Snort 2.9.2.3 pkg v. 2.5.0 Issues

Cino

Snort was running with preproc active a rules update was processed and snort stopped with the following error.

Jul 16 20:56:27 php: /snort/snort_download_rules.php: Snort has restarted with your new set of rules…
Jul 16 20:56:26 snort[25975]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
Jul 16 20:56:26 snort[25975]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
Jul 16 20:56:26 snort[25975]: Initializing rule chains…
Jul 16 20:56:26 snort[25975]: Initializing rule chains…
Jul 16 20:56:26 snort[25975]: +++++++++++++++++++++++++++++++++++++++++++++++++++
Jul 16 20:56:26 snort[25975]: +++++++++++++++++++++++++++++++++++++++++++++++++++

woke up to the same error this this morning. i looked in the preprocessor.rules file and commented the line and turned off sensitive data..

a google search states its because of sensitive data not being not being turned on… i have it on for testing and have 2 rules suppress. strange.....


alert ( msg: "SDF_COMBO_ALERT"; sid: 1; gid: 139; rev: 1; metadata: rule-type preproc ; classtype:sdf; )

EDIT: manual update (after removing the md5 files), and I dont have the above issue with sensitive data on… going to copy the rules over to my pc and compare them when/if this happens again

Fesoj

I installed the latest version and snort is running fine, but there might be an issue with the perl package that affects other packages.

During the last 2 weeks I removed and installed the snort package only. After one of the latest updates the perl files were gone, but pkg_info still reported about 2 perl packages installed. I noticed the missing files by the failure of other packages (e.g. lightsquid). After forcing a reinstall (pkg_add -f) of the latest perl package everything worked again as expected.

I am not sure whether this odd behavior is due to the snort package, but if you find that some things don't work any more, check for the existence of the perl package (and the system log).

Cino

@Fesoj:

I installed the latest version and snort is running fine, but there might be an issue with the perl package that affects other packages.

During the last 2 weeks I removed and installed the snort package only. After one of the latest updates the perl files were gone, but pkg_info still reported about 2 perl packages installed. I noticed the missing files by the failure of other packages (e.g. lightsquid). After forcing a reinstall (pkg_add -f) of the latest perl package everything worked again as expected.

I am not sure whether this odd behavior is due to the snort package, but if you find that some things don't work any more, check for the existence of the perl package (and the system log).

are you running 2.0.x? If so, here is why(i think anyways) https://github.com/bsdperimeter/pfsense-packages/commit/90a78d1150d6cf90b9fb60c2237d8c12b112c7d0. its been removed from the package.

with 2.1 being pbi packages, its alittle different

Fesoj

Cino,

yes, I am running 2.0.1.

bump version to 2.5.0 and remove perl from build requirments since it…

The extracts from snort.inc don't show what happens to those perl files, but the title seems to point to the villain.

Anyway, pkg_add -f remedies the situation.

breusshe

@Cino:

EDIT: manual update (after removing the md5 files), and I dont have the above issue with sensitive data on… going to copy the rules over to my pc and compare them when/if this happens again

I can confirm this solution. I deleted the MD5 files from /usr/local/etc/snort, turned on sensitive data, ran the rules update manually, and snort started right up. I'll post if thise problem repeats itself in the next day or two.

marcelloc

@Fesoj:

Anyway, pkg_add -f remedies the situation.

That because snort uninstalled perl on last update. As you have two other packages that requires perl, if you uninstall one of them, the other will break too.

To workaround the pkg_add step, just reinstall a package that requires perl.

att,
Marcello Coutinho

Fesoj

Marcello,

To workaround the pkg_add step, just reinstall a package that requires perl.

that's what I tried first && this didn't work. The perl files were gone, but pkg_info still reported about perl being installed. Therefore reinstalling s.th. like Lightsquid does not trigger a reinstall of perl.

Cino

not sure if its because of the new binary or this change https://github.com/bsdperimeter/pfsense-packages/commit/e2618ca4b906460455f1f778718ed9e9825d7085 but after uninstall-install around 12pm est, snort is blocking my wan ip address now. its in the HOME_NET… So i'm not sure what is going on... I dont have it on my whitelist, which i'm adding now and see what happens

EDIT: Its blocking my WAN IP with it in the whitelist also...

anyway the previous binary can be put back? ;D well if other users can confirm my findings

Fesoj

Cino,

I do not have any problems with bogus blockings (and I tested new version quit a lot today), but my pfSense box is not an edge router and the "WAN" side has a static address that showed up automatically in the default HOME_NET.

eri--

Cino,

please either snort config or snort package xml on config.xml?

dwood

Ermal, I've been uninstalling Snort, running the command "find /* | grep -i snort | xargs rm -rv" then reinstalling. I have to assume that this process would always replace the binary files?

