[Snort-users] enable_xff with Snort

Mon Sep 23 07:39:03 EDT 2013

What is the snort version being used? Also what does your stream5 config
look like?

Thanks!
-B

On Sun, Sep 22, 2013 at 6:30 AM, Balasubramaniam Natarajan <
bala150985 at ...11827...> wrote:

> Hi
>
> I have been trying to configure snort's http_inspect for sometime now with
> out any success.
>
> excerpt from snort.conf
>
> *# HTTP normalization and anomaly detection.  For more information, see
> README.http_inspect
> preprocessor http_inspect: global iis_unicode_map unicode.map 1252
> compress_depth 65535 decompress_depth 65535
>
> preprocessor http_inspect_server: server { 10.0.0.0/8 192.168.1.0/24
> 192.168.56.0/24 } \
>              profile all ports { 80 81 82 83 84 85 86 87 88 89 90 311 383
> 591 593 631 901 1220 1414 1741 1830 2301 2381 2809 3037 3057 3128 3443 3702
> 4343 4848 5250 6080 6988 7000 7001 7144 7145 7510 7777 7779 8000 8008 8014
> 8028 8080 8085 8088 8090 8118 8123 8180 8181 8222 8243 8280 8300 8500 8800
> 8888 8899 9000 9060 9080 9090 9091 9443 9999 10000 11371 34443 34444 41080
> 50000 50002 55555 } enable_xff*
>
> Here you can see that I have turned on enable_xff.
>
> While running snort I can see that "Enable XFF and True Client IP: YES"
>
> *HttpInspect Config:
>     GLOBAL CONFIG
>       Max Pipeline Requests:    0
>       Inspection Type:          STATELESS
>       Detect Proxy Usage:       NO
>       IIS Unicode Map Filename: /store/snort/etc/unicode.map
>       IIS Unicode Map Codepage: 1252
>       Memcap used for logging URI and Hostname: 150994944
>       Max Gzip Memory: 838860
>       Max Gzip Sessions: 9532
>       Gzip Compress Depth: 65535
>       Gzip Decompress Depth: 65535
>     SERVER: 10.0.0.0/8 192.168.1.0/24 192.168.56.0/24
>       Server profile: All
>       Ports (PAF): 80 81 82 83 84 85 86 87 88 89 90 311 383 591 593 631
> 901 1220 1414 1741 1830 2301 2381 2809 3037 3057 3128 3443 3702 4343 4848
> 5250 6080 6988 7000 7001 7144 7145 7510 7777 7779 8000 8008 8014 8028 8080
> 8085 8088 8090 8118 8123 8180 8181 8222 8243 8280 8300 8500 8800 8888 8899
> 9000 9060 9080 9090 9091 9443 9999 10000 11371 34443 34444 41080 50000
> 50002 55555
>       Server Flow Depth: 300
>       Client Flow Depth: 300
>       Max Chunk Length: 500000
>       Max Header Field Length: 0
>       Max Number Header Fields: 0
>       Max Number of WhiteSpaces allowed with header folding: 200
>       Inspect Pipeline Requests: YES
>       URI Discovery Strict Mode: NO
>       Allow Proxy Usage: NO
>       Disable Alerting: NO
>       Oversize Dir Length: 0
>       Only inspect URI: NO
>       Normalize HTTP Headers: NO
>       Inspect HTTP Cookies: NO
>       Inspect HTTP Responses: NO
>       Extract Gzip from responses: NO
>       Unlimited decompression of gzip data from responses: NO
>       Normalize Javascripts in HTTP Responses: NO
>       Normalize HTTP Cookies: NO
>       Enable XFF and True Client IP: YES
>       Log HTTP URI data: NO
>       Log HTTP Hostname data: NO
>       Extended ASCII code support in URI: NO
>       Ascii: YES alert: NO
>       Double Decoding: YES alert: YES
>       %U Encoding: YES alert: YES
>       Bare Byte: YES alert: YES
>       UTF 8: OFF
