[Snort-users] stream4_reassembly problems
Eric J. Bowser
--------------enig3958CE771BAE1CC076207671
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Hi All,
It seems like stream4 reassembly is quite often lumping packets together
unnecessarily. I'm running snort 2.4.3 with mySQL support compiled in an=
d
the SPADE patch, on RedHat 9.0.
For example, here is a packet dump, captured by a rule from bleeding edge=
,
"MALWARE Fun Web Products Spyware User Agent (1)" I have clipped the dat=
a
to only show the user agent portions, and prevent revealing anything priv=
ate.
Based on the contents, it seems there are three separate GET requests her=
e,
to three different sites, from three different web browsers on three
different machines.
Why are these lumped together into a single packet and passed to snort fo=
r
scanning? The IP address reported by snort in the packet headers is not
event the infected machine! The entire packet logged by snort is 1875 by=
tes
long by the way...
This is happening on several rules, and is even causing false positives
because of multiple packets being lumped together.
Thanks for any direction you can provide...
=2E..
030 : 6F 6F 67 6C 65 2E 63 6F 6D 0D 0A 55 73 65 72 2D oogle.com..User-
040 : 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 35 Agent: Mozilla/5
050 : 2E 30 20 28 57 69 6E 64 6F 77 73 3B 20 55 3B 20 .0 (Windows; U;
060 : 57 69 6E 64 6F 77 73 20 4E 54 20 35 2E 31 3B 20 Windows NT 5.1;
070 : 65 6E 2D 55 53 3B 20 72 76 3A 31 2E 38 2E 30 2E en-US; rv:1.8.0.
080 : 32 3B 20 47 6F 6F 67 6C 65 2D 54 52 2D 31 29 20 2; Google-TR-1)
090 : 47 65 63 6B 6F 2F 32 30 30 36 30 33 30 38 20 46 Gecko/20060308 F
0a0 : 69 72 65 66 6F 78 2F 31 2E 35 2E 30 2E 32 0D 0A irefox/1.5.0.2..
=2E..
440 : 3A 32 34 61 22 0D 0A 55 73 65 72 2D 41 67 65 6E :24a"..User-Agen
450 : 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 t: Mozilla/4.0 (
460 : 63 6F 6D 70 61 74 69 62 6C 65 3B 20 4D 53 49 45 compatible; MSIE
470 : 20 36 2E 30 3B 20 57 69 6E 64 6F 77 73 20 4E 54 6.0; Windows NT
480 : 20 35 2E 31 3B 20 53 56 31 3B 20 46 75 6E 57 65 5.1; SV1; FunWe
490 : 62 50 72 6F 64 75 63 74 73 3B 20 2E 4E 45 54 20 bProducts; .NET
4a0 : 43 4C 52 20 31 2E 31 2E 34 33 32 32 29 0D 0A 48 CLR 1.1.4322)..H
4b0 : 6F 73 74 3A 20 69 6D 61 67 65 73 32 2E 73 69 6E ost: images2.sin
=2E..
610 : 65 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 4D e..User-Agent: M
620 : 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 63 6F 6D 70 ozilla/4.0 (comp
630 : 61 74 69 62 6C 65 3B 20 4D 53 49 45 20 36 2E 30 atible; MSIE 6.0
640 : 3B 20 57 69 6E 64 6F 77 73 20 4E 54 20 35 2E 31 ; Windows NT 5.1
650 : 3B 20 53 56 31 3B 20 2E 4E 45 54 20 43 4C 52 20 ; SV1; .NET CLR
660 : 31 2E 31 2E 34 33 32 32 3B 20 49 6E 66 6F 50 61 1.1.4322; InfoPa
670 : 74 68 2E 31 29 0D 0A 48 6F 73 74 3A 20 63 6F 6E th.1)..Host: con
--=20
Eric J. Bowser
Bright.Net NE / Doylestown Communications, Inc.
800-535-6423 toll-free
www.neobright.net
www.doyestowncommunications.com
=C2=A8Providing advanced communications since 1899.=C2=A8
--------------enig3958CE771BAE1CC076207671
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQFEWQTuv/qInDvk8ugRAjYaAJ9KSrm4SXvgm5CnuqyWo6RQHjI+rACggwFL
h8DHIclGUNZwjufppghZ0p8=
=A1A5
-----END PGP SIGNATURE-----
--------------enig3958CE771BAE1CC076207671--
-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort...@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
Gentoo-Wally
'flush_behavior' setting in stream4. The one time I saw this I had
'flush_behavior large_window' set. I would check this first.
Wally
> ...
