Snort - [Snort-users] I finish installing the managment and 2 sensors !! I have small p

Author

[Snort-users] I finish installing the managment and 2 sensors !! I have small p

Juan Fernandez

2004-09-22, 10:25 pm

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_001_01C49CA7.388859F6
Content-Type: text/plain

Hi !

I use FC1 and followed the manual of Harper.

When I start snort manually

e.g. /etc/init.d/snort start I see in /var/log/messeges :

[root@sensjrlan root]# tail -f /var/log/messages

Sep 17 13:24:06 sensjrlan snort: Suspend threshold: 1000

Sep 17 13:24:06 sensjrlan snort: Suspend period: 30

Sep 17 13:24:06 sensjrlan snort: WARNING /etc/snort/snort.conf(261) =>
Unknown stream4: option: min_ttl

Sep 17 13:24:06 sensjrlan snort: FATAL ERROR: /etc/snort/snort.conf(286) =>
Invalid configuration token '80'. The first configuration must start with a
'global' configuration type.

Sep 17 13:35:44 sensjrlan sshd(pam_unix)[1836]: authentication failure;
logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=208.170.171.181 user=juanb

Sep 17 13:35:47 sensjrlan sshd(pam_unix)[1838]: session opened for user
juanb by (uid=500)

Sep 17 13:43:08 sensjrlan su(pam_unix)[1878]: session opened for user root
by juanb(uid=500)

Sep 17 13:50:18 sensjrlan sshd(pam_unix)[1926]: authentication failure;
logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=208.170.171.181 user=juanb

Sep 17 13:50:21 sensjrlan sshd(pam_unix)[1928]: session opened for user
juanb by (uid=500)

Sep 17 13:50:45 sensjrlan su(pam_unix)[1968]: session opened for user root
by juanb(uid=500)

Sep 17 13:52:49 sensjrlan snort: OpenPcap() device eth1 network lookup:
^Ieth1: no IPv4 address assigned

Sep 17 13:52:49 sensjrlan snort: Initializing daemon mode

Sep 17 13:52:49 sensjrlan snort: PID path stat checked out ok, PID path set
to /var/run/

Sep 17 13:52:49 sensjrlan snort: Writing PID "2038" to file
"/var/run//snort_eth1.pid"

Sep 17 13:52:49 sensjrlan snort: ,-----------[Flow
Config]----------------------

Sep 17 13:52:49 sensjrlan snort: | Stats Interval: 0

Sep 17 13:52:49 sensjrlan snort: | Hash Method: 2

Sep 17 13:52:49 sensjrlan snort: | Memcap: 10485760

Sep 17 13:52:49 sensjrlan snort: | Rows : 4099

Sep 17 13:52:49 sensjrlan snort: | Overhead Bytes: 16400(%0.16)

Sep 17 13:52:49 sensjrlan snort:
`----------------------------------------------

Sep 17 13:52:49 sensjrlan snort: [*] Frag2 config:

Sep 17 13:52:49 sensjrlan snort: Fragment timeout: 35 seconds

Sep 17 13:52:49 sensjrlan snort: Fragment memory cap: 4194304 bytes

Sep 17 13:52:49 sensjrlan snort: Fragment min_ttl: 3

Sep 17 13:52:49 sensjrlan snort: Fragment ttl_limit: 8

Sep 17 13:52:49 sensjrlan snort: Fragment Problems: 0

Sep 17 13:52:49 sensjrlan snort: State Protection: 0

Sep 17 13:52:49 sensjrlan snort: Self preservation threshold: 500

Sep 17 13:52:49 sensjrlan snort: Self preservation period: 90

Sep 17 13:52:49 sensjrlan snort: Suspend threshold: 1000

Sep 17 13:52:49 sensjrlan snort: Suspend period: 30

Sep 17 13:52:49 sensjrlan snort: WARNING /etc/snort/snort.conf(261) =>
Unknown stream4: option: min_ttl

Sep 17 13:52:49 sensjrlan snort: FATAL ERROR: /etc/snort/snort.conf(286) =>
Invalid configuration token '80'. The first configuration must start with a
'global' configuration type.

