Snort alerts

demian

hi everyone, Recently I deployed Snort on my pfsense box, everything is going fine(I think) but on snort alerts tab I see a lot of this messages:
05/22/13-10:30:46 3 TCP Unknown Traffic 208.51.35.50 80 200.108.136.46 41052 119:32:1 (http_inspect) SIMPLE REQUEST
05/22/13-10:30:40 3 TCP Unknown Traffic 200.108.136.46 41953 50.116.194.21 80 120:8:1 (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE
05/22/13-10:30:39 3 TCP Unknown Traffic 200.108.136.46 14305 50.116.194.21 80 120:8:1 (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE
05/22/13-10:30:31 3 TCP Unknown Traffic 200.108.136.46 46228 206.191.168.170 80 120:8:1 (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE

I dont know what does it mean.. Could you help me please?
Thanks!

bmeeks

@demian:

hi everyone, Recently I deployed Snort on my pfsense box, everything is going fine(I think) but on snort alerts tab I see a lot of this messages:
05/22/13-10:30:46 3 TCP Unknown Traffic 208.51.35.50 80 200.108.136.46 41052 119:32:1 (http_inspect) SIMPLE REQUEST
05/22/13-10:30:40 3 TCP Unknown Traffic 200.108.136.46 41953 50.116.194.21 80 120:8:1 (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE
05/22/13-10:30:39 3 TCP Unknown Traffic 200.108.136.46 14305 50.116.194.21 80 120:8:1 (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE
05/22/13-10:30:31 3 TCP Unknown Traffic 200.108.136.46 46228 206.191.168.170 80 120:8:1 (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE

I dont know what does it mean.. Could you help me please?
Thanks!

Welcome to the confusing world of the HTTP_INSPECT preprocessor and all of its alerts. Basically Snort's HTTP_INSPECT preprocessor is alerting when some part of a web request or reply does not precisely match the published standards. As you probably are noticing, many legitimate web sites seem to spew poorly constructed HTML. Yahoo is one prime example, but there are others.

You can research these various alert messages on Google and get an explanation of what they mean. Many folks either WHITELIST known good web sites to prevent blocking of them, or they add the GENERATOR ID and SIGNATURE ID of the alert to the Suppress List for the interface.

A third option available is to disable HTTP_INSPECT alerts entirely. There is a checkbox for this on the Preprocessors tab in Snort.

Bill

demian

Thanks!!
Appreciate it!!

simi8

thanks, it was useful also for me!