I haven't reinstalled since yesterday in the site that's best for testing (live site!) so not sure if a reinstall will fix the WAN blocking…

Cino

here is my config, I'm trying see if i re-produce this on-demand… cause now it seems to be working just fine... Go figure right? lol

but i did another (de)install, saved every paged.. then rebooted


# snort configuration file
# generated automatically by the pfSense subsystems do not modify manually

# Define Local Network  #
var HOME_NET [127.0.0.1,10.0.0.0/8,2001:470:x:x::/64,x.x.x.x/22,192.168.0.1/24,2001:470:x:x::1/64,192.168.200.1/32,172.16.50.1/32,2001:470:x:x::2/64,192.168.5.1/24,x.x.x.1,209.18.47.61,209.18.47.62,192.168.200.0/24,192.168.50.0/24,172.16.50.0/24,192.168.60.0/24,172.16.60.0/24]
var EXTERNAL_NET [!$HOME_NET]

# Define Rule Paths #
var RULE_PATH /usr/local/etc/snort/snort_60770_em3/rules
var PREPROC_RULE_PATH /usr/local/etc/snort/preproc_rules

# Define Servers  #
var DNS_SERVERS [$HOME_NET]
var SMTP_SERVERS [$HOME_NET]
var HTTP_SERVERS [$HOME_NET]
var WWW_SERVERS [$HOME_NET]
var SQL_SERVERS [$HOME_NET]
var TELNET_SERVERS [$HOME_NET]
var SNMP_SERVERS [$HOME_NET]
var FTP_SERVERS [$HOME_NET]
var SSH_SERVERS [$HOME_NET]
var POP_SERVERS [$HOME_NET]
var IMAP_SERVERS [$HOME_NET]
var SIP_PROXY_IP [$HOME_NET]
var SIP_SERVERS [$HOME_NET]
var RPC_SERVERS [$HOME_NET]
var AIM_SERVERS [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]

# Define Server Ports  #
portvar DNS_PORTS [53]
portvar SMTP_PORTS [25]
portvar MAIL_PORTS [25,143,465,691]
portvar HTTP_PORTS [80]
portvar ORACLE_PORTS [1521]
portvar MSSQL_PORTS [1433]
portvar TELNET_PORTS [23]
portvar SNMP_PORTS [161]
portvar FTP_PORTS [21]
portvar SSH_PORTS [22]
portvar POP2_PORTS [109]
portvar POP3_PORTS [110]
portvar IMAP_PORTS [143]
portvar SIP_PROXY_PORTS [5060:5090,16384:32768]
portvar SIP_PORTS [5060:5090,16384:32768]
portvar AUTH_PORTS [113]
portvar FINGER_PORTS [79]
portvar IRC_PORTS [6665,6666,6667,6668,6669,7000]
portvar SMB_PORTS [139,445]
portvar NNTP_PORTS [119]
portvar RLOGIN_PORTS [513]
portvar RSH_PORTS [514]
portvar SSL_PORTS [443,465,563,636,989,990,992,993,994,995]
portvar FILE_DATA_PORTS [$HTTP_PORTS,110,143]
portvar SHELLCODE_PORTS [!80]
portvar SUN_RPC_PORTS [111,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779]
portvar DCERPC_NCACN_IP_TCP [139,445]
portvar DCERPC_NCADG_IP_UDP [138,1024:]
portvar DCERPC_NCACN_IP_LONG [135,139,445,593,1024:]
portvar DCERPC_NCACN_UDP_LONG [135,1024:]
portvar DCERPC_NCACN_UDP_SHORT [135,593,1024:]
portvar DCERPC_NCACN_TCP [2103,2105,2107]
portvar DCERPC_BRIGHTSTORE [6503,6504]

# Configure the snort decoder  #
config checksum_mode: all
config disable_decode_alerts
config disable_tcpopt_experimental_alerts
config disable_tcpopt_obsolete_alerts
config disable_ttcp_alerts
config disable_tcpopt_alerts
config disable_ipopt_alerts
config disable_decode_drops

# Configure the detection engine  #
config detection: search-method ac-bnfa max_queue_events 5
config event_queue: max_queue 8 log 3 order_events content_length

#Configure dynamic loaded libraries
dynamicpreprocessor directory /usr/local/lib/snort/dynamicpreprocessor
dynamicengine directory /usr/local/lib/snort/dynamicengine
dynamicdetection directory /usr/local/lib/snort/dynamicrules

# Flow and stream #
preprocessor frag3_global: max_frags 8192
preprocessor frag3_engine: policy bsd detect_anomalies

preprocessor stream5_global: track_tcp yes, track_udp yes, track_icmp yes
preprocessor stream5_tcp: policy BSD, ports both all, max_queued_bytes 10485760, max_queued_segs 26210
preprocessor stream5_udp:
preprocessor stream5_icmp:

