Suricata false postives?



  • Are these false positives or some other problem in Suricata?

    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.FileEncoder IP geolocation checkin attempt"; flow:to_server,established; dsize:214; urilen:1; content:"GET / HTTP/1.1|0D 0A|User-Agent: Mozilla/4.0 (compatible|3B| MSIE 6.0|3B| Windows NT 5.1|3B| SV1|3B| .NET4.0C|3B| .NET4.0E|3B| .NET CLR 2.0.50727|3B| .NET CLR 3.0.4506.2152|3B| .NET CLR 3.5.30729)|0D 0A|Host: ip-addr.es|0D 0A|Cache-Control: no-cache|0D 0A 0D 0A|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/17edf82c40df6c7268191def7cbff6e60e78d7388018408800d42581567f78cf/analysis/; classtype:trojan-activity; sid:33449; rev:1;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_47000_em0_vlan14/rules/suricata.rules at line 658
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Signature combines packet specific matches (like dsize, flags, ttl) with stream / state matching by matching on app layer proto (like using http_* keywords).
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Agent.BHHK variant outbound connection"; flow:to_server,established; dsize:136; urilen:1; content:"GET / HTTP/1.1|0D 0A|User-Agent: Mozilla/4.0 (compatible|3B| MSIE 7.0|3B| Windows NT 6.0)|0D 0A|Host: windowsupdate.microsoft.com|0D 0A|Connection: Close|0D 0A 0D 0A|"; fast_pattern:only; content:!"Accept"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/cab1fffe7a34b5bb7dab2cacd406cf15628d835ab63502d28df78c2faeaad366/analysis/1421677054/; classtype:trojan-activity; sid:33227; rev:2;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_47000_em0_vlan14/rules/suricata.rules at line 653
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Signature combines packet specific matches (like dsize, flags, ttl) with stream / state matching by matching on app layer proto (like using http_* keywords).
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Sodebral HTTP Response attempt"; flow:to_client,established; file_data; dsize:<194; content:"BRASIL"; depth:6; content:!"Content-Length"; http_header; content:"Transfer-Encoding: chunked"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/e0290c3900445dc00ca24888924e37fa6ac17ecaddc60591e32b81536b9f5ef7/analysis/; classtype:trojan-activity; sid:32608; rev:1;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_47000_em0_vlan14/rules/suricata.rules at line 608
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - "http_header" keyword seen with a sticky buffer still set. Reset sticky buffer with pkt_data before using the modifier.
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Sodebral HTTP Response attempt"; flow:to_client,established; file_data; dsize:<194; content:"INTERNACIONAL"; depth:13; content:!"Content-Length"; http_header; content:"Transfer-Encoding: chunked"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/e0290c3900445dc00ca24888924e37fa6ac17ecaddc60591e32b81536b9f5ef7/analysis/; classtype:trojan-activity; sid:32607; rev:1;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_47000_em0_vlan14/rules/suricata.rules at line 607
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - "http_header" keyword seen with a sticky buffer still set. Reset sticky buffer with pkt_data before using the modifier.
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bancos variant outbound connection "; flow:to_server,established; content:"Content-Length: 166"; content:".php HTTP/1.1|0D 0A|Accept: */*|0D 0A|Content-Type: application/x-www-form-urlencoded|0D 0A|User-Agent: Mozilla/5.0 (Windows NT 6.1|3B| Trident/7.0|3B| rv:11.0) like Gecko|0D 0A|Host: "; fast_pattern:only; content:"v="; depth:2; http_client_body; content:"&c="; within:7; http_client_body; pcre:"/\x3d\x3d$/P"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/51540d7c9a4bc2a430bc50c85cf9cec5c6f2bb755e800a3f3575ba34fe5f008c/analysis; classtype:trojan-activity; sid:29895; rev:1;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_47000_em0_vlan14/rules/suricata.rules at line 421
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - previous keyword has a fast_pattern:only; set. Can't have relative keywords around a fast_pattern only content
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.WEC variant outbound connection"; flow:to_server,established; dsize:69; urilen:1; content:"GET / HTTP/1.1|0D 0A|User-Agent: Mozilla/4.0|0D 0A|Host: checkip.dyndns.org|0D 0A 0D 0A|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/164c792247b2822ab1dce8271a9498d3c9172ff21d36feccf83265ded1be8d0b/analysis/; classtype:trojan-activity; sid:29882; rev:2;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_47000_em0_vlan14/rules/suricata.rules at line 417
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Signature combines packet specific matches (like dsize, flags, ttl) with stream / state matching by matching on app layer proto (like using http_* keywords).
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Injector variant outbound communication"; flow:to_server,established; urilen:9; content:"/load.exe HTTP/1.1|0D 0A|User-Agent: Mozilla/"; fast_pattern:only; content:"|3B 20|MSIE|20|"; http_header; content:")|0D 0A|Host: "; distance:0; http_header; content:!"Accept"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,urlquery.net/search.php?q=%5C%2Fload%5C.exe%24&type=regexp&start=2013-08-24&end=2013-11-22&max=400; reference:url,www.virustotal.com/en/file/032572ea1f34a060ecac98a8e2899dc0f2a41dff199e879050481ddd3818b4d0/analysis/; classtype:trojan-activity; sid:28807; rev:1;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_47000_em0_vlan14/rules/suricata.rules at line 299
