Snort - Host Attributes Table - inlcude pfsense interfaces as hosts?

maex

Hi,
when creating configuration files using nmap and hogger the interfaces of the pfsense box (which runs snort) get included as hosts too.
Should I leave them in the host attributes table or remove them?
Max

PS:Thanks for the wonderful packages!!

bmeeks

@maex:

Hi,
when creating configuration files using nmap and hogger the interfaces of the pfsense box (which runs snort) get included as hosts too.
Should I leave them in the host attributes table or remove them?
Max

PS:Thanks for the wonderful packages!!

I personally would not include the pfSense interfaces in the Host Attribute Table (but I guess there is no real harm if you do). The real usefulness for this feature is customizing Snort's detection and preprocessor engines for the various hosts Snort is protecting.

Bill

maex

Thanks a lot, Bill.

Hogger seems to create unusable files.
I am getting:
snort[28040]: FATAL ERROR: /usr/local/etc/snort/snort_7277_igb0/snort.conf(272) ==> failed to load attribute table from /usr/local/etc/snort/snort_7277_igb0/host_attributes

Do you know of a good tutorial on how to create these files?
Especially I lack the orientation on what the possible values are. E.g. Should I use the nmap value ssl/http or https as protocol?
I only find very few samples. And I wonder if the file format has changed since hogger was published.

Could you please point me to a comprehensive example?

Thank you again.

bmeeks

@maex:

Thanks a lot, Bill.

Hogger seems to create unusable files.
I am getting:
snort[28040]: FATAL ERROR: /usr/local/etc/snort/snort_7277_igb0/snort.conf(272) ==> failed to load attribute table from /usr/local/etc/snort/snort_7277_igb0/host_attributes

Do you know of a good tutorial on how to create these files?
Especially I lack the orientation on what the possible values are. E.g. Should I use the nmap value ssl/http or https as protocol?
I only find very few samples. And I wonder if the file format has changed since hogger was published.

Could you please point me to a comprehensive example?

Thank you again.

I found this sample file (attached) that was put together from one of the core Snort VRT guys, Joel Esler. I used it during my testing of the Host Attribute Table feature. I have not actually done a nmap/hogger run, but will. I did the nmap scan but then got distracted on another project and never processed it the rest of the way. I will do so to see what problems, if any, I encounter.

The attached file was copied from this online article from 2010 by Joel:

http://www.csoonline.com/article/546763/tuning-snort-with-host-attribute-tables

I've never run across a really great document reference for the Host Attribute Table.
Bill

HostAttributeTableSetup.txt

maex

Hi Bill,
I tested your file and it does work. Thank you very much.

A readable overview of current nmap detectable OSes can be found here: http://nmap.org/data/os-classes.txt

Found some indications of policies in https://github.com/jasonish/snort/blob/master/src/preprocessors/Stream5/snort_stream5_tcp.c (or download snort source to get it.):
/* enum for policy names */
static char *reassembly_policy_names[] = {
"no policy!",
"FIRST",
"LINUX",
"BSD",
"OLD LINUX",
"LAST",
"WINDOWS",
"SOLARIS",
"HPUX11",
"IRIX",
"MACOS",
"HPUX10",
"WINDOWS VISTA",
"WINDOWS 2003"
"IPS"
};

Would you choose WINDOWS 2003 frag policy for a windows 2008 Server?

Thank you!
BR, Max

bmeeks

@maex:

Hi Bill,
I tested your file and it does work. Thank you very much.

A readable overview of current nmap detectable OSes can be found here: http://nmap.org/data/os-classes.txt

Found some indications of policies in https://github.com/jasonish/snort/blob/master/src/preprocessors/Stream5/snort_stream5_tcp.c (or download snort source to get it.):
/* enum for policy names */
static char *reassembly_policy_names[] = {
"no policy!",
"FIRST",
"LINUX",
"BSD",
"OLD LINUX",
"LAST",
"WINDOWS",
"SOLARIS",
"HPUX11",
"IRIX",
"MACOS",
"HPUX10",
"WINDOWS VISTA",
"WINDOWS 2003"
"IPS"
};

Would you choose WINDOWS 2003 frag policy for a windows 2008 Server?

Thank you!
BR, Max

Just a hunch, and this is not based on any research, but I would choose Windows Vista for Windows 2008 over Windows 2003. It seems that for a number of other things, Vista and Windows 7 more closely resemble Windows 2008 and 2008 R2 than does Windows 2003. One place is hardware drivers, for instance. Usually something that works on Vista has a decent chance of working on 2008, and pretty much any Windows 7 driver is likely to work on 2008.

Bill

maex

Thanks!