# Performance Statistics #
preprocessor perfmonitor: time 300 file /var/log/snort/snort_em360770/em3.stats pktcnt 10000

# HTTP Inspect  #
preprocessor http_inspect: global iis_unicode_map unicode.map 1252 compress_depth 65535 decompress_depth 65535

preprocessor http_inspect_server: server default \
                        ports  { 80 }  \
                        non_strict \
                        non_rfc_char  { 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 }  \
                        flow_depth 300  \
                        apache_whitespace no \
                        directory no \
                        iis_backslash no \
                        u_encode yes \
			extended_response_inspection \
			inspect_gzip \
			normalize_utf \
			normalize_javascript \
			unlimited_decompress \
                        ascii no \
                        chunk_length 500000 \
                        bare_byte yes \
                        double_decode yes \
                        iis_unicode no \
                        iis_delimiter no \
                        multi_slash no

# Other preprocs #
preprocessor rpc_decode: 111 32770 32771 32772 32773 32774 32775 32776 32777 32778 32779

# Back Orifice
preprocessor bo

# ftp preprocessor  #
preprocessor ftp_telnet: global \
inspection_type stateless

preprocessor ftp_telnet_protocol: telnet \
   normalize \
   ayt_attack_thresh 200

preprocessor ftp_telnet_protocol: \
    ftp server default \
    def_max_param_len 100 \
    ports { 21 } \
    ftp_cmds { USER PASS ACCT CWD SDUP SMNT QUIT REIN PORT PASV TYPE STRU MODE } \
    ftp_cmds { RETR STOR STOU APPE ALLO REST RNFR RNTO ABOR DELE RMD MKD PWD } \
    ftp_cmds { LIST NLST SITE SYST STAT HELP NOOP } \
    ftp_cmds { AUTH ADAT PROT PBSZ CONF ENC } \
    ftp_cmds { FEAT CEL CMD MACB } \
    ftp_cmds { MDTM REST SIZE MLST MLSD } \
    ftp_cmds { XPWD XCWD XCUP XMKD XRMD TEST CLNT } \
    alt_max_param_len 0 { CDUP QUIT REIN PASV STOU ABOR PWD SYST NOOP } \
    alt_max_param_len 100 { MDTM CEL XCWD SITE USER PASS REST DELE RMD SYST TEST STAT MACB EPSV CLNT LPRT } \
    alt_max_param_len 200 { XMKD NLST ALLO STOU APPE RETR STOR CMD RNFR HELP } \
    alt_max_param_len 256 { RNTO CWD } \
    alt_max_param_len 400 { PORT } \
    alt_max_param_len 512 { SIZE } \
    chk_str_fmt { USER PASS ACCT CWD SDUP SMNT PORT TYPE STRU MODE } \
    chk_str_fmt { RETR STOR STOU APPE ALLO REST RNFR RNTO DELE RMD MKD } \
    chk_str_fmt { LIST NLST SITE SYST STAT HELP } \
    chk_str_fmt { AUTH ADAT PROT PBSZ CONF ENC } \
    chk_str_fmt { FEAT CEL CMD } \
    chk_str_fmt { MDTM REST SIZE MLST MLSD } \
    chk_str_fmt { XPWD XCWD XCUP XMKD XRMD TEST CLNT } \
    cmd_validity MODE < char ASBCZ > \
    cmd_validity STRU < char FRP > \
    cmd_validity ALLO < int [ char R int ] > \
    cmd_validity TYPE < { char AE [ char NTC ] | char I | char L [ number ] } > \
    cmd_validity MDTM < [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string > \
    cmd_validity PORT < host_port >

preprocessor ftp_telnet_protocol: ftp client default \
   max_resp_len 256 \
   bounce yes \
   telnet_cmds yes

# SMTP preprocessor #
preprocessor SMTP: \
    ports { 25 143 465 691 } \
    inspection_type stateful \
    normalize cmds \
    valid_cmds { MAIL RCPT HELP HELO ETRN EHLO EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY IDENT NOOP RSET SEND SAML SOML AUTH TURN ETRN PIPELINING \
CHUNKING DATA DSN RSET QUIT ONEX QUEU STARTTLS TICK TIME TURNME VERB X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN XLICENSE XQUEU XSTA XTRN XUSR } \
    normalize_cmds { MAIL RCPT HELP HELO ETRN EHLO EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY IDENT NOOP RSET SEND SAML SOML AUTH TURN ETRN \
PIPELINING CHUNKING DATA DSN RSET QUIT ONEX QUEU STARTTLS TICK TIME TURNME VERB X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN XLICENSE XQUEU XSTA XTRN XUSR } \
    max_header_line_len 1000 \ 
    max_response_line_len 512 \
    alt_max_command_line_len 260 { MAIL } \
    alt_max_command_line_len 300 { RCPT } \
    alt_max_command_line_len 500 { HELP HELO ETRN EHLO } \
    alt_max_command_line_len 255 { EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY IDENT NOOP RSET } \
    alt_max_command_line_len 246 { SEND SAML SOML AUTH TURN ETRN PIPELINING CHUNKING DATA DSN RSET QUIT ONEX } \
    alt_max_command_line_len 246 { QUEU STARTTLS TICK TIME TURNME VERB X-EXPS X-LINK2STATE XADR } \
    alt_max_command_line_len 246 { XAUTH XCIR XEXCH50 XGEN XLICENSE XQUEU XSTA XTRN XUSR } \
    xlink2state { enable }