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - previous keyword has a fast_pattern:only; set. Can't have relative keywords around a fast_pattern only content
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"MALWARE-CNC Win.Trojan.Conficker variant outbound connection"; flow:to_server,established; dsize:139; urilen:1; content:"GET / HTTP/1.1|0D 0A|User-Agent: Mozilla/4.0 (compatible|3B| MSIE 7.0|3B| Windows NT 5.1|3B| Trident/4.0)|0D 0A|Host: www.ask.com|0D 0A|Cache-Control: no-cache|0D 0A 0D 0A|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.sans.org/security-resources/malwarefaq/conficker-worm.php; classtype:trojan-activity; sid:28543; rev:1;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_47000_em0_vlan14/rules/suricata.rules at line 293
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Signature combines packet specific matches (like dsize, flags, ttl) with stream / state matching by matching on app layer proto (like using http_* keywords).
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"MALWARE-CNC Win.Trojan.Conficker variant outbound connection"; flow:to_server,established; dsize:146; urilen:1; content:"GET / HTTP/1.1|0D 0A|User-Agent: Mozilla/4.0 (compatible|3B| MSIE 7.0|3B| Windows NT 5.1|3B| Trident/4.0)|0D 0A|Host: checkip.dyndns.org|0D 0A|Cache-Control: no-cache|0D 0A 0D 0A|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.sans.org/security-resources/malwarefaq/conficker-worm.php; classtype:trojan-activity; sid:28542; rev:1;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_47000_em0_vlan14/rules/suricata.rules at line 292
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Signature combines packet specific matches (like dsize, flags, ttl) with stream / state matching by matching on app layer proto (like using http_* keywords).
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win32/Autorun.JN variant outbound connection"; flow:to_server,established; dsize:142; urilen:8; content:"/u5.htm"; fast_pattern:only; http_uri; content:"//u5.htm"; http_raw_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Worm%3AWin32%2FAutorun.JN; reference:url,www.virustotal.com/en/file/36144738373c665d262bc007fceaeb9613e59ec29ea3d7424dd9f400af2c0f06/analysis/; classtype:trojan-activity; sid:26966; rev:3;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_47000_em0_vlan14/rules/suricata.rules at line 188
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Signature combines packet specific matches (like dsize, flags, ttl) with stream / state matching by matching on app layer proto (like using http_* keywords).
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Bancos fake JPG encrypted config file download"; flow:to_server,established; content:".com.br|0D 0A 0D 0A|"; fast_pattern:only; content:"/imagens/"; depth:9; http_uri; content:".jpg"; distance:0; http_uri; pcre:"/\.jpg\x20HTTP\/1\.[01]\r\nUser\x2dAgent\x3a\x20[a-z]+\r\nHost\x3a\x20[a-z0-9\x2d\x2e]+\.com\.br\r\n\r\n$/"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:26722; rev:1;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_47000_em0_vlan14/rules/suricata.rules at line 130
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - previous keyword has a fast_pattern:only; set. Can't have relative keywords around a fast_pattern only content
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Trojan.Zeus Spam 2013 dated zip/exe HTTP Response - potential malware download"; flow:to_client,established; content:"-2013.zip|0D 0A|"; fast_pattern:only; content:"-2013.zip|0D 0A|"; http_header; content:"-"; within:1; distance:-14; http_header; file_data; content:"-2013.exe"; content:"-"; within:1; distance:-14; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/2eff3ee6ac7f5bf85e4ebcbe51974d0708cef666581ef1385c628233614b22c0/analysis/; classtype:trojan-activity; sid:26470; rev:1;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_47000_em0_vlan14/rules/suricata.rules at line 95
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - previous keyword has a fast_pattern:only; set. Can't have relative keywords around a fast_pattern only content
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"MALWARE-CNC Win.Trojan.Fakeavlock variant outbound connection"; flow:to_server,established; dsize:267<>276; content:"User-Agent|3A| Mozilla/5.0 (Windows|3B| U|3B| MSIE 9.0|3B| Windows NT 9.0|3B| en-US)|0D 0A|"; fast_pattern:only; http_header; urilen:159; pcre:"/\x2f[A-F0-9]{158}/U"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/file/c49f7dbc036ad0a86df02cbbde00cb3b3fbd651d82f6c9c5a98170644374f64f/analysis/; classtype:trojan-activity; sid:25675; rev:7;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_47000_em0_vlan14/rules/suricata.rules at line 62
    Oct 19 14:40:51 	suricata: 19/10/2015 -- 14:40:51 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Signature combines packet specific matches (like dsize, flags, ttl) with stream / state matching by matching on app layer proto (like using http_* keywords).
    Oct 19 14:40:50 	suricata: 19/10/2015 -- 14:40:50 - <notice>-- This is Suricata version 2.0.8 RELEASE</notice></error></error></error></error></error></error></error></error></error></error></error></error></error></error></error></error></error></error></error></error></error></error></error></error></error></error> 
    

