Snort 2.9.4.6 Pkg v 2.5.9

bmeeks

Yes.

Go to the Snort Interfaces tab, click the WAN interface, then the WAN If Settings tab. Scroll down and click the VIEW button next to the whitelist selection. Verify that the correct WAN IPs are (or are not) displayed in the pop-up window and post back.

Bill

gogol

@Supermule:

The new snort package blocks whitelisted WAN IP's and the 2.5.8 didnt.

I had the 1st block just a couple of minutes ago.

As far as I can see in your pictures (a few posts later) WAN IP is not blocked, but has the new + sign to add it to the suppress list. When it is blocked it has also an X!

Supermule

They are there.

@bmeeks:

@Supermule:

Yes.

Go to the Snort Interfaces tab, click the WAN interface, then the WAN If Settings tab. Scroll down and click the VIEW button next to the whitelist selection. Verify that the correct WAN IPs are (or are not) displayed in the pop-up window and post back.

Bill

Supermule

THANKS Gogol!!

I am glad you are awake when I am not :D

@gogol:

@Supermule:

The new snort package blocks whitelisted WAN IP's and the 2.5.8 didnt.

I had the 1st block just a couple of minutes ago.

As far as I can see in your pictures (a few posts later) WAN IP is not blocked, but has the new + sign to add it to the suppress list. When it is blocked it has also an X!

bmeeks

@shinzo:

sorry i was awake 8). Thanks for all the adds to the package. Noticed that in the Home Net to inspect tab, I set up a custom whitelist so only the wan ip would be checked but its still adding the lan subnet. In the Whitelist underneath External net, it does display correctly.

Yes, this was by design. HOME_NET defines the networks to protect, so it should include locally attached subnets. The general premise in Snort is anything not in HOME_NET is a potential bad guy. Are you doing something unique that needs local nets excluded from HOME_NET?

Bill

bmeeks

@Supermule:

THANKS Gogol!!

I am glad you are awake when I am not :D

@gogol:

@Supermule:

The new snort package blocks whitelisted WAN IP's and the 2.5.8 didnt.

I had the 1st block just a couple of minutes ago.

As far as I can see in your pictures (a few posts later) WAN IP is not blocked, but has the new + sign to add it to the suppress list. When it is blocked it has also an X!

I missed the fact as well that it was the ALERTS tab you were showing. You will get displayed alerts for whitelisted IPs, but no blocks. The whitelist prevents blocks on alerts, but does not suppress the alerts themselves.

Bill

Supermule

Thanks Bill! Another fantastic job from you!

shinzo

@bmeeks:

@shinzo:

sorry i was awake 8). Thanks for all the adds to the package. Noticed that in the Home Net to inspect tab, I set up a custom whitelist so only the wan ip would be checked but its still adding the lan subnet. In the Whitelist underneath External net, it does display correctly.

Yes, this was by design. HOME_NET defines the networks to protect, so it should include locally attached subnets. The general premise in Snort is anything not in HOME_NET is a potential bad guy. Are you doing something unique that needs local nets excluded from HOME_NET?

Bill

Nope nothing special, Just making sure its not a bug or anything.
I was only asking because of the WAN Variables. What ever i don't have running i try to set to the WAN ip so it doesn't it doesn't do the entire network(to try to increase performance). When the home_net didn't add the local network i could just leave all the variables blank, but i will just create an alias and define the servers manually.

Thanks again

shinzo

So i have been playing with the Host Attribute Table but cant seem to get it running correctly. I looked at a few examples but i keep getting
snort[****]: FATAL ERROR: /usr/local/etc/snort/snort_*_em0/snort.conf(253) Unknown config directive: max_attribute_hosts.

Can anyone provide a example to put in the Host Attribute data with just one host

bmeeks

@shinzo:

So i have been playing with the Host Attribute Table but cant seem to get it running correctly. I looked at a few examples but i keep getting
snort[****]: FATAL ERROR: /usr/local/etc/snort/snort_*_em0/snort.conf(253) Unknown config directive: max_attribute_hosts.

Can anyone provide a example to put in the Host Attribute data with just one host

I had this running in my VMware setup using a sample table Joel Esler posted in an article from several months back. Let me run a quick check and make sure something is not fat-fingered in my code. Your error indicates the feature is not being recognized by the binary, or there is syntax error in the snort.conf file.