# sf Portscan  #
preprocessor sfportscan: scan_type { all } \
                         proto  { all } \
                         memcap { 10000000 } \
                         sense_level { medium } \
                         ignore_scanners { $HOME_NET }

# DCE/RPC 2   #
preprocessor dcerpc2: memcap 102400, events [smb, co, cl]
preprocessor dcerpc2_server: default, policy WinXP, \
    detect [smb [139,445], tcp 135, udp 135, rpc-over-http-server 593], \
    autodetect [tcp 1025:, udp 1025:, rpc-over-http-server 1025:], \
    smb_max_chain 3

# DNS preprocessor #
preprocessor dns: \
    ports { 53 } \
    enable_rdata_overflow

preprocessor sensitive_data:

# Ignore SSL and Encryption  #
preprocessor ssl: ports { 443 465 563 636 989 990 992 993 994 995 }, trustservers, noinspect_encrypted

# Snort Output Logs #
output alert_csv: alert timestamp,sig_generator,sig_id,sig_rev,msg,proto,src,srcport,dst,dstport,id,classification,priority

output unified2: filename snort_60770_em3.u2, limit 128
output alert_pf: /usr/local/etc/snort/snort_60770_em3/MainWhiteList,snort2c,src,

# Misc Includes #
include /usr/local/etc/snort/snort_60770_em3/reference.config
include /usr/local/etc/snort/snort_60770_em3/classification.config
include $PREPROC_RULE_PATH/sensitive-data.rules
include $PREPROC_RULE_PATH/decoder.rules
include $PREPROC_RULE_PATH/preprocessor.rules

include /usr/local/etc/snort/snort_60770_em3/suppMainSuppressList

# Snort user pass through configuration

# Rules Selection #
include $RULE_PATH/snort_attack-responses.rules
include $RULE_PATH/snort_bad-traffic.so.rules
include $RULE_PATH/emerging-attack_response.rules
include $RULE_PATH/snort_backdoor.rules
include $RULE_PATH/emerging-botcc.rules
include $RULE_PATH/snort_bad-traffic.rules
include $RULE_PATH/snort_dos.so.rules
include $RULE_PATH/snort_blacklist.rules
include $RULE_PATH/snort_exploit.so.rules
include $RULE_PATH/emerging-ciarmy.rules
include $RULE_PATH/snort_botnet-cnc.rules
include $RULE_PATH/emerging-compromised.rules
include $RULE_PATH/emerging-current_events.rules
include $RULE_PATH/snort_content-replace.rules
include $RULE_PATH/snort_misc.so.rules
include $RULE_PATH/snort_ddos.rules
include $RULE_PATH/emerging-dos.rules
include $RULE_PATH/snort_dos.rules
include $RULE_PATH/emerging-dshield.rules
include $RULE_PATH/emerging-exploit.rules
include $RULE_PATH/snort_exploit.rules
include $RULE_PATH/snort_web-client.so.rules
include $RULE_PATH/snort_web-misc.so.rules
include $RULE_PATH/emerging-malware.rules
include $RULE_PATH/emerging-misc.rules
include $RULE_PATH/emerging-mobile_malware.rules
include $RULE_PATH/snort_indicator-compromise.rules
include $RULE_PATH/snort_indicator-obfuscation.rules
include $RULE_PATH/snort_misc.rules
include $RULE_PATH/emerging-rbn-malvertisers.rules
include $RULE_PATH/emerging-rbn.rules
include $RULE_PATH/emerging-rpc.rules
include $RULE_PATH/emerging-scan.rules
include $RULE_PATH/emerging-shellcode.rules
include $RULE_PATH/snort_other-ids.rules
include $RULE_PATH/snort_phishing-spam.rules
include $RULE_PATH/emerging-trojan.rules
include $RULE_PATH/emerging-user_agents.rules
include $RULE_PATH/emerging-virus.rules
include $RULE_PATH/emerging-web_client.rules
include $RULE_PATH/snort_rpc.rules
include $RULE_PATH/emerging-worm.rules
include $RULE_PATH/snort_scan.rules
include $RULE_PATH/snort_shellcode.rules
include $RULE_PATH/snort_specific-threats.rules
include $RULE_PATH/snort_spyware-put.rules
include $RULE_PATH/snort_virus.rules
include $RULE_PATH/snort_web-attacks.rules
include $RULE_PATH/snort_web-client.rules
include $RULE_PATH/snort_web-iis.rules
include $RULE_PATH/snort_web-misc.rules

