[Snort-devel] loopback network 127.0.0.0/8

Martin Roesch roesch at ...402...
Fri Jul 27 16:09:50 EDT 2001


Hi Phil,
  
     Do you have binary logs of the packets you've got for your example,
and if so can you send them to me so I can recreate the probelm and
track it down?  Additionally, what platform is this on?

    -Marty

 

Phil Wood wrote:
> 
> Folks,
> 
> I've been on a wild goose chase for about a week.  Snort (as recent as
> yesterday) takes fragments of the interface tap, and, among other things,
> changes the two "hi" order bytes of the source IP address from x.y to
> 127.?.  There are some other problems too.
> 
> I came up with a hypothetical packet which I think snort should have generated
> and should be compared to the snort generated packet
> (with exception of checksum) for corrected values.  It shows that the
> Length, Ident, Offset, TTL, and Protocol are incorrect as well as the
> transport layer and data.
> 
> The "table" below is an interpretation of the real packets on the wire (w),
> snort generated packet (s), and my hypothetical packet (h).
> 
> The frag2 preprocessor was in use.
> 
>        V H TOS Length Ident Flg Off TTL Prot   CKS Source        Destination
> w   ip:4 5   0   1500 16811 001   0 255 icmp 15539 192.16.20.241 128.165.194.27
>        Type Code  CKS    Id sequence Data ...
>   icmp:   0    0 1313   512    12845 00010203...bcbdbebf (1500-28) bytes
> 
>        V H TOS Length Ident Flg Off TTL Prot   CKS Source        Destination
> w   ip:4 5   0     48 16811 000 185 255 icmp 24998 192.16.20.241 128.165.194.27
>   data:c0c1c2c3...d8d9dadb (48-20) bytes
> 
>        V H TOS Length Ident Flg Off TTL Prot   CKS Source        Destination
> s   ip:4 5   0     48  1528 000 185   0    0 24998 127.4.20.241  128.165.194.27
>   junk: see below
> 
>        V H TOS Length Ident Flg Off TTL Prot   CKS Source        Destination
> h   ip:4 5   0   1528 16811 000   0 255 icmp xxxxx 192.16.20.241 128.165.194.27
>   icmp:Type Code  CKS    Id sequence Data ...
>           0    0 xxxx   512   12845  00010203...d8d9dadb (1500) bytes
> 
> Below:
> 
> If you look close at the hex dumps you will see that the icmp header is
> in the snort generated packet, shifted right  by 2 bytes leaving exposed the
> beginning 2 bytes of data which were in the fragment.
> 
> Also, there are only 1,463 bytes of "data" in the packet starting with 00
> and ending with b6.
> 
> Here is the hex for tcpdump packets on the wire and what snort generated
> and recorded (-b) using the data.
> 
> TCPDUMP:
> 
> 10:32:03.769712 P 192.16.20.241 > 128.165.194.27: icmp 1480 echo reply (frag 168
> 11:1480 at ...475...+)
>   450005dc  41ab2000  ff013cb3  c01014f1  80a5c21b : E   A     <          :
>   00000521  0200322d  00010203  04050607  08090a0b :    !  2-             :
>   0c0d0e0f  10111213  14151617  18191a1b  1c1d1e1f :                      :