  • Banned

    No, those are not FPs. Those are Snort rules incompatible with Suricata.

    P.S. Kindly use the nifty # button to post code/logs in future.



  • Thanks, and edited to for```
    .



  • As @doktornotor stated, there are (at last count according to my feeble memory) nearly 800 Snort VRT rules that use syntax incompatible with the current Suricata rules engine.  There are requests over on the Suricata Redmine site to add the necessary syntax support in later Suricata versions.  Once that support is incorporated into Suricata upstream and then the FreeBSD port is also updated, it will be available in pfSense.

    Until then, all users of Suricata should note that a significant number of Snort VRT rules will generate syntax errors and not be loaded or used by Suricata.  Suricata will print error messages (as posted by the OP) that show which specific rules failed to load.

    Bill



  • I spent about 20mins looking at these rules and reading around to get an understanding of what data these rules contain to work.

    Would you say this problem is simply a syntax translation/find & replace issue, ie snort using dsize, but suricata cant use dsize as an example?



  • @firewalluser:

    I spent about 20mins looking at these rules and reading around to get an understanding of what data these rules contain to work.

    Would you say this problem is simply a syntax translation/find & replace issue, ie snort using dsize, but suricata cant use dsize as an example?

    Yes, the problem is Snort recognizes certain rule option keywords that Suricata does not.  Also, there are some options Snort can do that Suricata can't and vice-versa.  If you look in the Suricata log file, it will show a final tally of how many VRT rules were ignored.  It won't specifically identify them as VRT, but just as rule errors.  I can tell you, though, that only Snort VRT rules will generate those errors.  The Emerging Threats rules that Suricata downloads are specifically written/tailored for Suricata.

    Simply doing a find/replace to remove one keyword and insert another is not a global fix.  As I mentioned, there are some things Snort does that Suricata cannot in terms of using those keywords.  And without the keywords/options, the rules would likely not perform their intended task anyway.

    So the short answer is the preferred configuration is to use just Emerging Threats rules with Suricata because the package downloads the Suricata-optimized version of that rules package.  Otherwise, just understand that around 800 Snort VRT rules are incompatible with Suricata and won't load and thus can't generate alerts.  I'm not saying the VRT rules can't be used at all with Suricata, just that ALL of them can't be used with Suricata.

    Bill



  • I was thinking how difficult would it be to parse the snort rules into a format suricata can use. Whilst I appreciate some things suricata does is not present in snort, if the snort rules could be made suricata friendly by parsing them properly in an automated fashion, then it would be a step closer, besides with virus total and other online sources I also wondered how hard it would be to draw in the various signatures to build a rule database of my own, copyrights permitting from the various online sources.

