[Snort-users] snort does not send active response in passive mode

Anton warm at ...2377...
Thu Sep 19 04:07:47 EDT 2013


Good day.

I'm trying to set up snort with active response in passive mode. Here is my setup:


[switch port with mirrored 802.1q traffic]===[eth0 used for monitoring only]-[PC with snort]-[eth4 used for management
and has network access]===[network]

So, I have compiled snort-2.9.5.5 with 

./configure \                                                                                             
  --prefix=/usr \                                                                                         
  --sysconfdir=/etc \                                                                                     
  --mandir=/usr/man \                                                                                     
  --localstatedir=/var \                                                                                  
  --enable-pthread \                                                                                      
  --enable-linux-smp-stats \                                                                              
  --enable-zlib \                                                                                         
  --enable-active-response --enable-react --enable-flexresp3


I've read instructions from README.active

preprocessor stream5_global: \
   track_tcp yes, \
   track_udp no, \
   track_icmp no, \
   max_tcp 262144, \
   max_udp 131072, \
   max_active_responses 4, \
   min_response_seconds 2

...
# this was not required but I select only 80 port for better performance.
preprocessor stream5_tcp: policy windows, detect_anomalies, require_3whs 180, \
   overlap_limit 10, small_segments 3 bytes 150, timeout 180, \
    ports server \
        80 \
        , \
    ports both 80 3128 \
        8080
...

config response: device eth4 dst_mac 00:1a:30:62:7c:40 attempts 2 # this is MAC of the default gateway


I have test rule:

drop tcp any any -> any 80 (msg:"TEST0";\
        content:"TEST0";\
        resp:reset_source;\
        sid:1;)

I start snort like this:

snort   -q \
        --daq-var buffer_size_mb=128MB \
        --treat-drop-as-alert \
        -n 10000000 \
        -i eth0 \
        -l /var/log/snort \
        -K none \
        -c /etc/snort/snort.conf \
        -A console \
        -F 'bpf-file'

bpf-file contains filter for test machine only. It looks like "vlan and host X.X.X.65". vlan because it selects 802.1q
frames.

I start snort then I do "telnet somehost 80"  and print TEST0. Somehost prints HTML page:

<html>
<head><title>400 Bad Request</title></head>
<body bgcolor="white">
<center><h1>400 Bad Request</h1></center>
<hr><center>nginx</center>
</body>
</html>

and closes connection. Snort does not send anything but it writes alert messages to the console - snort can see
traffic described in rule. I tried to start "tcpdump -ni eth4 'host X.X.X.65'" on snort machine - it does not send
anything to X.X.X.65 at all.

Active response can be workable or can be unworkable but snort should send some reset packets to X.X.X.65 but is does
not.

How to find out the reason on which snort does not send rst (or other) packets ? If snort in passive mode should not
send any active response - why ? Documentation says that it should send rst in passive mode. 

"Configure the number of attempts to land a TCP RST within the session's current window (so that it is accepted by the
receiving TCP). This sequence "strafing" is really only useful in passive mode." - from documentation
(http://manual.snort.org/node26.html).



More information about the Snort-users mailing list