[Snort-users] flow:established still broken in 126.96.36.199? (was:FP shows snort-188.8.131.52 confused over packets and sessions)
jesler at ...1935...
Wed Jun 29 07:40:46 EDT 2011
On Jun 29, 2011, at 7:07 AM, Matthew Jonkman <jonkman at ...15020...> wrote:
> On Jun 29, 2011, at 6:47 AM, Joel Esler wrote:
>> Just a couple thoughts initially, I'll fwd this over to devel for them to look at as well.
>> Are you dropping packets? I am wondering that, because maybe Snort tagged this as a midstream pickup or something.
>> Do you have a pcap?
>> As a rule writing note, "isset" flowbit checks generally should come before content. I have no idea what this rule does though, but I'd want the flowbit check before the content in this case, as it's only a two byte match.
> Thanks for checking on the above Joel, thats something that's been killing me over the years but I thought it was expected behavior...
> On the flowbits though: I think we had a discussion here a while ago (years perhaps) that flowbits were checked AFTER all content matching, just before the alert stage. So order would be irrelevant in the rule, no?
You are right in the sense that content matches are put into the fast pattern matcher, and therefore processed before the other rule options, however, you are incorrect in your overall assumption. The fast pattern matcher pre-qualifies the rule to run, but when the rule runs, it runs from left to right in the "detection portion" of the rule. With a two byte content match, which will be pre-qualified on just about every packet going by, you want the flowbit first, to make the rule "fail" in a non-alert case as fast as possible. At low speed, or with a large content match you might not notice much of a difference, but the faster you go, and more the rules you have on, that makes a difference.
> That came around when we were trying to get performance gains by using flowbits to avoid costly content checks, but in the end it didn't help, it only prevented events, not load.
Content checks shouldnt be too costly unless they are really small or commonly occurring. (like a two byte.) But it's generally a good practice to write your rules in a standard format every time.
Some of the IP blocking conversations may be laid to rest in 2.9.1, so we'll see.
More information about the Snort-users