mschiek01

@Cino:

here is my config, I'm trying see if i re-produce this on-demand… cause now it seems to be working just fine... Go figure right? lol

but i did another (de)install, saved every paged.. then rebooted


# snort configuration file
# generated automatically by the pfSense subsystems do not modify manually

# Define Local Network  #
var HOME_NET [127.0.0.1,10.0.0.0/8,2001:470:x:x::/64,x.x.x.x/22,192.168.0.1/24,2001:470:x:x::1/64,192.168.200.1/32,172.16.50.1/32,2001:470:x:x::2/64,192.168.5.1/24,x.x.x.1,209.18.47.61,209.18.47.62,192.168.200.0/24,192.168.50.0/24,172.16.50.0/24,192.168.60.0/24,172.16.60.0/24]
var EXTERNAL_NET [!$HOME_NET]

# Define Rule Paths #
var RULE_PATH /usr/local/etc/snort/snort_60770_em3/rules
var PREPROC_RULE_PATH /usr/local/etc/snort/preproc_rules

# Define Servers  #
var DNS_SERVERS [$HOME_NET]
var SMTP_SERVERS [$HOME_NET]
var HTTP_SERVERS [$HOME_NET]
var WWW_SERVERS [$HOME_NET]
var SQL_SERVERS [$HOME_NET]
var TELNET_SERVERS [$HOME_NET]
var SNMP_SERVERS [$HOME_NET]
var FTP_SERVERS [$HOME_NET]
var SSH_SERVERS [$HOME_NET]
var POP_SERVERS [$HOME_NET]
var IMAP_SERVERS [$HOME_NET]
var SIP_PROXY_IP [$HOME_NET]
var SIP_SERVERS [$HOME_NET]
var RPC_SERVERS [$HOME_NET]
var AIM_SERVERS [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]

# Define Server Ports  #
portvar DNS_PORTS [53]
portvar SMTP_PORTS [25]
portvar MAIL_PORTS [25,143,465,691]
portvar HTTP_PORTS [80]
portvar ORACLE_PORTS [1521]
portvar MSSQL_PORTS [1433]
portvar TELNET_PORTS [23]
portvar SNMP_PORTS [161]
portvar FTP_PORTS [21]
portvar SSH_PORTS [22]
portvar POP2_PORTS [109]
portvar POP3_PORTS [110]
portvar IMAP_PORTS [143]
portvar SIP_PROXY_PORTS [5060:5090,16384:32768]
portvar SIP_PORTS [5060:5090,16384:32768]
portvar AUTH_PORTS [113]
portvar FINGER_PORTS [79]
portvar IRC_PORTS [6665,6666,6667,6668,6669,7000]
portvar SMB_PORTS [139,445]
portvar NNTP_PORTS [119]
portvar RLOGIN_PORTS [513]
portvar RSH_PORTS [514]
portvar SSL_PORTS [443,465,563,636,989,990,992,993,994,995]
portvar FILE_DATA_PORTS [$HTTP_PORTS,110,143]
portvar SHELLCODE_PORTS [!80]
portvar SUN_RPC_PORTS [111,32770,32771,32772,32773,32774,32775,32776,32777,32778,32779]
portvar DCERPC_NCACN_IP_TCP [139,445]
portvar DCERPC_NCADG_IP_UDP [138,1024:]
portvar DCERPC_NCACN_IP_LONG [135,139,445,593,1024:]
portvar DCERPC_NCACN_UDP_LONG [135,1024:]
portvar DCERPC_NCACN_UDP_SHORT [135,593,1024:]
portvar DCERPC_NCACN_TCP [2103,2105,2107]
portvar DCERPC_BRIGHTSTORE [6503,6504]

# Configure the snort decoder  #
config checksum_mode: all
config disable_decode_alerts
config disable_tcpopt_experimental_alerts
config disable_tcpopt_obsolete_alerts
config disable_ttcp_alerts
config disable_tcpopt_alerts
config disable_ipopt_alerts
config disable_decode_drops

# Configure the detection engine  #
config detection: search-method ac-bnfa max_queue_events 5
config event_queue: max_queue 8 log 3 order_events content_length

#Configure dynamic loaded libraries
dynamicpreprocessor directory /usr/local/lib/snort/dynamicpreprocessor
dynamicengine directory /usr/local/lib/snort/dynamicengine
dynamicdetection directory /usr/local/lib/snort/dynamicrules

# Flow and stream #
preprocessor frag3_global: max_frags 8192
preprocessor frag3_engine: policy bsd detect_anomalies

preprocessor stream5_global: track_tcp yes, track_udp yes, track_icmp yes
preprocessor stream5_tcp: policy BSD, ports both all, max_queued_bytes 10485760, max_queued_segs 26210
preprocessor stream5_udp:
preprocessor stream5_icmp:

