http://permalink.gmane.org/gmane.comp.security.ids.snort.devel hourly 1 1901-01-01T00:00+00:00 http://gmane.org/img/gmane-25t.png http://gmane.org http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5202 <pre> I'll post some excerpts from the doc, then I'll explain a bit about how we designed this: set --- This keyword sets bits to group for a particular flow. When no group specified, set the default group. This keyword always returns true. Syntax: flowbits:set,bats[,group] Usage: flowbits:set,bit1,doc; flowbits:set,bit2&amp;bit3,doc; First rule sets bit1 in doc group, second rule sets bit2 and bit3 in doc group. So doc group has bit 1, bit2 and bit3 set setx --- This keyword sets bits to group exclusively. This clears other bits in group. Group must present.This keyword always returns true. Syntax: flowbits:setx,bats,group Usage: flowbits: setx, bit1, doc flowbits: setx, bit2&amp;bit3, doc First rule sets bit1 in doc group, second rule sets bit2 and bit3 in doc group. So doc group has bit2 and bit3 set, because bit1 is cleared by rule 2. unset ----- This keyword clears bits specified for a particular flow or clears all bits in the group (Group must present). This ke</pre> Joel Esler 2012-05-18T20:00:52 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5201 <pre> This will be interesting to play with. I take it this was designed to combine multiple uses of the keyword when checking the state of several flowbits? I take it this also fixes the handling of ignore_data with respect to the fast-pattern matcher? Looking at the changed code, I think this will also fix the same issue when logging with tcpdump output. I hacked right around that for loop in snort_stream5_tcp.c and was able to fully log all packets associated with a stream when using file_data with SMTP. I suspect this might also fix the use case with flow:only_stream and flow:only_frag. I'll have to test, though. Thanks! </pre> Joshua Kinard 2012-05-18T18:58:14 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5200 <pre>Snort 2.9.3 Beta is now available on snort.org, at http://www.snort.org/snort-downloads/ in the Latest Development Release section. 2.9.0 RC &amp; later packages are signed with a new PGP key (that is signed with the previous key). Snort 2.9.3 introduces the following new capabilities: [*] New additions * Updates to flowbit rule option to allow for OR and AND of individual bits within a single rule, and allow flowbits to be used in multiple groups. See README.flowbits and the Snort manual for details. * Dynamic output plugin architecture to provide an API that developers can write their own output mechanisms to log alert and packet data from Snort. Some output plugins have been removed as a result of this to be maintained by their respective authors. * Update to dcerpc2 preprocessor for improved accuracy and handling of different OSs for SMB processing. See README.dcerpc2 and the Snort manual for details. * Updates to reputation preprocessor for handling of wh</pre> Snort Releases 2012-05-18T13:55:44 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5199 <pre>Hi Abdel, You need to change your compilation options and disable linux-smp-stats --enable-dynamicplugin --enable-perfprofiling --enable-targetbased --enable-ipv6 --enable-ppm --enable-gre --enable-static-daq=no --enable-64bit-gcc=no Regards, Guillaume DALEUX From: Abdelmonaim Mokadem [mailto:abdelmonaim.mokadem&lt; at &gt;abovesecurity.com] Sent: Wednesday, May 16, 2012 2:11 PM To: snort-users&lt; at &gt;lists.sourceforge.net; snort-devel&lt; at &gt;lists.sourceforge.net Subject: [Snort-users] Perfmonitor Issue Hi all, I have an issue using the perfmonitor preprocessor for snort inline to provide the "Max performance snort stats" with the following parameters: preprocessor perfmonitor: time 300 pktcnt 5000 events max console Here are the options used to launch snort : -A none \ --dynamic-engine-lib "${SNORT_ENG}" --dynamic-preprocessor-lib-dir "${SNORT_DYNPPDIR}" --dynamic-detection-lib-dir "${SNORT_DYNRULDIR}" --daq-dir "${DAQ_DIR}" -i "${</pre> Guillaume Daleux 2012-05-17T17:11:33 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5198 <pre>Hi all, I have an issue using the perfmonitor preprocessor for snort inline to provide the "Max performance snort stats" with the following parameters: preprocessor perfmonitor: time 300 pktcnt 5000 events max console Here are the options used to launch snort : -A none \ --dynamic-engine-lib "${SNORT_ENG}" --dynamic-preprocessor-lib-dir "${SNORT_DYNPPDIR}" --dynamic-detection-lib-dir "${SNORT_DYNRULDIR}" --daq-dir "${DAQ_DIR}" -i "${INTERFACE}" -c "${SNORT_CONF}" --perfmon-file "${LOG_DIR}/snort.stats" -l "${LOG_DIR}" -Q Since I'm using the "max " and "console" parameters, my console should display the results, based on the following code: if(iFlags &amp; MAX_PERF_STATS) { . . LogMessage("uSeconds/Pkt\n"); LogMessage("----------------\n"); LogMessage("Snort: %.3f\n",sfBaseStats-&gt;usecs_per_packet.usertime); LogMessage("Sniffing: %.3f\n",sfBaseStats-&gt;usecs_per_packet.syst</pre> Abdelmonaim Mokadem 2012-05-16T18:10:58 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5197 <pre>Snort 2.9.2.3 is now available on snort.org, at http://www.snort.org/snort-downloads/ in the Latest Release section. 