    It wouldnt take long to build a windows app probably less than a day knock something up to pulled down data from known sources, then parse this sort of stuff into a database and then rehash it to various formats, and then it could run as a service on a windows box just doing that job keeping itself upto date before posting the output online somewhere for it to be useful for others as well as myself.



  • @bmeeks:

    As @doktornotor stated, there are (at last count according to my feeble memory) nearly 800 Snort VRT rules that use syntax incompatible with the current Suricata rules engine.  There are requests over on the Suricata Redmine site to add the necessary syntax support in later Suricata versions.

    If there are around 800 Snort VRT rules that dont work, why doesnt the system log show error 800 ERRCODE: SC_ERR_INVALID_SIGNATURE(39) errors in the system log, or a total of around 800 errors regarding problems with suricata?

    Do you have a link to the redmine issue regarding this as I've been through all 9 pages of issues at this link
    https://redmine.openinfosecfoundation.org/projects/suricata/issues?page=9&set_filter=1&tracker_id=1

    searching for "snort" or "snort vrt" and I cant find any open issues, plenty of feature requests and closed requests but no open issues using the word "snort"

    I have found 6 issues refering to "snort vrt" which are closed and these appear to have been closed over 5 years ago.
    https://redmine.openinfosecfoundation.org/issues/220
    https://redmine.openinfosecfoundation.org/issues/204
    https://redmine.openinfosecfoundation.org/issues/219
    https://redmine.openinfosecfoundation.org/issues/188
    https://redmine.openinfosecfoundation.org/issues/97
    https://redmine.openinfosecfoundation.org/issues/96

    So if you can provide me with a link to the open issue in suricata's redmine that would be useful, thanks.


  • Banned

    Sigh. Please, read the above explanation again. This is NOT a package issue, this is NOT pfSense issue either. It's simply a Suricata limitation with using VRT rules. There is no such thing like 1:1 compatibility with Snort rules, so incompatible rules are simply skipped.

    (And, WHY THE HECK would you want to flood syslog with 800 warnings?!? Are you mad? You have that noise in suricata logs if you are interested.)



  • @bmeeks:

    As @doktornotor stated, there are (at last count according to my feeble memory) nearly 800 Snort VRT rules that use syntax incompatible with the current Suricata rules engine.  There are requests over on the Suricata Redmine site to add the necessary syntax support in later Suricata versions. Once that support is incorporated into Suricata upstream and then the FreeBSD port is also updated, it will be available in pfSense.

    Until then, all users of Suricata should note that a significant number of Snort VRT rules will generate syntax errors and not be loaded or used by Suricata.  Suricata will print error messages (as posted by the OP) that show which specific rules failed to load.

    Bill

    I'm just trying to find the link, as Bill mentioned it, I did NOT say it was a package issue, I did NOT say it was a pfsense issue.

    I'm trying to find out why I'm not seeing a significant number of syntax errors in the system log when the option is checked to send the messages to the system log and in the syslog. It would be wise to find out what works and what doesnt wouldnt you say?

    As to flooding the syslog server, if someone is using a syslog server than cant handle a flood of messages, they need to change their setup, besides it would be useful to know what in the VRT works and what doesnt, which is all I'm trying to find out.


  • Banned

    As to flooding, there's a circular log on pfSense that can certainly serve MUCH better purpose than flooding it with absolutely useless duplicate shit that you are too lazy to find in the proper place.



  • Well I seem to be having problems with the logs at the moment as you can see from these posts.
    https://forum.pfsense.org/index.php?topic=101692.0

    And as you can see from this post, theres messages appearing in the console but not in the logs.
    https://forum.pfsense.org/index.php?topic=101408.0

    So with these problems its probably best to get a copy all messages out of the fw for any post mortem analysis.

    As it happens I've had to reinstall pfsense from scratch again this morning as reseting the system logs and rebooting the fw didnt sort the problem of the disappearing system logs, along with other oddities.

    With regard to whether this is absolutely useless duplicate shit, thats a matter of opinion, I guess you cant spot the significance and thus importance of logging data, its how you find anomalies with the system, for when systems get hacked.



  • The choice of exactly what is logged where is handled by the Suricata binary. I think rule syntax errors always go to the Suricata log.  You can find it under the LOGS VIEW tab and then selecting the Suricata.log file to view.