> 030 : 6F 6F 67 6C 65 2E 63 6F 6D 0D 0A 55 73 65 72 2D oogle.com..User-
> 040 : 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 35 Agent: Mozilla/5
> 050 : 2E 30 20 28 57 69 6E 64 6F 77 73 3B 20 55 3B 20 .0 (Windows; U;
> 060 : 57 69 6E 64 6F 77 73 20 4E 54 20 35 2E 31 3B 20 Windows NT 5.1;
> 070 : 65 6E 2D 55 53 3B 20 72 76 3A 31 2E 38 2E 30 2E en-US; rv:1.8.0.
> 080 : 32 3B 20 47 6F 6F 67 6C 65 2D 54 52 2D 31 29 20 2; Google-TR-1)
> 090 : 47 65 63 6B 6F 2F 32 30 30 36 30 33 30 38 20 46 Gecko/20060308 F
> 0a0 : 69 72 65 66 6F 78 2F 31 2E 35 2E 30 2E 32 0D 0A irefox/1.5.0.2..
> ...
> 440 : 3A 32 34 61 22 0D 0A 55 73 65 72 2D 41 67 65 6E :24a"..User-Agen
> 450 : 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 t: Mozilla/4.0 (
> 460 : 63 6F 6D 70 61 74 69 62 6C 65 3B 20 4D 53 49 45 compatible; MSIE
> 470 : 20 36 2E 30 3B 20 57 69 6E 64 6F 77 73 20 4E 54 6.0; Windows NT
> 480 : 20 35 2E 31 3B 20 53 56 31 3B 20 46 75 6E 57 65 5.1; SV1; FunWe
> 490 : 62 50 72 6F 64 75 63 74 73 3B 20 2E 4E 45 54 20 bProducts; .NET
> 4a0 : 43 4C 52 20 31 2E 31 2E 34 33 32 32 29 0D 0A 48 CLR 1.1.4322)..H
> 4b0 : 6F 73 74 3A 20 69 6D 61 67 65 73 32 2E 73 69 6E ost: images2.sin
> ...
> 610 : 65 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 4D e..User-Agent: M
> 620 : 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 63 6F 6D 70 ozilla/4.0 (comp
> 630 : 61 74 69 62 6C 65 3B 20 4D 53 49 45 20 36 2E 30 atible; MSIE 6.0
> 640 : 3B 20 57 69 6E 64 6F 77 73 20 4E 54 20 35 2E 31 ; Windows NT 5.1
> 650 : 3B 20 53 56 31 3B 20 2E 4E 45 54 20 43 4C 52 20 ; SV1; .NET CLR
> 660 : 31 2E 31 2E 34 33 32 32 3B 20 49 6E 66 6F 50 61 1.1.4322; InfoPa
> 670 : 74 68 2E 31 29 0D 0A 48 6F 73 74 3A 20 63 6F 6E th.1)..Host: con
>
> --
> Eric J. Bowser
> Bright.Net NE / Doylestown Communications, Inc.
> 800-535-6423 toll-free
> www.neobright.net
> www.doyestowncommunications.com
>
> =A8Providing advanced communications since 1899.=A8
Eric J. Bowser
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
I'm afraid I don't fully understand the plugin, and the docs don't make i=
t
too clear.
All I have set in the conf related to stream4_reassemble is to turn it on=
:
"preprocessor stream4_reassemble"
What is the default flush behavior? Do you have a suggestion as to what
setting I should try next, or better yet, a method I could follow to
determine what setting is "right" for my network?
Thanks much,
Eric
Gentoo-Wally wrote:
> I've seen this before. It probably has to do with your
> 'flush_behavior' setting in stream4. The one time I saw this I had
> 'flush_behavior large_window' set. I would check this first.
>=20
> Wally
>=20
> On 5/3/06, Eric J. Bowser <ebo...@neobright.net> wrote:
>=20
>> Hi All,
>>
>> It seems like stream4 reassembly is quite often lumping packets togeth=
er
>> unnecessarily. I'm running snort 2.4.3 with mySQL support compiled in=
>> and
>> the SPADE patch, on RedHat 9.0.
>>
>> For example, here is a packet dump, captured by a rule from bleeding
>> edge,
>> "MALWARE Fun Web Products Spyware User Agent (1)" I have clipped the
>> data
>> to only show the user agent portions, and prevent revealing anything
>> private.
>>
>> Based on the contents, it seems there are three separate GET requests
>> here,
>> to three different sites, from three different web browsers on three
>> different machines.