# Performance Statistics #
preprocessor perfmonitor: time 300 file /var/log/snort/snort_em360770/em3.stats pktcnt 10000
	
# HTTP Inspect  #
preprocessor http_inspect: global iis_unicode_map unicode.map 1252 compress_depth 65535 decompress_depth 65535

preprocessor http_inspect_server: server default \
                        ports  { 80 }  \
                        non_strict \
                        non_rfc_char  { 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 }  \
                        flow_depth 300  \
                        apache_whitespace no \
                        directory no \
                        iis_backslash no \
                        u_encode yes \
			extended_response_inspection \
			inspect_gzip \
			normalize_utf \
			normalize_javascript \
			unlimited_decompress \
                        ascii no \
                        chunk_length 500000 \
                        bare_byte yes \
                        double_decode yes \
                        iis_unicode no \
                        iis_delimiter no \
                        multi_slash no
	
# Other preprocs #
preprocessor rpc_decode: 111 32770 32771 32772 32773 32774 32775 32776 32777 32778 32779

# Back Orifice
preprocessor bo
	
# ftp preprocessor  #
preprocessor ftp_telnet: global \
inspection_type stateless

preprocessor ftp_telnet_protocol: telnet \
   normalize \
   ayt_attack_thresh 200

preprocessor ftp_telnet_protocol: \
    ftp server default \
    def_max_param_len 100 \
    ports { 21 } \
    ftp_cmds { USER PASS ACCT CWD SDUP SMNT QUIT REIN PORT PASV TYPE STRU MODE } \
    ftp_cmds { RETR STOR STOU APPE ALLO REST RNFR RNTO ABOR DELE RMD MKD PWD } \
    ftp_cmds { LIST NLST SITE SYST STAT HELP NOOP } \
    ftp_cmds { AUTH ADAT PROT PBSZ CONF ENC } \
    ftp_cmds { FEAT CEL CMD MACB } \
    ftp_cmds { MDTM REST SIZE MLST MLSD } \
    ftp_cmds { XPWD XCWD XCUP XMKD XRMD TEST CLNT } \
    alt_max_param_len 0 { CDUP QUIT REIN PASV STOU ABOR PWD SYST NOOP } \
    alt_max_param_len 100 { MDTM CEL XCWD SITE USER PASS REST DELE RMD SYST TEST STAT MACB EPSV CLNT LPRT } \
    alt_max_param_len 200 { XMKD NLST ALLO STOU APPE RETR STOR CMD RNFR HELP } \
    alt_max_param_len 256 { RNTO CWD } \
    alt_max_param_len 400 { PORT } \
    alt_max_param_len 512 { SIZE } \
    chk_str_fmt { USER PASS ACCT CWD SDUP SMNT PORT TYPE STRU MODE } \
    chk_str_fmt { RETR STOR STOU APPE ALLO REST RNFR RNTO DELE RMD MKD } \
    chk_str_fmt { LIST NLST SITE SYST STAT HELP } \
    chk_str_fmt { AUTH ADAT PROT PBSZ CONF ENC } \
    chk_str_fmt { FEAT CEL CMD } \
    chk_str_fmt { MDTM REST SIZE MLST MLSD } \
    chk_str_fmt { XPWD XCWD XCUP XMKD XRMD TEST CLNT } \
    cmd_validity MODE < char ASBCZ > \
    cmd_validity STRU < char FRP > \
    cmd_validity ALLO < int [ char R int ] > \
    cmd_validity TYPE < { char AE [ char NTC ] | char I | char L [ number ] } > \
    cmd_validity MDTM < [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string > \
    cmd_validity PORT < host_port >

preprocessor ftp_telnet_protocol: ftp client default \
   max_resp_len 256 \
   bounce yes \
   telnet_cmds yes
	
# SMTP preprocessor #
preprocessor SMTP: \
    ports { 25 143 465 691 } \
    inspection_type stateful \
    normalize cmds \
    valid_cmds { MAIL RCPT HELP HELO ETRN EHLO EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY IDENT NOOP RSET SEND SAML SOML AUTH TURN ETRN PIPELINING \
CHUNKING DATA DSN RSET QUIT ONEX QUEU STARTTLS TICK TIME TURNME VERB X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN XLICENSE XQUEU XSTA XTRN XUSR } \
    normalize_cmds { MAIL RCPT HELP HELO ETRN EHLO EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY IDENT NOOP RSET SEND SAML SOML AUTH TURN ETRN \
PIPELINING CHUNKING DATA DSN RSET QUIT ONEX QUEU STARTTLS TICK TIME TURNME VERB X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN XLICENSE XQUEU XSTA XTRN XUSR } \
    max_header_line_len 1000 \ 
    max_response_line_len 512 \
    alt_max_command_line_len 260 { MAIL } \
    alt_max_command_line_len 300 { RCPT } \
    alt_max_command_line_len 500 { HELP HELO ETRN EHLO } \
    alt_max_command_line_len 255 { EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY IDENT NOOP RSET } \
    alt_max_command_line_len 246 { SEND SAML SOML AUTH TURN ETRN PIPELINING CHUNKING DATA DSN RSET QUIT ONEX } \
    alt_max_command_line_len 246 { QUEU STARTTLS TICK TIME TURNME VERB X-EXPS X-LINK2STATE XADR } \
    alt_max_command_line_len 246 { XAUTH XCIR XEXCH50 XGEN XLICENSE XQUEU XSTA XTRN XUSR } \
    xlink2state { enable }
	