  • I know those SC_ERR_INVALID_SIGNATURE messages appear in Services, Suricata, Logs View Tab, Suricata.log, they are the same ones replicated in the system log when you tick the option, Services, Suricata, Global Settings, General Settings section, Log to System Log.

    As I cant find the 800 odd snort VRT rules as cited by yourself which dont work with suricata, I've been trying to track this down.

    I do see info messages saying

    18374 rules successfully loaded, 13 rules failed
    

    but no mention of the 26 messages with SC_ERR_INVALID_SIGNATURE.

    So you see there are some inconsistency in whats being said and what is being seen on the ground, and I'm trying to establish what is actually going on.

    Likewise in this thread https://forum.pfsense.org/index.php?topic=101682.0
    Vane makes the statement Suricata is an Intrusion Detection System (IDS) not an Intrusion Protection System (IPS), you state

    The design simply triggers off any alert and the source and/or destination IP address is inserted into the snort2c table.  Because the blocking mechanism depends on libpcap and getting copies of packets for inspection by Suricata or Snort, there is no real support for DROP or REJECT.  In other words, there is no inline mode available and thus those rule operations make no sense on pfSense at the moment.

    Can I also make a suggestion that the description for the Suricata package description is an accurate representation of its current capabilities.

    Currently the Package manager states

    High Performance Network IDS, IPS and Security Monitoring engine by OISF

    which is misleading to pfsense users looking for an IDS where the functionality doesnt exist in PFSense.

    In the long term its not good for business for pfsense in general to claim its got every bell and whistle under the sun, when much of the functionality is yet to be implemented, or is implemented incorrectly so that holes exist in the firewall leaving many users systems vulnerable.

    And if you cant provide the link to the request in the Suricata redmine, just say so instead of avoiding the question.

    You guys have now been called out, lets see how you respond as your business future depends on it, because this is not the only thing wrong with pfsense!


  • Banned

    Dude - you realize this package is maintained by a volunteer maintainer for free? WTF is that business you are talking about? WTF is wrong with you? The only "business" here for bmeeks is spending tons of his free time on the project.

    You take absolute non-issue and start attacking the volunteer maintainer who's damn one heck of a good job when maintaining these complex Snort/Suricata monsters for users?

    You don't like it? You say not good enough? How much did you pay for this? Ah, right - $0. So, if you don't like it and it ain't good enough for you, may I suggest that you move your fucking ass and produce some work to make it better!

    Incredible. Is your head overheating from too much tinfoil applied?

    :( >:( >:(



  • You obviously dont value the time volunteers as you like to call them, spend time testing the aforementioned output by volunteers and then you have the audacity to shoot the volunteer messenger down in flames.

    Dude, you need to re evaluate yourself.

    Criticism is constructive feedback, if you hadn't worked it out!


  • Banned

    That incoherent blurb you produced above has nothing to do with constructive criticism. You've already been told what's the "issue" here, but apparently you are just too dumb to understand it, yet apparently "qualified" enough to advise people about their business. Just piss off, really.



  • Go back to school if you dont understand English, at least then you might be able to learn something.

    All I'm asking for is links to the requests in Suricata's Redmine so I can look over these 800 Snort VRT rules which are syntactically incompatible.

    You see, here https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Known_issues it states known issues, one being

    Signature language support

    Suricata supports Snort's signature language. We've focused on Snort version 2.9.x, which is not fully complete yet. ET/ETpro is fully supported, VRT support is steadily improving.

    But as the wiki has not been updated since 2.0.3 and Suricata is now 2.0.9 stable and beta 2.1.beta4 with all references to "snort vrt" found in redmine being closed, that doesnt tie in with the pfsense Suricata 2.1.7 version shown in the package manager so I'm still trying to find out what these 800 odd incompatible snort vrt rules are, hence the request for a link.

    Instead of wasting so much time getting defensive and abusive why don't you just answer the question by providing a link?


  • Banned

    If you want to see those ~800 rules incompatible with Suricata to "look over them", then simply go to the damned GUI, enable all categories and all rules and look at the log. Why should I provide you with some links when you behave like an idiot?!



  • But that only gives my 70 odd errors in total now which is not the 800 odd originally cited, I'd already looked at that before.

    But heres another problem if you think you are so clever, only the suricata.log messages for the last interface appears in the system log. So a user has no way of knowing if a problem exists on any other interface.