>   20212223  24252627  28292a2b  2c2d2e2f  30313233 :  !"#$%&'()*+,-./0123 :
>   34353637  38393a3b  3c3d3e3f  40414243  44454647 : 456789:;<=>?@ABCDEFG :
>   48494a4b  4c4d4e4f  50515253  54555657  58595a5b : HIJKLMNOPQRSTUVWXYZ{ :
>   5c5d5e5f  60616263  64656667  68696a6b  6c6d6e6f : \]^_`abcdefghijklmno :
>   70717273  74757677  78797a7b  7c7d7e7f  80818283 : pqrstuvwxyz{|}~      :
>   84858687  88898a8b  8c8d8e8f  90919293  94959697 :                      :
>   98999a9b  9c9d9e9f  a0a1a2a3  a4a5a6a7  a8a9aaab :                      :
>   acadaeaf  b0b1b2b3  b4b5b6b7  b8b9babb  bcbdbebf :                      :
>   c0c1c2c3  c4c5c6c7  c8c9cacb  cccdcecf  d0d1d2d3 :                      :
>   d4d5d6d7  d8d9dadb  dcdddedf  e0e1e2e3  e4e5e6e7 :                      :
>   e8e9eaeb  ecedeeef  f0f1f2f3  f4f5f6f7  f8f9fafb :                      :
>   fcfdfeff  00010203  04050607  08090a0b  0c0d0e0f :                      :
>   10111213  14151617  18191a1b  1c1d1e1f  20212223 :                  !"# :
>   24252627  28292a2b  2c2d2e2f  30313233  34353637 : $%&'()*+,-./01234567 :
>   38393a3b  3c3d3e3f  40414243  44454647  48494a4b : 89:;<=>?@ABCDEFGHIJK :
>   4c4d4e4f  50515253  54555657  58595a5b  5c5d5e5f : LMNOPQRSTUVWXYZ{\]^_ :
>   60616263  64656667  68696a6b  6c6d6e6f  70717273 : `abcdefghijklmnopqrs :
>   74757677  78797a7b  7c7d7e7f  80818283  84858687 : tuvwxyz{|}~          :
>   88898a8b  8c8d8e8f  90919293  94959697  98999a9b :                      :
>   9c9d9e9f  a0a1a2a3  a4a5a6a7  a8a9aaab  acadaeaf :                      :
>   b0b1b2b3  b4b5b6b7  b8b9babb  bcbdbebf  c0c1c2c3 :                      :
>   c4c5c6c7  c8c9cacb  cccdcecf  d0d1d2d3  d4d5d6d7 :                      :
>   d8d9dadb  dcdddedf  e0e1e2e3  e4e5e6e7  e8e9eaeb :                      :
>   ecedeeef  f0f1f2f3  f4f5f6f7  f8f9fafb  fcfdfeff :                      :
>   00010203  04050607  08090a0b  0c0d0e0f  10111213 :                      :
>   14151617  18191a1b  1c1d1e1f  20212223  24252627 :              !"#$%&' :
>   28292a2b  2c2d2e2f  30313233  34353637  38393a3b : ()*+,-./0123456789:; :
>   3c3d3e3f  40414243  44454647  48494a4b  4c4d4e4f : <=>?@ABCDEFGHIJKLMNO :
>   50515253  54555657  58595a5b  5c5d5e5f  60616263 : PQRSTUVWXYZ{\]^_`abc :
>   64656667  68696a6b  6c6d6e6f  70717273  74757677 : defghijklmnopqrstuvw :
>   78797a7b  7c7d7e7f  80818283  84858687  88898a8b : xyz{|}~              :
>   8c8d8e8f  90919293  94959697  98999a9b  9c9d9e9f :                      :
>   a0a1a2a3  a4a5a6a7  a8a9aaab  acadaeaf  b0b1b2b3 :                      :
>   b4b5b6b7  b8b9babb  bcbdbebf  c0c1c2c3  c4c5c6c7 :                      :
>   c8c9cacb  cccdcecf  d0d1d2d3  d4d5d6d7  d8d9dadb :                      :
>   dcdddedf  e0e1e2e3  e4e5e6e7  e8e9eaeb  ecedeeef :                      :