2.9.0 RC &amp; later packages are signed with a new PGP key (that is signed with the previous key). Snort 2.9.2.3 includes changes for the following: * Update to GTP preprocessor to better handle GTPv1 data. * Update to DNP3 preprocessor to add stricter checking on packets before processing by dnp3. Improved checking on reassembly buffer * Update to PCRE rule option processing to prevent issues seen w/ libpcre-8.30 and certain rules. * Update to dcerpc2 to not abort reassembly if target-based protocol is undefined. Please see the Release Notes and ChangeLog for more details. Please submit bugs, questions, and feedback to bugs&lt; at &gt;snort.org. Happy Snorting! The Snort Release Team ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat land</pre> Snort Releases 2012-05-15T19:56:27 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5196 <pre>Snort i will always make this my priority from now on http://cnbcnews.net this is going to change everything ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Snort-devel mailing list Snort-devel&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort! </pre> easyeinfo< at >yahoo.com 2012-05-15T07:07:49 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5195 <pre>We generally don't comment on future plans, however, yes, we are looking at this for several different things. J On May 10, 2012, at 9:28 AM, "Guillaume Daleux" &lt;guillaume.daleux&lt; at &gt;abovesecurity.com&gt; wrote: ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Snort-devel mailing list Snort-devel&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort! </pre> Joel Esler 2012-05-10T13:39:10 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5194 <pre>Hi all, Is it possible to know if the implementation of AF_PACKET capture mode with zero copy mode is currently under development in Snort ? https://home.regit.org/2012/02/using-af_packet-zero-copy-mode-in-suricata/ Thanks for your answer, Guillaume DALEUX Junior Research Engineer Ingénieur Junior en Recherchetel : 450.430.8166 ext. 2279 | guillaume.daleux&lt; at &gt;abovesecurity.com sans frais / toll free : 1.866.430.8166 | fax: 450.430.1858 Managed Security Services ? Information Risk Management Surveillance ? Gestion des Risques Informationnels 203 - 1919 boul. Lionel-Bertrand ? Boisbriand ? QC ? Canada ? J7H 1N8 www.abovesecurity.com ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl0</pre> Guillaume Daleux 2012-05-10T13:28:39 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5193 <pre>You may get different results with a newer Snort. On Wed, May 9, 2012 at 1:18 PM, Jon Larson &lt;jlarson&lt; at &gt;catbird.com&gt; wrote: ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/_______________________________________________ Snort-devel mailing list Snort-devel&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort!</pre> Russ Combs 2012-05-09T17:27:30 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5192 <pre>Snort is Version 2.9.0.5 DAQ is 0.5 I think. The storm occurs when I have a rule configured like this: alert tcp [192.168.10.10] any -&gt; [192.168.20.11] any (resp:reset_both; flow:to_server,established; ) Anyway, snort isn't really *supposed* to be used like a firewall in this manner so we've moved on. On 5/8/2012 9:57 PM, Russ Combs wrote: ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/_______________________________________________ Snort-devel mailing list Snort-devel&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort!</pre> Jon Larson 2012-05-09T17:18:44 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5191 <pre>What version of Snort and DAQ are you using? Snort has a check to prevent RST to RST. On Tue, May 1, 2012 at 7:46 PM, Jon Larson &lt;jlarson&lt; at &gt;catbird.com&gt; wrote: ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/_______________________________________________ Snort-devel mailing list Snort-devel&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort!