[Snort-users] rule does not alert from nmap

Matt Kettler mkettler at ...4108...
Thu Aug 17 14:15:42 EDT 2006


repniksz at ...13889... wrote:
> 
> Hi,
> I've written a very simply rule:
> 
> alert tcp any any -> any 80 (msg: "SYN on 80 port" ; flags: S; )
> 
> I've started testing, first of all i used just a simply browser to get a
> page from there, and the rule was working.
> But after i've tried use Nmap in some way:
> 
> nmap -sS -P0 -p 80 195.xxx.xxx.xxx
> nmap -P0 -p 80 195.xxx.xxx.xxx
> nmap -s-sacnflags syn -P0 -p 80 195.xxx.xxx.xxx
> 
> All of them sent a SYN to the 80 port.
> I've checked with ethereal.
> But there was not any on the alert file.
> what's wrong?

If you are using the stream4 preprocessor, you need "flow:stateless" in order to
detect this.


Stream4 will suppress any tcp packets that don't wind up creating a successful
tcp connection from being sent to normal rules. nmap -sS only sends a syn, so
stream4 will suppress that packet from being scanned by ordinary rules. This is
done to reduce overhead from pointless scanning of packets, as most rules are
designed to examine the data content. If no connection is established, there can
be no data...

Adding "flow:stateless" will allow a rule to match any packets, even if a
connection is not established. However, you should not use this on normal rules
that are trying to look for server exploits in a session. You should only use
this for rules that need to examine packets that do not result in a connection.
(great for checking for single syn packet DoS exploits, like the classic "land"
attack)











More information about the Snort-users mailing list