>   f0f1f2f3  f4f5f6f7  f8f9fafb  fcfdfeff  00010203 :                      :
>   04050607  08090a0b  0c0d0e0f  10111213  14151617 :                      :
>   18191a1b  1c1d1e1f  20212223  24252627  28292a2b :          !"#$%&'()*+ :
>   2c2d2e2f  30313233  34353637  38393a3b  3c3d3e3f : ,-./0123456789:;<=>? :
>   40414243  44454647  48494a4b  4c4d4e4f  50515253 : @ABCDEFGHIJKLMNOPQRS :
>   54555657  58595a5b  5c5d5e5f  60616263  64656667 : TUVWXYZ{\]^_`abcdefg :
>   68696a6b  6c6d6e6f  70717273  74757677  78797a7b : hijklmnopqrstuvwxyz{ :
>   7c7d7e7f  80818283  84858687  88898a8b  8c8d8e8f : |}~                  :
>   90919293  94959697  98999a9b  9c9d9e9f  a0a1a2a3 :                      :
>   a4a5a6a7  a8a9aaab  acadaeaf  b0b1b2b3  b4b5b6b7 :                      :
>   b8b9babb  bcbdbebf  c0c1c2c3  c4c5c6c7  c8c9cacb :                      :
>   cccdcecf  d0d1d2d3  d4d5d6d7  d8d9dadb  dcdddedf :                      :
>   e0e1e2e3  e4e5e6e7  e8e9eaeb  ecedeeef  f0f1f2f3 :                      :
>   f4f5f6f7  f8f9fafb  fcfdfeff  00010203  04050607 :                      :
>   08090a0b  0c0d0e0f  10111213  14151617  18191a1b :                      :
>   1c1d1e1f  20212223  24252627  28292a2b  2c2d2e2f :      !"#$%&'()*+,-./ :
>   30313233  34353637  38393a3b  3c3d3e3f  40414243 : 0123456789:;<=>?@ABC :
>   44454647  48494a4b  4c4d4e4f  50515253  54555657 : DEFGHIJKLMNOPQRSTUVW :
>   58595a5b  5c5d5e5f  60616263  64656667  68696a6b : XYZ{\]^_`abcdefghijk :
>   6c6d6e6f  70717273  74757677  78797a7b  7c7d7e7f : lmnopqrstuvwxyz{|}~  :
>   80818283  84858687  88898a8b  8c8d8e8f  90919293 :                      :
>   94959697  98999a9b  9c9d9e9f  a0a1a2a3  a4a5a6a7 :                      :
>   a8a9aaab  acadaeaf  b0b1b2b3  b4b5b6b7  b8b9babb :                      :
>   bcbdbebf  c0c1c2c3  c4c5c6c7  c8c9cacb  cccdcecf :                      :
>   d0d1d2d3  d4d5d6d7  d8d9dadb  dcdddedf  e0e1e2e3 :                      :
>   e4e5e6e7  e8e9eaeb  ecedeeef  f0f1f2f3  f4f5f6f7 :                      :
>   f8f9fafb  fcfdfeff  00010203  04050607  08090a0b :                      :
>   0c0d0e0f  10111213  14151617  18191a1b  1c1d1e1f :                      :
>   20212223  24252627  28292a2b  2c2d2e2f  30313233 :  !"#$%&'()*+,-./0123 :
>   34353637  38393a3b  3c3d3e3f  40414243  44454647 : 456789:;<=>?@ABCDEFG :
>   48494a4b  4c4d4e4f  50515253  54555657  58595a5b : HIJKLMNOPQRSTUVWXYZ{ :
>   5c5d5e5f  60616263  64656667  68696a6b  6c6d6e6f : \]^_`abcdefghijklmno :
>   70717273  74757677  78797a7b  7c7d7e7f  80818283 : pqrstuvwxyz{|}~      :
>   84858687  88898a8b  8c8d8e8f  90919293  94959697 :                      :
>   98999a9b  9c9d9e9f  a0a1a2a3  a4a5a6a7  a8a9aaab :                      :
>   acadaeaf  b0b1b2b3  b4b5b6b7  b8b9babb  bcbdbebf :                      :
> 10:32:03.769718 P 192.16.20.241 > 128.165.194.27: frag 28 (frag 16811:28 at ...575...)
