[Snort-users] Question on port lists and negation

Richard Bejtlich taosecurity at ...11827...
Mon Oct 8 15:59:15 EDT 2007


As I mentioned to roesch and WuTang in IRC, I am playing with port
lists and negation.

Say I create this snort.conf:

portvar MY_HTTP_PORTS [80,81,82,83,88,8000,8008,8080]
alert tcp any any -> any !$MY_HTTP_PORTS (msg:"Example Not"; sid:4;)

To test this variable and rule I use Netcat:

$ nc -v 8000
nc: connect to port 8000 (tcp) failed: Connection refused

Netcat generates this traffic.

16:52:32.370899 IP >
 S 3574479912:3574479912(0) win 65535
 <mss 1460,nop,wscale 1,nop,nop,timestamp 2620575 0,sackOK,eol>

16:52:32.370903 IP >
 R 0:0(0) ack 3574479913 win 0

Snort reports these alerts.

10/08-16:56:26.358386  [**] [1:4:0] Example Not [**] [Priority: 0]
{TCP} ->
10/08-16:56:26.358527  [**] [1:4:0] Example Not [**] [Priority: 0]
{TCP} ->

That doesn't look right.  Why did the first alert fire?  You do not
want to see traffic to port 8000 TCP, yet you got an alert.  The
second alert fired because the RST ACK was sent to port 50970 TCP,
which is not in the port variable list.

Let's try another angle in a new snort.conf.

portvar NOT_MY_HTTP_PORTS [!80,!81,!82,!83,!88,!8000,!8008,!8080]
alert tcp any any -> any $NOT_MY_HTTP_PORTS (msg:"Example Not"; sid:5;)

Again use Netcat to generate traffic.

$ nc -v 8000
nc: connect to port 8000 (tcp) failed: Connection refused

It looks like this.

16:56:11.091099 IP >
 S 2235929694:2235929694(0) win 65535
 <mss 1460,nop,wscale 1,nop,nop,timestamp 2642448 0,sackOK,eol>

16:56:11.095002 IP >
 R 0:0(0) ack 2235929695 win 0

This time, Snort reports only one alert.

10/08-17:00:07.050091  [**] [1:5:0] Example Not [**] [Priority: 0]
{TCP} ->

This is the desired behavior.  Snort ignored the SYN packet to port
8000 TCP but it fired on the return traffic.

Is this is a logic issue?

This does not negate (oww, bad pun) the fact that port lists are very helpful.

Thank you,


More information about the Snort-users mailing list