[Snort-users] Snort inline setup issues

The Adept adept at ...13938...
Thu Sep 28 11:27:34 EDT 2006


I am setting up a snort IPS on a Gentoo 2.6 box and I've run into a wall 
getting Snort to pass the packets out of the iptables queue.

For testing I have the snort box which sits on a 10.x.x.x address, it 
has a dual ethernet card to use for the inline bridge.  I have two 
different boxes connected to the dual ethernet card, one with 
192.168.100.1 as its address and one with 192.168.100.2.  The bridge 
(br0) works perfectly with -P FORWARD ACCEPT set and no snort.  When I 
change policy to DROP packets are correctly dropped (all protocols).  
When I enable snort, it sees the packets and ICMP works (pings) but tcp 
does not.  (log attached below)

I'm not sure what I'm doing wrong.  Everything appears to be set up 
correctly but no tcp sessions are being properly set up.  Any suggestions?

Thanks in advance for any advice.

Cheers,

 Dan

09/28-09:52:23.122172 192.168.100.1 -> 192.168.100.2
ICMP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:84 DF
Type:8  Code:0  ID:41257   Seq:256  ECHO
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/28-09:52:23.122394 192.168.100.2 -> 192.168.100.1
ICMP TTL:64 TOS:0x0 ID:4712 IpLen:20 DgmLen:84
Type:0  Code:0  ID:41257  Seq:256  ECHO REPLY
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/28-09:52:33.806050 192.168.100.1:33430 -> 192.168.100.2:22
TCP TTL:64 TOS:0x0 ID:58483 IpLen:20 DgmLen:60 DF
******S* Seq: 0xC52F7745  Ack: 0x0  Win: 0x16D0  TcpLen: 40
TCP Options (5) => MSS: 1460 SackOK TS: 250778422 0 NOP WS: 0
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/28-09:52:36.801000 192.168.100.1:33430 -> 192.168.100.2:22
TCP TTL:64 TOS:0x0 ID:58484 IpLen:20 DgmLen:60 DF
******S* Seq: 0xC52F7745  Ack: 0x0  Win: 0x16D0  TcpLen: 40
TCP Options (5) => MSS: 1460 SackOK TS: 250778722 0 NOP WS: 0
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

09/28-09:52:42.800391 192.168.100.1:33430 -> 192.168.100.2:22
TCP TTL:64 TOS:0x0 ID:58485 IpLen:20 DgmLen:60 DF
******S* Seq: 0xC52F7745  Ack: 0x0  Win: 0x16D0  TcpLen: 40
TCP Options (5) => MSS: 1460 SackOK TS: 250779322 0 NOP WS: 0
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+





More information about the Snort-users mailing list