>   45000030  41ab00b9  ff0161a6  c01014f1  80a5c21b : E  0A     a          :
>   c0c1c2c3  c4c5c6c7  c8c9cacb  cccdcecf  d0d1d2d3 :                      :
>   d4d5d6d7  d8d9dadb
> 
> SNORT:
> 
> 10:32:03.769718 127.4.20.241 > 128.165.194.27: frag 28 (frag 1528:28 at ...575...) [ttl 0]
>   45000030  05f800b9  000061a6  7f0414f1  80a5c21b : E  0      a          :
>   c0c10000  05210200  322d0001  02030405  06070809 :      !  2-           :
>   0a0b0c0d  0e0f1011  12131415  16171819  1a1b1c1d :                      :
>   1e1f2021  22232425  26272829  2a2b2c2d  2e2f3031 :    !"#$%&'()*+,-./01 :
>   32333435  36373839  3a3b3c3d  3e3f4041  42434445 : 23456789:;<=>?@ABCDE :
>   46474849  4a4b4c4d  4e4f5051  52535455  56575859 : FGHIJKLMNOPQRSTUVWXY :
>   5a5b5c5d  5e5f6061  62636465  66676869  6a6b6c6d : Z{\]^_`abcdefghijklm :
>   6e6f7071  72737475  76777879  7a7b7c7d  7e7f8081 : nopqrstuvwxyz{|}~    :
>   82838485  86878889  8a8b8c8d  8e8f9091  92939495 :                      :
>   96979899  9a9b9c9d  9e9fa0a1  a2a3a4a5  a6a7a8a9 :                      :
>   aaabacad  aeafb0b1  b2b3b4b5  b6b7b8b9  babbbcbd :                      :
>   bebfc0c1  c2c3c4c5  c6c7c8c9  cacbcccd  cecfd0d1 :                      :
>   d2d3d4d5  d6d7d8d9  dadbdcdd  dedfe0e1  e2e3e4e5 :                      :
>   e6e7e8e9  eaebeced  eeeff0f1  f2f3f4f5  f6f7f8f9 :                      :
>   fafbfcfd  feff0001  02030405  06070809  0a0b0c0d :                      :
>   0e0f1011  12131415  16171819  1a1b1c1d  1e1f2021 :                    ! :
>   22232425  26272829  2a2b2c2d  2e2f3031  32333435 : "#$%&'()*+,-./012345 :
>   36373839  3a3b3c3d  3e3f4041  42434445  46474849 : 6789:;<=>?@ABCDEFGHI :
>   4a4b4c4d  4e4f5051  52535455  56575859  5a5b5c5d : JKLMNOPQRSTUVWXYZ{\] :
>   5e5f6061  62636465  66676869  6a6b6c6d  6e6f7071 : ^_`abcdefghijklmnopq :
>   72737475  76777879  7a7b7c7d  7e7f8081  82838485 : rstuvwxyz{|}~        :
>   86878889  8a8b8c8d  8e8f9091  92939495  96979899 :                      :
>   9a9b9c9d  9e9fa0a1  a2a3a4a5  a6a7a8a9  aaabacad :                      :
>   aeafb0b1  b2b3b4b5  b6b7b8b9  babbbcbd  bebfc0c1 :                      :
>   c2c3c4c5  c6c7c8c9  cacbcccd  cecfd0d1  d2d3d4d5 :                      :
>   d6d7d8d9  dadbdcdd  dedfe0e1  e2e3e4e5  e6e7e8e9 :                      :
>   eaebeced  eeeff0f1  f2f3f4f5  f6f7f8f9  fafbfcfd :                      :
>   feff0001  02030405  06070809  0a0b0c0d  0e0f1011 :                      :
>   12131415  16171819  1a1b1c1d  1e1f2021  22232425 :                !"#$% :
>   26272829  2a2b2c2d  2e2f3031  32333435  36373839 : &'()*+,-./0123456789 :
>   3a3b3c3d  3e3f4041  42434445  46474849  4a4b4c4d : :;<=>?@ABCDEFGHIJKLM :
>   4e4f5051  52535455  56575859  5a5b5c5d  5e5f6061 : NOPQRSTUVWXYZ{\]^_`a :
>   62636465  66676869  6a6b6c6d  6e6f7071  72737475 : bcdefghijklmnopqrstu :
>   76777879  7a7b7c7d  7e7f8081  82838485  86878889 : vwxyz{|}~            :
>   8a8b8c8d  8e8f9091  92939495  96979899  9a9b9c9d :                      :
>   9e9fa0a1  a2a3a4a5  a6a7a8a9  aaabacad  aeafb0b1 :                      :
>   b2b3b4b5  b6b7b8b9  babbbcbd  bebfc0c1  c2c3c4c5 :                      :