# sf Portscan  #
preprocessor sfportscan: scan_type { all } \
                         proto  { all } \
                         memcap { 10000000 } \
                         sense_level { medium } \
                         ignore_scanners { $HOME_NET }
	
# DCE/RPC 2   #
preprocessor dcerpc2: memcap 102400, events [smb, co, cl]
preprocessor dcerpc2_server: default, policy WinXP, \
    detect [smb [139,445], tcp 135, udp 135, rpc-over-http-server 593], \
    autodetect [tcp 1025:, udp 1025:, rpc-over-http-server 1025:], \
    smb_max_chain 3
	
# DNS preprocessor #
preprocessor dns: \
    ports { 53 } \
    enable_rdata_overflow
	
preprocessor sensitive_data:

# Ignore SSL and Encryption  #
preprocessor ssl: ports { 443 465 563 636 989 990 992 993 994 995 }, trustservers, noinspect_encrypted

# Snort Output Logs #
output alert_csv: alert timestamp,sig_generator,sig_id,sig_rev,msg,proto,src,srcport,dst,dstport,id,classification,priority

output unified2: filename snort_60770_em3.u2, limit 128
output alert_pf: /usr/local/etc/snort/snort_60770_em3/MainWhiteList,snort2c,src,
						
# Misc Includes #
include /usr/local/etc/snort/snort_60770_em3/reference.config
include /usr/local/etc/snort/snort_60770_em3/classification.config
include $PREPROC_RULE_PATH/sensitive-data.rules
include $PREPROC_RULE_PATH/decoder.rules
include $PREPROC_RULE_PATH/preprocessor.rules

include /usr/local/etc/snort/snort_60770_em3/suppMainSuppressList

# Snort user pass through configuration

# Rules Selection #
include $RULE_PATH/snort_attack-responses.rules
include $RULE_PATH/snort_bad-traffic.so.rules
include $RULE_PATH/emerging-attack_response.rules
include $RULE_PATH/snort_backdoor.rules
include $RULE_PATH/emerging-botcc.rules
include $RULE_PATH/snort_bad-traffic.rules
include $RULE_PATH/snort_dos.so.rules
include $RULE_PATH/snort_blacklist.rules
include $RULE_PATH/snort_exploit.so.rules
include $RULE_PATH/emerging-ciarmy.rules
include $RULE_PATH/snort_botnet-cnc.rules
include $RULE_PATH/emerging-compromised.rules
include $RULE_PATH/emerging-current_events.rules
include $RULE_PATH/snort_content-replace.rules
include $RULE_PATH/snort_misc.so.rules
include $RULE_PATH/snort_ddos.rules
include $RULE_PATH/emerging-dos.rules
include $RULE_PATH/snort_dos.rules
include $RULE_PATH/emerging-dshield.rules
include $RULE_PATH/emerging-exploit.rules
include $RULE_PATH/snort_exploit.rules
include $RULE_PATH/snort_web-client.so.rules
include $RULE_PATH/snort_web-misc.so.rules
include $RULE_PATH/emerging-malware.rules
include $RULE_PATH/emerging-misc.rules
include $RULE_PATH/emerging-mobile_malware.rules
include $RULE_PATH/snort_indicator-compromise.rules
include $RULE_PATH/snort_indicator-obfuscation.rules
include $RULE_PATH/snort_misc.rules
include $RULE_PATH/emerging-rbn-malvertisers.rules
include $RULE_PATH/emerging-rbn.rules
include $RULE_PATH/emerging-rpc.rules
include $RULE_PATH/emerging-scan.rules
include $RULE_PATH/emerging-shellcode.rules
include $RULE_PATH/snort_other-ids.rules
include $RULE_PATH/snort_phishing-spam.rules
include $RULE_PATH/emerging-trojan.rules
include $RULE_PATH/emerging-user_agents.rules
include $RULE_PATH/emerging-virus.rules
include $RULE_PATH/emerging-web_client.rules
include $RULE_PATH/snort_rpc.rules
include $RULE_PATH/emerging-worm.rules
include $RULE_PATH/snort_scan.rules
include $RULE_PATH/snort_shellcode.rules
include $RULE_PATH/snort_specific-threats.rules
include $RULE_PATH/snort_spyware-put.rules
include $RULE_PATH/snort_virus.rules
include $RULE_PATH/snort_web-attacks.rules
include $RULE_PATH/snort_web-client.rules
include $RULE_PATH/snort_web-iis.rules
include $RULE_PATH/snort_web-misc.rules