UPDATE: It works in my VMware setup using the sample file attached to this post. Are you positive that your Snort binary got updated? Check by getting to the command line on the firewall and running this command:

/usr/local/bin/snort -V

This will print the version of the Snort binary. It should say 2.9.4.6. Also, there will be some lines down near the bottom of the snort.conf file for the interface that should look like these (although your path will be different for a 2.0.3 box):

# Host Attribute Table #
attribute_table filename /usr/pbi/snort-i386/etc/snort/snort_64703_em0/host_attributes
config max_attribute_hosts: 10000
config max_attribute_services_per_host: 10

Bill

HostAttributeTableSetup.txt

shinzo

I imported the file and it was a no go, i changed the ip to the subnet i was on and nothing also.

The version is correct. The path is /usr/local/etc/snort/snort_59927_em0/host_attributes which is correct also

bmeeks

@shinzo:

I imported the file and it was a no go, i changed the ip to the subnet i was on and nothing also.

The version is correct. The path is /usr/local/etc/snort/snort_59927_em0/host_attributes which is correct also

Do you have a section in snort.conf that is like the example I posted? The path to the Host Attribute file will be different for you since you have 2.0.3 and I posted a test from 2.1. Your error really points to a syntax error in the snort.conf file. Make sure the numbers actually contain only numeric characters (no extra spaces, for example). I didn't put any validation code around the inputs, so if a non-numeric character sneaks in that could trip up Snort as it parses the configuration.

Here is another test you can do to help pinpoint the problem. Run this sequence of commands. This will validate the snort.conf file and print out the line where an error is encountered.

cd /usr/local/etc/snort/snort_59927_em0
/usr/local/bin/snort -T -c ./snort.conf

shinzo

When i run the command, it says
ERROR: ./snort.conf(253) Unknown config directive: max_attribute_hosts.
Fatal Error, Quitting..

In the snort.conf file, its like the example you provied except for the path which is as stated before. I lowered the max_attribute_hosts number from 10,000 to 10 and made sure there was no spaces or anything and still the same

the 3 lines are
attribute_table filename /usr/local/etc/snort/snort_59927_em0/host_attributes
config max_attribute_hosts: 10
config max_attribute_services_per_host: 10

If i cat the host_attributes file it display the same as in the text file. If i VI into it, it has ^M at the end of every line except for the last

bmeeks

@shinzo:

When i run the command, it says
ERROR: ./snort.conf(253) Unknown config directive: max_attribute_hosts.
Fatal Error, Quitting..

In the snort.conf file, its like the example you provied except for the path which is as stated before. I lowered the max_attribute_hosts number from 10,000 to 10 and made sure there was no spaces or anything and still the same

OK. I've seen similar behavior before with another different directive in snort.conf. It may be choking not on the "max_attribute_hosts" value, but instead on the preceding line. Open the snort.conf in the vi editor and be sure nothing weird exists on the end of any of the lines in the Host Attribute Table section. Be sure the filename is correct and contains nothing padded onto the end. Save the file from the vi editor.

Now restart Snort using the command line shell script. Doing it this way will not rebuild the conf file. Doing anything from the GUI will rebuild the conf file, and if that is how an error is getting in, it will come back. Here is how to stop/start with the shell script:

/usr/local/etc/rc.d/snort.sh start

I'm using just "start", because with the error Snort is not starting. You can substitute "stop" or "restart" at other times.

Bill

bmeeks

@shinzo:

the 3 lines are
attribute_table filename /usr/local/etc/snort/snort_59927_em0/host_attributes
config max_attribute_hosts: 10
config max_attribute_services_per_host: 10

If i cat the host_attributes file it display the same as in the text file. If i VI into it, it has ^M at the end of every line except for the last

The ^M characters are just DOS line endings (CR/LF) instead of UNIX (LF). They are in my file and don't seem to confuse Snort.

Bill

bmeeks

@shinzo:

the 3 lines are
attribute_table filename /usr/local/etc/snort/snort_59927_em0/host_attributes
config max_attribute_hosts: 10
config max_attribute_services_per_host: 10

If i cat the host_attributes file it display the same as in the text file. If i VI into it, it has ^M at the end of every line except for the last

If you don't get to the bottom of this, send me your snort.conf file if you don't mind. I will PM you with my e-mail address. It's getting close to my bedtime here, so I'm logging out for tonight. Us old farts have to get our rest.. :D Will check back in tomorrow.