The thing is that I didn't touch line 286 and line 261 in snort.conf at
all!! here I inserted the relevant lines so you can help me debug:

( with the :set number option):

255 # 10 Stealth scan: NMAP XMAS scan

256 # 11 Stealth scan: Vecna scan

257 # 12 Stealth scan: NMAP fingerprint scan stateful detect

258 # 13 Stealth scan: SYN-FIN scan

259 # 14 TCP forward overlap

260

261 preprocessor stream4: detect_scans, timeout 35, memcap 8388608,
min_ttl 3 , ttl_limit 8

262

263 # tcp stream reassembly directive

264 # no arguments loads the default configuration

265 # Only reassemble the client,

266 # Only reassemble the default list of ports (See below),

267 # Give alerts for "bad" streams

268 #

269 # Available options (comma delimited):

270 # clientonly - reassemble traffic for the client side of a
connection only

271 # serveronly - reassemble traffic for the server side of a
connection only

272 # both - reassemble both sides of a session

273 # noalerts - turn off alerts from the stream reassembly stage of
stream4

274 # ports [list] - use the space separated list of ports in [list],
"all"

275 # will turn on reassembly for all ports, "default"
will turn

276 # on reassembly for ports 21, 23, 25, 53, 80, 143,
110, 111

277 # and 513

278

279 preprocessor stream4_reassemble: both, ports all

280

281 # http_inspect: normalize and detect HTTP traffic and protocol
anomalies

282 #

283 # lots of options available here. See doc/README.http_inspect.

284 # unicode.map should be wherever your snort.conf lives, or given

285 # a full path to where snort can find it.

286 preprocessor http_inspect: 80 443 8080 unicode iis_alt_unicode

287 double_encode iis_flip_slash full_whitespace

Thanks very much to all of you !!

------_=_NextPart_001_01C49CA7.388859F6
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable

<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">

<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered medium)">
<style>

</style>

</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple>

<div class=3DSection1 dir=3DRTL>

         =
;   Hi =
!<o:p></o:p>

<o:p> </o:p></f=
ont>

I
use FC1 and followed the manual of Harper.<o:p></o:p>

<o:p> </o:p></f=
ont>

When
I start snort manually <o:p></o:p>

<o:p> </o:p></f=
ont>

e.g.
/etc/init.d/snort start    I see in /var/log/messeges =
:<o:p></o:p>

<o:p> </o:p></f=
ont>

[root@sensjrlan
root]# tail -f /var/log/messages <o:p></o:p></=
p>

Sep
17 13:24:06 sensjrlan snort:     Suspend threshold: =
1000 <o:p></o:p>

Sep
17 13:24:06 sensjrlan snort:     Suspend period: 30 =
<o:p></o:p>

Sep
17 13:24:06 sensjrlan snort: WARNING /etc/snort/snort.conf(261) =3D> =
Unknown
stream4: option: min_ttl <o:p></o:p></=
p>

Sep
17 13:24:06 sensjrlan snort: FATAL ERROR: /etc/snort/snort.conf(286) =
=3D> Invalid
configuration token '80'.  The first configuration must start with =
a 'global'
configuration type. <o:p></o:p></=
p>

Sep
17 13:35:44 sensjrlan sshd(pam_unix)[1836]: authentication failure; =
logname=3D uid=3D0
euid=3D0 tty=3DNODEVssh ruser=3D rhost=3D208.170.171.181  =
user=3Djuanb<o:p></o:p>

Sep
17 13:35:47 sensjrlan sshd(pam_unix)[1838]: session opened for user =
juanb by (uid=3D500)<o:p></o:p>

Sep
17 13:43:08 sensjrlan su(pam_unix)[1878]: session opened for user root =
by juanb(uid=3D500)<o:p></o:p>

