[Snort-devel] Flowbits Set and Not Checked Against SRC/DST Networks

Martin Holste mcholste at ...2499...
Mon Jun 27 12:15:10 EDT 2011


Hm, forgot about stateless.  Eoin, do you recall if we tried stateless
as opposed to flags:S to improve performance over flags:A+?  I would
think that stateless=flags:S for our purposes.

On Mon, Jun 27, 2011 at 11:09 AM, beenph <beenph at ...2499...> wrote:
> On Fri, Jun 24, 2011 at 4:10 PM, Eoin Miller
> <eoin.miller at ...3055...> wrote:
>> We were having some issues when setting flowbits for sessions based upon IP lists. I think I have narrowed down the problem after creating and running these rules:
>>
>> alert tcp $HOME_NET any <> [127.0.0.1,127.0.0.2,127.0.0.3,127.1.0.0/24,127.2.0.0/24,127.127.0.0/16] any (msg:"TEST talking to localhost"; flags:S; flowbits:set,AOL.test; classtype:bad-unknown; sid:7000004; rev:1;)
>> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"TEST http_uri to localhost"; flowbits:isset,AOL.test; content:"/"; http_uri; classtype:bad-unknown; sid:7000005; rev:1;)
>>
>> The first rule never creates alerting output. But the second rule will fire on every HTTP request from our client net while these are both running. What I think is occurring is that the packet causes an alert and a flowbit to be set for the stream because it sees the initial SYN packet (which is true). But the alert output is never created because it is actually checked against the SRC/DST networks in the rule and therefor it gets suppressed. But, the flowbit must not be getting compared against the SRC/DST network ranges and ports and unset if it doesn't match. Can I bug you guys to take a look into this?
>>
>>
>
> If you change your first rule to the following rules
> alert tcp $HOME_NET any ->
> [127.0.0.1,127.0.0.2,127.0.0.3,127.1.0.0/24,127.2.0.0/24,127.127.0.0/16]
> any (msg:"TEST talking to localhost"; flags:S; flowbits:set,AOL.test;
> flow:stateless ;classtype:bad-unknown; sid:7000003; rev:2;)
> alert tcp [127.0.0.1,127.0.0.2,127.0.0.3,127.1.0.0/24,127.2.0.0/24,127.127.0.0/16]
> any -> $HOME_NET any (msg:"TEST talking to localhost"; flags:S;
> flowbits:set,AOL.test; flow:stateless ;classtype:bad-unknown;
> sid:7000004; rev:2;)
>
> If you change your second rule from from:
>
> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"TEST
> http_uri to localhost"; flowbits:isset,AOL.test; content:"/";
> http_uri; classtype:bad-unknown; sid:7000005; rev:1;)
> to
> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"TEST
> http_uri to localhost"; flowbits:isset,AOL.test; content:"/";
> http_uri; classtype:bad-unknown; sid:7000005; flow:established;
> rev:2;)
>
> Do you have any changes to results?
>
> Assertion that source/dest is not checked is not what i see from the
> code stack (i might interpret it wrong) but
> mabey there is an issue with
> CheckBidirectional(Packet *p, struct _RuleTreeNode *rtn_idx,
>        RuleFpList *fp_list, int check_ports)
>
> 0.02 cents.
> -elz
>
> ------------------------------------------------------------------------------
> All of the data generated in your IT infrastructure is seriously valuable.
> Why? It contains a definitive record of application performance, security
> threats, fraudulent activity, and more. Splunk takes this data and makes
> sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-d2d-c2
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
>




More information about the Snort-devel mailing list