    Or should I quote here? https://forum.pfsense.org/index.php?topic=101668.msg567130#msg567130


  • Banned

    Yeah, so what? How the heck does it matter how many of them are incompatible? They simply are incompatible, noone counts them, except for apparently you because you have no better things to do than harassing maintainers with crap, this ain't any bug but well known Suricata limitation with Snort rules. Move on and perhaps try to produce something useful, like submitting patches upstream to make those rules compatible.

    Besides, your testing skills miserably suck, with a short look at the log noise (which you'd like to flood syslog with!!!) shows

    
    3/11/2015 -- 00:47:02 - <info>-- 3 rule files processed. 15947 rules successfully loaded, 1632 rules failed</info> 
    

    At minimum, please stop suggesting that everyone's general syslog should be flooded with crap such as:

    
    3/11/2015 -- 00:47:02 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-IDENTIFY GIF file magic detected"; flow:to_server,established; file_data; content:"GIF8"; depth:4; fast_pattern; content:"a"; within:1; distance:1; flowbits:set,file.gif; flowbits:noalert; metadata:service smtp; classtype:misc-activity; sid:23647; rev:5;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_13310_em0/rules/flowbit-required.rules at line 850
    3/11/2015 -- 00:47:02 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Can't use file_data with flow:to_server or from_client with http.
    3/11/2015 -- 00:47:02 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-IDENTIFY RealNetworks Real Media file magic detected"; flow:to_server,established; file_data; content:".RMF"; depth:4; flowbits:set,file.realplayer; flowbits:noalert; metadata:service smtp; classtype:misc-activity; sid:23645; rev:6;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_13310_em0/rules/flowbit-required.rules at line 853
    3/11/2015 -- 00:47:02 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Can't use file_data with flow:to_server or from_client with http.
    3/11/2015 -- 00:47:02 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-IDENTIFY MPEG sys stream file magic detected"; flow:to_server,established; file_data; content:"|00 00 01 BA|"; depth:4; flowbits:set,file.mpeg; flowbits:noalert; metadata:service smtp; classtype:misc-activity; sid:23640; rev:8;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_13310_em0/rules/flowbit-required.rules at line 856
    3/11/2015 -- 00:47:02 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Can't use file_data with flow:to_server or from_client with http.
    3/11/2015 -- 00:47:02 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-IDENTIFY MPEG video stream file magic detected"; flow:to_server,established; file_data; content:"|00 00 01 B3|"; depth:4; flowbits:set,file.mpeg; flowbits:noalert; metadata:service smtp; classtype:misc-activity; sid:23639; rev:8;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_13310_em0/rules/flowbit-required.rules at line 859
    3/11/2015 -- 00:47:02 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Can't use file_data with flow:to_server or from_client with http.
    3/11/2015 -- 00:47:02 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-IDENTIFY Adobe LZMA compressed Flash file magic detected"; flow:to_server,established; file_data; content:"ZWS"; depth:3; flowbits:set,file.swf; flowbits:noalert; metadata:service smtp; classtype:misc-activity; sid:35458; rev:1;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_13310_em0/rules/flowbit-required.rules at line 1750
    3/11/2015 -- 00:47:02 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Can't use file_data with flow:to_server or from_client with http.
    3/11/2015 -- 00:47:02 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-IDENTIFY M4A file magic detected"; flow:to_server,established; file_data; content:"ftypM4A"; depth:7; offset:4; flowbits:set,file.mp4; flowbits:noalert; metadata:service smtp; classtype:misc-activity; sid:35433; rev:2;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_13310_em0/rules/flowbit-required.rules at line 1762
    3/11/2015 -- 00:47:02 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Can't use file_data with flow:to_server or from_client with http.
    3/11/2015 -- 00:47:02 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"FILE-IDENTIFY JPEG file upload detected"; flow:to_server,established; file_data; content:"|FF D8 FF E1|"; depth:4; flowbits:set,file.jpeg; flowbits:noalert; metadata:service http; classtype:misc-activity; sid:35852; rev:1;)" from file /usr/pbi/suricata-amd64/etc/suricata/suricata_13310_em0/rules/flowbit-required.rules at line 1768
    3/11/2015 -- 00:47:02 - <error>-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Can't use file_data with flow:to_server or from_client with http.</error></error></error></error></error></error></error></error></error></error></error></error></error></error> 
    

    FFS. Ktnxbye.  >:(


Log in to reply