>       IIS Unicode: YES alert: YES
>       Multiple Slash: YES alert: NO
>       IIS Backslash: YES alert: NO
>       Directory Traversal: YES alert: NO
>       Web Root Traversal: YES alert: YES
>       Apache WhiteSpace: YES alert: NO
>       IIS Delimiter: YES alert: NO
>       IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
>       Non-RFC Compliant Characters: NONE
>       Whitespace Characters: 0x09 0x0b 0x0c 0x0d
>     DEFAULT SERVER CONFIG:*
>
> Now I try to generate an alert by going to test.com using the command
> shown
>
> $ wget  -U ".Debian.APT-HTTP/1.3.(0.9.7.7ubuntu4)" test.com
>
> For some strange reason I cannot get snort to log ExtraData for the True
> Client IP.
>
> # u2spewfoo /tmp/log/snort.alert.log.1379845107
>
> *(Event)
>     sensor id: 0    event id: 1    event second: 1379845237    event
> microsecond: 165224
>     sig id: 2013504    gen id: 1    revision: 3     classification: 1
>     priority: 3    ip source: 10.0.2.15    ip destination: 174.36.85.72
>     src port: 60145    dest port: 80    protocol: 6    impact_flag: 0
> blocked: 0
>
> Packet
>     sensor id: 0    event id: 1    event second: 1379845237
>     packet second: 1379845237    packet microsecond: 165224
>     linktype: 1    packet_length: 272
> [    0] 52 54 00 12 35 02 08 00 27 EE 1B A6 08 00 45 00  RT..5...'.....E.
> [   16] 01 02 BA 59 40 00 40 06 70 21 0A 00 02 0F AE 24  ...Y at ...843...@.p!.....$
> [   32] 55 48 EA F1 00 50 88 D7 92 2E AE CB 12 02 50 18  UH...P........P.
> [   48] 39 08 10 70 00 00 47 45 54 20 2F 20 48 54 54 50  9..p..GET / HTTP
> [   64] 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74  /1.1..User-Agent
> [   80] 3A 20 2E 44 65 62 69 61 6E 2E 41 50 54 2D 48 54  : .Debian.APT-HT
> [   96] 54 50 2F 31 2E 33 2E 28 30 2E 39 2E 37 2E 37 75  TP/1.3.(0.9.7.7u
> [  112] 62 75 6E 74 75 34 29 0D 0A 41 63 63 65 70 74 3A  buntu4)..Accept:
> [  128] 20 2A 2F 2A 0D 0A 48 6F 73 74 3A 20 74 65 73 74   */*..Host: test
> [  144] 2E 63 6F 6D 0D 0A 56 69 61 3A 20 31 2E 31 20 6C  .com..Via: 1.1 l
> [  160] 6F 63 61 6C 68 6F 73 74 20 28 73 71 75 69 64 2F  ocalhost (squid/
> [  176] 33 2E 31 2E 32 30 29 0D 0A 58 2D 46 6F 72 77 61  3.1.20)..X-Forwa
> [  192] 72 64 65 64 2D 46 6F 72 3A 20 31 39 32 2E 31 36  rded-For: 192.16
> [  208] 38 2E 31 2E 32 0D 0A 43 61 63 68 65 2D 43 6F 6E  8.1.2..Cache-Con
> [  224] 74 72 6F 6C 3A 20 6D 61 78 2D 61 67 65 3D 32 35  trol: max-age=25
> [  240] 39 32 30 30 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E  9200..Connection
> [  256] 3A 20 6B 65 65 70 2D 61 6C 69 76 65 0D 0A 0D 0A  : keep-alive....
> *
>
>
> --
> Regards,
> Balasubramaniam Natarajan
> www.blog.etutorshop.com
>
>
> ------------------------------------------------------------------------------
> LIMITED TIME SALE - Full Year of Microsoft Training For Just $49.99!
> 1,500+ hours of tutorials including VisualStudio 2012, Windows 8,
> SharePoint
> 2013, SQL 2012, MVC 4, more. BEST VALUE: New Multi-Library Power Pack
> includes
> Mobile, Cloud, Java, and UX Design. Lowest price ever! Ends 9/22/13.
> http://pubads.g.doubleclick.net/gampad/clk?id=64545871&iu=/4140/ostg.clktrk
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130923/7d6f29d5/attachment.html>