I have the same problem except I have static Wan addresses snort was running just without problems then the following

system log
Jul 17 13:33:32 apinger: ALARM: WAN1GW(nn.nn.nnn.nnn) *** WAN1GWdown ***
Jul 17 13:28:04 snort[40189]: [1:2500062:2570] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP (32) [Classification: Misc Attack] [Priority: 2] {TCP}
Jul 17 13:28:04 snort[40189]: [1:2500062:2570] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP (32) [Classification: Misc Attack] [Priority: 2]

Alert description which is very strange.

"ET RBN Known Russian Business Network IP UDP (112)" - 07/17-12:25:48
"ET DOS Microsoft Remote Desktop (RDP) Syn then Reset 30 Second DoS Attempt" - 07/17-11:59:17
4 nnn.nnn.nnn.nnn "ET RBN Known Russian Business Network IP TCP (232)" - 07/17-09:59:36
"ET RBN Known Russian Business Network IP TCP (208)" - 07/17-11:05:21
"ET RBN Known Russian Business Network IP TCP (94)" - 07/17-11:14:14
"ET COMPROMISED Known Compromised or Hostile Host Traffic TCP (29)" - 07/17-11:23:48
"(dcerpc2) Connection-oriented DCE/RPC - Bind: Remaining fragment length (3) less than size needed (20)" - 07/17-13:19:42
"ET COMPROMISED Known Compromised or Hostile Host Traffic TCP (32)" - 07/17-13:28:04

Snort started blocking the Wan interface ip.

The wan addresses are defined as nnn.nnn.nnn.nnn/nn in the white list.

dwood

Same here…SNORT was running fine for a few hours before the WAN connections were blocked.

eri--

but i did another (de)install, saved every paged.. then rebooted

That is not necessary anymore Cino :)
Everything will just get magically applied.

Fesoj

Which sides are you blocking on the WAN interface? If you block src and dst you can effectively shoot yourself in the foot. It seems that snort 2.9.2.3 has more sensitive preprocessors and I had to suppress a few more rules for my box compared to 2.9.0.x.

So looking at the alerts should tell you whether your WAN IP was part of an alert message. My 2.9.2.3/2.5.0 box has currently an uptime of more than 7 hours with typically about 5 clients and everything looks fine.

dwood

Blocking src only, kill states and checksum enabled. The WAN IP being blocked was x.x.x.0 effectively blocking everything over that connetion. My uptime was several hours, about 20 users before the alert was triggered. I had to remove Snort but can throw it back on later for a log if required. My concern was IP6 blocking as I need to learn more about IP6 before I'm able to manage it on a router ;-)

Cheers
D.

mschiek01

@Fesoj:

Which sides are you blocking on the WAN interface? If you block src and dst you can effectively shoot yourself in the foot. It seems that snort 2.9.2.3 has more sensitive preprocessors and I had to suppress a few more rules for my box compared to 2.9.0.x.

So looking at the alerts should tell you whether your WAN IP was part of an alert message. My 2.9.2.3/2.5.0 box has currently an uptime of more than 7 hours with typically about 5 clients and everything looks fine.

Same here source only with "kill states and checksum" both selected. This has now happened on multiple installations. Some installations have static wans others have dynamic. I do not see a common pattern at all.

uptime on boxes varies from days to weeks. I have turned off auto updates for snort rules as well. Still have not found a common thread.

Fesoj

On the WAN side, I am blocking destination addresses only (because offenders are typically coming from the inside, and I want to block their outside contact on the WAN interface, but there is a corresponding handling on the LAN side to vet my clients :(). Of course this depends on what you actually want to block and which rules are active.

You need to look at each rule, if the source is s.th. like $HOME_NET, then you might have to do the blocking on the LAN side, maybe sometimes you could simply suppress the alert.

mschiek01

@Fesoj:

On the WAN side, I am blocking destination addresses only (because offenders are typically coming from the inside, and I want to block their outside contact on the WAN interface, but there is a corresponding handling on the LAN side to vet my clients :(). Of course this depends on what you actually want to block and which rules are active.

You need to look at each rule, if the source is s.th. like $HOME_NET, then you might have to do the blocking on the LAN side, maybe sometimes you could simply suppress the alert.

I agree with you but, this is the alert trigger right before snort blocked the wan ip.

Jul 17 13:28:04 snort[40189]: [1:2500062:2570] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP (32) [Classification: Misc Attack] [Priority: 2] {TCP} 59.175.218.166:31157 -> nn.nn.nn.nnn

This clearly show the source is 59.175.218.166 but snort blocked the wan ip instead.