Bill

shinzo

Yeah i tried it again and no go, i dont mind sending you the file

shinzo

yeah i couldn't get it to work. I did what i was going to do another way. I added this to the Advanced configuration pass-through. This is pretty much a baseline for now

preprocessor frag3_engine: policy bsd bind_to 192.168.1.1 detect_anomalies timeout 60 overlap_limit 0 min_fragment_length 0
preprocessor frag3_engine: policy first bind_to 192.168.1.3 detect_anomalies timeout 60 overlap_limit 0 min_fragment_length 0
preprocessor frag3_engine: policy first bind_to 192.168.1.0/24 detect_anomalies timeout 60 overlap_limit 0 min_fragment_length 0
preprocessor stream5_tcp: policy bsd, bind_to 192.168.1.1, overlap_limit 0, timeout 30, ports both all, max_queued_bytes 1048576, max_queued_segs 2621
preprocessor stream5_tcp: policy windows, bind_to 192.168.1.3, overlap_limit 0, timeout 30, ports both all, max_queued_bytes 1048576, max_queued_segs 2621
preprocessor stream5_tcp: policy vista, bind_to 192.168.1.0/24, overlap_limit 0, timeout 30, ports both all, max_queued_bytes 1048576, max_queued_segs 2621
It works fine, as long as frag3 and stream5 have a default policy which they already do, i am able to bind specific ranges to other policies.

bmeeks

@shinzo:

yeah i couldn't get it to work. I did what i was going to do another way. I added this to the Advanced configuration pass-through. This is pretty much a baseline for now

preprocessor frag3_engine: policy bsd bind_to 192.168.1.1 detect_anomalies timeout 60 overlap_limit 0 min_fragment_length 0
preprocessor frag3_engine: policy first bind_to 192.168.1.3 detect_anomalies timeout 60 overlap_limit 0 min_fragment_length 0
preprocessor frag3_engine: policy first bind_to 192.168.1.0/24 detect_anomalies timeout 60 overlap_limit 0 min_fragment_length 0
preprocessor stream5_tcp: policy bsd, bind_to 192.168.1.1, overlap_limit 0, timeout 30, ports both all, max_queued_bytes 1048576, max_queued_segs 2621
preprocessor stream5_tcp: policy windows, bind_to 192.168.1.3, overlap_limit 0, timeout 30, ports both all, max_queued_bytes 1048576, max_queued_segs 2621
preprocessor stream5_tcp: policy vista, bind_to 192.168.1.0/24, overlap_limit 0, timeout 30, ports both all, max_queued_bytes 1048576, max_queued_segs 2621
It works fine, as long as frag3 and stream5 have a default policy which they already do, i am able to bind specific ranges to other policies.

This level of "multi-engine configurations" is coming in the next release. Now that the Snort binary is up to the latest version and we will have Snort VRT rules updates for a while, I can concentrate some time on getting the multi-engine configuration incorporated. Once done, you will be able to do things like this via the GUI. There will be a "default" or "global" section for each preprocessor, and then a table underneath where you can add additional rows that represent unique "engines" running under that preprocessor. I'm still working out in my head exactly how to structure it.

The Host Attribute Table feature can accomplish the same thing, but obviously needs third-party tools to generate the data.

I will troubleshoot why the Host Attribute Table is not working for you. One thing I need to validate is that the 2.0.x TBZ package file actually got compiled with "–enabled-targetbased" as an option. The Snort GUI is identical on 2.0.x and 2.1 pfSense, but the binaries are compiled on different servers. It could be that the new config directive for Target-Based support did not get switched on in the 2.0.x compile. I did my test yesterday on a 2.1 virtual machine. My 2.0.x VM also worked, but it was loaded with the binary compiled by my own test pfSense package builder. I need to download the 2.0.x package from pfSense and make sure it works as well.

Bill

giorgiolago

Hi i'm using this version: pfsense 2.1-RC0 (amd64) built on Wed Jun 19 07:03:30 EDT 2013 FreeBSD 8.3-RELEASE-p8 and i have many problems here:
1- stop/start button dont work, snort is always running independent I deactivate it or not by gui
2- suppression rules made through the web interface, still being shown on alerts tab

This is a bug ?