f1  f2f3f4f5  f6f7f8f9  fafbfcfd :                      :
  feff0001  02030405  06070809  0a0b0c0d  0e0f1011 :                      :
  12131415  16171819  1a1b1c1d  1e1f2021  22232425 :                !"#$% :
  26272829  2a2b2c2d  2e2f3031  32333435  36373839 : &'()*+,-./0123456789 :
  3a3b3c3d  3e3f4041  42434445  46474849  4a4b4c4d : :;<=>?@ABCDEFGHIJKLM :
  4e4f5051  52535455  56575859  5a5b5c5d  5e5f6061 : NOPQRSTUVWXYZ{\]^_`a :
  62636465  66676869  6a6b6c6d  6e6f7071  72737475 : bcdefghijklmnopqrstu :
  76777879  7a7b7c7d  7e7f8081  82838485  86878889 : vwxyz{|}~            :
  8a8b8c8d  8e8f9091  92939495  96979899  9a9b9c9d :                      :
  9e9fa0a1  a2a3a4a5  a6a7a8a9  aaabacad  aeafb0b1 :                      :
  b2b3b4b5  b6b7b8b9  babbbcbd  bebfc0c1  c2c3c4c5 :                      :
  c6c7c8c9  cacbcccd  cecfd0d1  d2d3d4d5  d6d7d8d9 :                      :
  dadbdcdd  dedfe0e1  e2e3e4e5  e6e7e8e9  eaebeced :                      :
  eeeff0f1  f2f3f4f5  f6f7f8f9  fafbfcfd  feff0001 :                      :
  02030405  06070809  0a0b0c0d  0e0f1011  12131415 :                      :
  16171819  1a1b1c1d  1e1f2021  22232425  26272829 :            !"#$%&'() :
  2a2b2c2d  2e2f3031  32333435  36373839  3a3b3c3d : *+,-./0123456789:;<= :
  3e3f4041  42434445  46474849  4a4b4c4d  4e4f5051 : >?@ABCDEFGHIJKLMNOPQ :
  52535455  56575859  5a5b5c5d  5e5f6061  62636465 : RSTUVWXYZ{\]^_`abcde :
  66676869  6a6b6c6d  6e6f7071  72737475  76777879 : fghijklmnopqrstuvwxy :
  7a7b7c7d  7e7f8081  82838485  86878889  8a8b8c8d : z{|}~                :
  8e8f9091  92939495  96979899  9a9b9c9d  9e9fa0a1 :                      :
  a2a3a4a5  a6a7a8a9  aaabacad  aeafb0b1  b2b3b4b5 :                      :
  b6b7b8b9  babbbcbd  bebfc0c1  c2c3c4c5  c6c7c8c9 :                      :
  cacbcccd  cecfd0d1  d2d3d4d5  d6d7d8d9  dadbdcdd :                      :
  dedfe0e1  e2e3e4e5  e6e7e8e9  eaebeced  eeeff0f1 :                      :
  f2f3f4f5  f6f7f8f9  fafbfcfd  feff0001  02030405 :                      :
  06070809  0a0b0c0d  0e0f1011  12131415  16171819 :                      :
  1a1b1c1d  1e1f2021  22232425  26272829  2a2b2c2d :        !"#$%&'()*+,- :
  2e2f3031  32333435  36373839  3a3b3c3d  3e3f4041 : ./0123456789:;<=>?@A :
  42434445  46474849  4a4b4c4d  4e4f5051  52535455 : BCDEFGHIJKLMNOPQRSTU :
  56575859  5a5b5c5d  5e5f6061  62636465  66676869 : VWXYZ{\]^_`abcdefghi :
  6a6b6c6d  6e6f7071  72737475  76777879  7a7b7c7d : jklmnopqrstuvwxyz{|} :
  7e7f8081  82838485  86878889  8a8b8c8d  8e8f9091 : ~                    :
  92939495  96979899  9a9b9c9d  9e9fa0a1  a2a3a4a5 :                      :
  a6a7a8a9  aaabacad  aeafb0b1  b2b3b4b5  b6b7b8b9 :                      :
  babbbcbd  bebfc0c1  c2c3c4c5  c6c7c8c9  cacbcccd :                      :
  cecfd0d1  d2d3d4d5  d6d7d8d9  dadbdcdd  dedfe0e1 :                      :
  e2e3e4e5  e6e7e8e9  eaebeced  eeeff0f1  f2f3f4f5 :                      :
  f6f7f8f9  fafbfcfd  feff0001  02030405  06070809 :                      :
  0a0b0c0d  0e0f1011  12131415  16171819  1a1b1c1d :                      :
  1e1f2021  22232425  26272829  2a2b2c2d  2e2f3031 :    !"#$%&'()*+,-./01 :
  32333435  36373839  3a3b3c3d  3e3f4041  42434445 : 23456789:;<=>?@ABCDE :
  46474849  4a4b4c4d  4e4f5051  52535455  56575859 : FGHIJKLMNOPQRSTUVWXY :
  5a5b5c5d  5e5f6061  62636465  66676869  6a6b6c6d : Z{\]^_`abcdefghijklm :
  6e6f7071  72737475  76777879  7a7b7c7d  7e7f8081 : nopqrstuvwxyz{|}~    :
  82838485  86878889  8a8b8c8d  8e8f9091  92939495 :                      :
  96979899  9a9b9c9d  9e9fa0a1  a2a3a4a5  a6a7a8a9 :                      :
  aaabacad  aeafb0b1  b2b3b4b5  b6                 :                      :






More information about the Snort-devel mailing list