No subject


Thu Nov 23 16:36:19 EST 2017


LARGE ICMP:<br>
<br>
xavierc@ [~]# ping x.x.x.x<br>
PING 207.58.187.4 (207.58.187.4) 56(84) bytes of data.<br>
64 bytes from x.x.x.x: icmp_seq=1 ttl=62 time=0.481 ms<br>
<br>
xavierc@ [~]# ping x.x.x.x -s 1000<br>
PING x,x,x,x (x.x.x.x) 1000(1028) bytes of data.<br>
c<br>
--- x.x.x.x ping statistics ---<br>
5 packets transmitted, 0 received, 100% packet loss, time 4018ms<br>
<br>
<br>
But for HTTP Dont Work<br>
<br>
 xavierc at ...13351... [~]# telnet x.x.x.x 80<br>
Trying x.x.x.x...<br>
<br>
whit other ports WORK!!!<br>
<br>
xavierc at ...13351... [~]# telnet x.x.x.x 10000<br>
Trying x.x.x.x...<br>
Connected to x.x.x.x.<br>
Escape character is '^]'.<br>
<br>
The rule again are:<br>
<br>
drop tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"XavierC 
Try to stop http DOS Attack"; threshold: type both, track by_src, count
20, seconds 1; classtype:misc-activity; sid:3000000; rev:1;)<br>
<br>
And with rule commented, i can't connect to the port :( <br>
<br>
<br>
<br>
Will Thanks for your tip doesn't work too. <br>
<pre wrap="">"config checksum_mode: none"</pre>
<br>
i have this on the alert log:<br>
<br>
06/06-18:09:46.385165  [**] [1:3000000:1] XavierC  Try to stop http DOS
Attack [**] [Classification: Misc activity] [Priority: 3] {TCP}
10.80.98.7:2095 -> x.x.x.x:80<br>
06/06-18:10:09.834341  [**] [116:47:1] (snort_decoder) WARNING: TCP
Header length exceeds packet length! [**] {TCP} 192.168.0.30:0 ->
x.x.x.x:0<br>
<br>
i think whit this log there are some kind of comunication between snort
and iptables, but good connections are droped too and don't appears in
log.... for example the machine where i made the telnet doesn't appear,
even when the rule are uncommented i can't connecto to the 80 port....
any preprocessor maybe?<br>
<br>
Thanks for any help... I'm going to be crazy...<br>
Regards<br>
<br>
Xavier C.<br>
<br>
<br>
Will Metcalf wrote:
<blockquote cite="midc13e433a050606145030ab4cb5 at ...11828..."
 type="cite">
  <pre wrap="">Xavier,

Darn checksums, try setting this in your snort.conf

config checksum_mode: none

Regards,

Will
On 6/6/05, Xavier Cabrera <a class="moz-txt-link-rfc2396E" href="mailto:xavierc at ...12882..."><xavierc at ...12882...></a> wrote:
  </pre>
  <blockquote type="cite">
    <pre wrap="">I put your line on my iptables.. and don't work...  icmp works good for
me there some other reasons do you have?

Thanks...

Xavier C.

Victor Julien wrote:

    </pre>
    <blockquote type="cite">
      <pre wrap="">On Monday 06 June 2005 21:14, Xavier Cabrera wrote:


      </pre>
      <blockquote type="cite">
        <pre wrap="">Hello:

Anyone have a rule to stop a DoS attack to apache whit snort inline?

i Have this rule:

drop tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"XavierC  Try
to stop http DOS Attack";  flags:S; threshold: type both, track by_src,
count 5, seconds 1; classtype:misc-activity; sid:3000000; rev:1;)

and this on iptables table INPUT:

QUEUE      tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80



        </pre>
      </blockquote>
      <pre wrap="">Snort_inline needs to see the outgoing traffic as well, so add the following
iptables rule:
'iptables -A OUTPUT -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0 --sport 80 -j QUEUE'

Now it should work!

Regards,
Victor




      </pre>
      <blockquote type="cite">
        <pre wrap="">is seem stop some connections:



but when i want to make a real connection for a good ip i can't see the
website....... and no log appears for the good ip!!!

What can be happend?

thanks every one.

Xavier C.



-------------------------------------------------------
This SF.Net email is sponsored by: NEC IT Guy Games.  How far can you
shotput a projector? How fast can you ride your desk chair down the office
luge track? If you want to score the big prize, get to know the little guy.
Play to win an NEC 61" plasma display: <a class="moz-txt-link-freetext" href="http://www.necitguy.com/?r=20">http://www.necitguy.com/?r=20</a>
_______________________________________________
Snort-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Snort-users at lists.sourceforge.net">Snort-users at lists.sourceforge.net</a>
Go to this URL to change user options or unsubscribe:
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a>
Snort-users list archive:
<a class="moz-txt-link-freetext" href="http://www.geocrawler.com/redir-sf.php3?list=snort-users">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a>


        </pre>
      </blockquote>
      <pre wrap="">
-------------------------------------------------------
This SF.Net email is sponsored by: NEC IT Guy Games.  How far can you shotput
a projector? How fast can you ride your desk chair down the office luge track?
If you want to score the big prize, get to know the little guy.
Play to win an NEC 61" plasma display: <a class="moz-txt-link-freetext" href="http://www.necitguy.com/?r=20">http://www.necitguy.com/?r=20</a>
_______________________________________________
Snort-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Snort-users at lists.sourceforge.net">Snort-users at lists.sourceforge.net</a>
Go to this URL to change user options or unsubscribe:
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a>
Snort-users list archive:
<a class="moz-txt-link-freetext" href="http://www.geocrawler.com/redir-sf.php3?list=snort-users">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a>


      </pre>
    </blockquote>
    <pre wrap="">

-------------------------------------------------------
This SF.Net email is sponsored by: NEC IT Guy Games.  How far can you shotput
a projector? How fast can you ride your desk chair down the office luge track?
If you want to score the big prize, get to know the little guy.
Play to win an NEC 61" plasma display: <a class="moz-txt-link-freetext" href="http://www.necitguy.com/?r=20">http://www.necitguy.com/?r=20</a>
_______________________________________________
Snort-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Snort-users at lists.sourceforge.net">Snort-users at lists.sourceforge.net</a>
Go to this URL to change user options or unsubscribe:
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a>
Snort-users list archive:
<a class="moz-txt-link-freetext" href="http://www.geocrawler.com/redir-sf.php3?list=snort-users">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a>

    </pre>
  </blockquote>
  <pre wrap=""><!---->

-------------------------------------------------------
This SF.Net email is sponsored by: NEC IT Guy Games.  How far can you shotput
a projector? How fast can you ride your desk chair down the office luge track?
If you want to score the big prize, get to know the little guy.  
Play to win an NEC 61" plasma display: <a class="moz-txt-link-freetext" href="http://www.necitguy.com/?r">http://www.necitguy.com/?r</a> 
_______________________________________________
Snort-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Snort-users at lists.sourceforge.net">Snort-users at lists.sourceforge.net</a>
Go to this URL to change user options or unsubscribe:
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a>
Snort-users list archive:
<a class="moz-txt-link-freetext" href="http://www.geocrawler.com/redir-sf.php3?list=ort-users">http://www.geocrawler.com/redir-sf.php3?list=ort-users</a>
  </pre>
</blockquote>
<br>
</body>
</html>

--------------010906090808020107000401--




More information about the Snort-users mailing list