>>
>> Why are these lumped together into a single packet and passed to snort=
>> for
>> scanning? The IP address reported by snort in the packet headers is n=
ot
>> event the infected machine! The entire packet logged by snort is 1875=
>> bytes
>> long by the way...
>>
>> This is happening on several rules, and is even causing false positive=
s
>> because of multiple packets being lumped together.
>>
>> Thanks for any direction you can provide...
>>
>> ...
>> 030 : 6F 6F 67 6C 65 2E 63 6F 6D 0D 0A 55 73 65 72 2D oogle.com..Use=
r-
>> 040 : 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 35 Agent: Mozilla=
/5
>> 050 : 2E 30 20 28 57 69 6E 64 6F 77 73 3B 20 55 3B 20 .0 (Windows; U=
;
>> 060 : 57 69 6E 64 6F 77 73 20 4E 54 20 35 2E 31 3B 20 Windows NT 5.1=
;
>> 070 : 65 6E 2D 55 53 3B 20 72 76 3A 31 2E 38 2E 30 2E en-US; rv:1.8.=
0.
>> 080 : 32 3B 20 47 6F 6F 67 6C 65 2D 54 52 2D 31 29 20 2; Google-TR-1=
)
>> 090 : 47 65 63 6B 6F 2F 32 30 30 36 30 33 30 38 20 46 Gecko/20060308=
F
>> 0a0 : 69 72 65 66 6F 78 2F 31 2E 35 2E 30 2E 32 0D 0A irefox/1.5.0.2=
=2E.
>> ...
>> 440 : 3A 32 34 61 22 0D 0A 55 73 65 72 2D 41 67 65 6E :24a"..User-Ag=
en
>> 450 : 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 t: Mozilla/4.0=
(
>> 460 : 63 6F 6D 70 61 74 69 62 6C 65 3B 20 4D 53 49 45 compatible; MS=
IE
>> 470 : 20 36 2E 30 3B 20 57 69 6E 64 6F 77 73 20 4E 54 6.0; Windows =
NT
>> 480 : 20 35 2E 31 3B 20 53 56 31 3B 20 46 75 6E 57 65 5.1; SV1; Fun=
We
>> 490 : 62 50 72 6F 64 75 63 74 73 3B 20 2E 4E 45 54 20 bProducts; .NE=
T
>> 4a0 : 43 4C 52 20 31 2E 31 2E 34 33 32 32 29 0D 0A 48 CLR 1.1.4322).=
=2EH
>> 4b0 : 6F 73 74 3A 20 69 6D 61 67 65 73 32 2E 73 69 6E ost: images2.s=
in
>> ...
>> 610 : 65 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 4D e..User-Agent:=
M
>> 620 : 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 63 6F 6D 70 ozilla/4.0 (co=
mp
>> 630 : 61 74 69 62 6C 65 3B 20 4D 53 49 45 20 36 2E 30 atible; MSIE 6=
=2E0
>> 640 : 3B 20 57 69 6E 64 6F 77 73 20 4E 54 20 35 2E 31 ; Windows NT 5=
=2E1
>> 650 : 3B 20 53 56 31 3B 20 2E 4E 45 54 20 43 4C 52 20 ; SV1; .NET CL=
R
>> 660 : 31 2E 31 2E 34 33 32 32 3B 20 49 6E 66 6F 50 61 1.1.4322; Info=
Pa
>> 670 : 74 68 2E 31 29 0D 0A 48 6F 73 74 3A 20 63 6F 6E th.1)..Host: c=
on
>>
>> --=20
>> Eric J. Bowser
>> Bright.Net NE / Doylestown Communications, Inc.
>> 800-535-6423 toll-free
>> www.neobright.net
>> www.doyestowncommunications.com
>>
>> =A8Providing advanced communications since 1899.=A8
>>
>>
>>
>>
>=20
>=20
> -------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, securit=
y?
> Get stuff done quickly with pre-integrated technology to make your job
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geron=
imo
> http://sel.as-us.falkag.net/sel?cmd____________________________________=
___________
>=20
> Snort-users mailing list
> Snort...@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list
>=20
>=20
--=20
Eric J. Bowser
Bright.Net NE / Doylestown Communications, Inc.
800-535-6423 toll-free
www.neobright.net
www.doyestowncommunications.com
=A8Providing advanced communications since 1899.=A8
--------------enig9F0D223C4B32534DC58CA593
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQFEWRPev/qInDvk8ugRAvB7AKCgTyR+P7N+nTzQaNxVIw3GPcbZrwCfedbw
suDo8th1YgXcJIyBy3Pc/PM=
=mk6h
-----END PGP SIGNATURE-----
--------------enig9F0D223C4B32534DC58CA593--