>   c6c7c8c9  cacbcccd  cecfd0d1  d2d3d4d5  d6d7d8d9 :                      :
>   dadbdcdd  dedfe0e1  e2e3e4e5  e6e7e8e9  eaebeced :                      :
>   eeeff0f1  f2f3f4f5  f6f7f8f9  fafbfcfd  feff0001 :                      :
>   02030405  06070809  0a0b0c0d  0e0f1011  12131415 :                      :
>   16171819  1a1b1c1d  1e1f2021  22232425  26272829 :            !"#$%&'() :
>   2a2b2c2d  2e2f3031  32333435  36373839  3a3b3c3d : *+,-./0123456789:;<= :
>   3e3f4041  42434445  46474849  4a4b4c4d  4e4f5051 : >?@ABCDEFGHIJKLMNOPQ :
>   52535455  56575859  5a5b5c5d  5e5f6061  62636465 : RSTUVWXYZ{\]^_`abcde :
>   66676869  6a6b6c6d  6e6f7071  72737475  76777879 : fghijklmnopqrstuvwxy :
>   7a7b7c7d  7e7f8081  82838485  86878889  8a8b8c8d : z{|}~                :
>   8e8f9091  92939495  96979899  9a9b9c9d  9e9fa0a1 :                      :
>   a2a3a4a5  a6a7a8a9  aaabacad  aeafb0b1  b2b3b4b5 :                      :
>   b6b7b8b9  babbbcbd  bebfc0c1  c2c3c4c5  c6c7c8c9 :                      :
>   cacbcccd  cecfd0d1  d2d3d4d5  d6d7d8d9  dadbdcdd :                      :
>   dedfe0e1  e2e3e4e5  e6e7e8e9  eaebeced  eeeff0f1 :                      :
>   f2f3f4f5  f6f7f8f9  fafbfcfd  feff0001  02030405 :                      :
>   06070809  0a0b0c0d  0e0f1011  12131415  16171819 :                      :
>   1a1b1c1d  1e1f2021  22232425  26272829  2a2b2c2d :        !"#$%&'()*+,- :
>   2e2f3031  32333435  36373839  3a3b3c3d  3e3f4041 : ./0123456789:;<=>?@A :
>   42434445  46474849  4a4b4c4d  4e4f5051  52535455 : BCDEFGHIJKLMNOPQRSTU :
>   56575859  5a5b5c5d  5e5f6061  62636465  66676869 : VWXYZ{\]^_`abcdefghi :
>   6a6b6c6d  6e6f7071  72737475  76777879  7a7b7c7d : jklmnopqrstuvwxyz{|} :
>   7e7f8081  82838485  86878889  8a8b8c8d  8e8f9091 : ~                    :
>   92939495  96979899  9a9b9c9d  9e9fa0a1  a2a3a4a5 :                      :
>   a6a7a8a9  aaabacad  aeafb0b1  b2b3b4b5  b6b7b8b9 :                      :
>   babbbcbd  bebfc0c1  c2c3c4c5  c6c7c8c9  cacbcccd :                      :
>   cecfd0d1  d2d3d4d5  d6d7d8d9  dadbdcdd  dedfe0e1 :                      :
>   e2e3e4e5  e6e7e8e9  eaebeced  eeeff0f1  f2f3f4f5 :                      :
>   f6f7f8f9  fafbfcfd  feff0001  02030405  06070809 :                      :
>   0a0b0c0d  0e0f1011  12131415  16171819  1a1b1c1d :                      :
>   1e1f2021  22232425  26272829  2a2b2c2d  2e2f3031 :    !"#$%&'()*+,-./01 :
>   32333435  36373839  3a3b3c3d  3e3f4041  42434445 : 23456789:;<=>?@ABCDE :
>   46474849  4a4b4c4d  4e4f5051  52535455  56575859 : FGHIJKLMNOPQRSTUVWXY :
>   5a5b5c5d  5e5f6061  62636465  66676869  6a6b6c6d : Z{\]^_`abcdefghijklm :
>   6e6f7071  72737475  76777879  7a7b7c7d  7e7f8081 : nopqrstuvwxyz{|}~    :
>   82838485  86878889  8a8b8c8d  8e8f9091  92939495 :                      :
>   96979899  9a9b9c9d  9e9fa0a1  a2a3a4a5  a6a7a8a9 :                      :
>   aaabacad  aeafb0b1  b2b3b4b5  b6                 :                      :
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> http://lists.sourceforge.net/lists/listinfo/snort-devel

--
Martin Roesch
roesch at ...402...
http://www.sourcefire.com - http://www.snort.org




More information about the Snort-devel mailing list