</pre> Russ Combs 2012-05-09T04:57:30 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5190 <pre> It's probably how you are pulling down bits from a Google service if you run chrome. Locally it's mod_spdy on Apache with Chrome clients. It's all encrypted. \\//, Lorax ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Snort-devel mailing list Snort-devel&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort! </pre> Graham Bignell 2012-05-02T18:43:00 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5189 <pre> If you look for DETECTION_OPTION_MATCH and DETECTION_OPTION_NO_MATCH you will find what you need. J ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/_______________________________________________ Snort-devel mailing list Snort-devel&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort!</pre> Russ Combs 2012-05-04T14:38:37 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5188 <pre>The Snort code is available at www.snort.org. I suggest you take a look at it and see how you can modify it to fit your purpose. J On May 4, 2012, at 6:45 AM, Efthymia Tsamoura wrote: ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Snort-devel mailing list Snort-devel&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort! </pre> Joel Esler 2012-05-04T13:49:06 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5187 <pre>Hi all, My name is Efi and Im a PhD student. Im writing this email, since I want to find out how to monitor for each rule and for each input packet which of the rule's predicates were satisfied and which not for the specific packet that is currently being processed. For example, given the rule alert tcp 1.1.1.1 any -&gt; 2.2.2.2 80 (content:"BOB"; gid:1000001; sid:1; rev:1;), i want for each packet statistics of the form: Packet 1 satisfied Protocol=tcp and srcIp = 1.1.1.1 and did not satisfy destIp = 2.2.2.2 and destport = 80 and content = "BOB" What are the modifications that need to be performed to the src to get this info? For example, which functions, data structures hold this info ... Best Regards, Efi ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security,</pre> Efthymia Tsamoura 2012-05-04T10:45:35 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5186 <pre>It won't be in 2.9.3. That version is already baked. I'll keep you updated as we work on it. -- Joel Esler Sent from my.. NO ONE CARES On May 3, 2012, at 9:43 PM, Joshua Kinard &lt;kumba&lt; at &gt;gentoo.org&gt; wrote: ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Snort-devel mailing list Snort-devel&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort! </pre> Joel Esler 2012-05-04T01:50:03 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5185 <pre> I believe Firefox plans to enable SPDY support by default in FF 13. Not sure what your roadmap is, but 12 just came out, so maybe a beta preprocessor in Snort-2.9.3 or 2.9.4? I haven't looked at it yet myself. Wireshark doesn't even have a dissector for it I believe. </pre> Joshua Kinard 2012-05-04T01:43:09 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5184 <pre>It is on the roadmap. Are you seeing SPDY traffic now? Can you tell us about what the client and server are running? Is any of the SPDY traffic encrypted? Thanks Russ On Tue, May 1, 2012 at 4:46 PM, Brian Wilhide &lt;brian.wilhide&lt; at &gt;gmail.com&gt;wrote: ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/_______________________________________________ Snort-devel mailing list Snort-devel&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort!</pre> Russ Combs 2012-05-02T17:06:49 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5183 <pre>I/we need to get snort to operate on two interfaces. For simplicity, let's just say I want to have snort monitor traffic on eth0, but then send its resets out on eth1. What's the configuration magic to allow this? I've tried something like this in the snort.conf: config response: device eth1 attempts 2 This, however, seems to get snort into this mode (when it detects some TCP connection it's configured to reset) where it "sniffs" back in the RST packet (on the other interface), then sends another RST packet. Kinda like "eating it's own tail". The snort process consumes the CPU and floods the network in this mode. Also is there documentation someone could point me to regarding configuring snort for multiple interfaces? Any and all information would be greatly appreciated! Jonny L. ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how</pre> Jon Larson 2012-05-01T23:46:18 http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/5182 <pre>Have you guys looked into SPDY awareness within Snort? http://en.wikipedia.org/wiki/SPDY Brian Wilhide brian.wilhide&lt; at &gt;gmail.com ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Snort-devel mailing list Snort-devel&lt; at &gt;lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort! </pre> Brian Wilhide 2012-05-01T20:46:10 Search the mailing list at Gmane query http://search.gmane.org/?group=$group=gmane.comp.security.ids.snort.devel