Sep
17 13:50:18 sensjrlan sshd(pam_unix)[1926]: authentication failure; =
logname=3D uid=3D0
euid=3D0 tty=3DNODEVssh ruser=3D rhost=3D208.170.171.181  =
user=3Djuanb<o:p></o:p>

Sep
17 13:50:21 sensjrlan sshd(pam_unix)[1928]: session opened for user =
juanb by (uid=3D500)<o:p></o:p>

Sep
17 13:50:45 sensjrlan su(pam_unix)[1968]: session opened for user root =
by juanb(uid=3D500)<o:p></o:p>

Sep
17 13:52:49 sensjrlan snort: OpenPcap() device eth1 network =
lookup:  ^Ieth1:
no IPv4 address assigned <o:p></o:p></=
p>

Sep
17 13:52:49 sensjrlan snort: Initializing daemon mode =
<o:p></o:p>

Sep
17 13:52:49 sensjrlan snort: PID path stat checked out ok, PID path set =
to /var/run/
<o:p></o:p>

Sep
17 13:52:49 sensjrlan snort: Writing PID "2038" to file =
"/var/run//snort_eth1.pid"
<o:p></o:p>

Sep
17 13:52:49 sensjrlan snort: ,-----------[Flow =
Config]---------------------- <o:p></o:p>

Sep
17 13:52:49 sensjrlan snort: | Stats Interval:  0 =
<o:p></o:p>

Sep
17 13:52:49 sensjrlan snort: | Hash Method:     2 =
<o:p></o:p>

Sep
17 13:52:49 sensjrlan snort: | =
Memcap:         
10485760 <o:p></o:p></=
p>

Sep
17 13:52:49 sensjrlan snort: | Rows  =
:         
4099 <o:p></o:p></=
p>

Sep
17 13:52:49 sensjrlan snort: | Overhead Bytes:  16400(%0.16) =
<o:p></o:p>

Sep
17 13:52:49 sensjrlan snort: =
`---------------------------------------------- <o:p></o:p>

Sep
17 13:52:49 sensjrlan snort: [*] Frag2 config: <o:p></o:p></=
p>

Sep
17 13:52:49 sensjrlan snort:     Fragment timeout: =
35 seconds
<o:p></o:p>

Sep
17 13:52:49 sensjrlan snort:     Fragment memory =
cap: 4194304
bytes <o:p></o:p></=
p>

Sep
17 13:52:49 sensjrlan snort:     Fragment =
min_ttl:  
3 <o:p></o:p>

Sep
17 13:52:49 sensjrlan snort:     Fragment =
ttl_limit: 8 <o:p></o:p>

Sep
17 13:52:49 sensjrlan snort:     Fragment Problems: =
0 <o:p></o:p>

Sep
17 13:52:49 sensjrlan snort:     State Protection: =
0 <o:p></o:p>

Sep
17 13:52:49 sensjrlan snort:     Self preservation
threshold: 500 <o:p></o:p></=
p>

Sep
17 13:52:49 sensjrlan snort:     Self preservation =
period: 90
<o:p></o:p>

Sep
17 13:52:49 sensjrlan snort:     Suspend threshold: =
1000 <o:p></o:p>

Sep
17 13:52:49 sensjrlan snort:     Suspend period: 30 =
<o:p></o:p>

Sep
17 13:52:49 sensjrlan snort: WARNING /etc/snort/snort.conf(261) =3D> =
Unknown
stream4: option: min_ttl <o:p></o:p></=
p>

Sep
17 13:52:49 sensjrlan snort: FATAL ERROR: /etc/snort/snort.conf(286) =
=3D> Invalid
configuration token '80'.  The first configuration must start with =
a 'global'
configuration type.<o:p></o:p>

<o:p> </o:p></f=
ont>

The
thing is that I didn't touch line 286 and line 261 in snort.conf at =
all!!
here I inserted the relevant lines so you can help me =
debug:  <o:p></o:p>

 (
with the :set number option):<o:p></o:p>

<o:p> </o:p></f=
ont>

   
255 #   10      Stealth scan: NMAP =
XMAS scan<o:p></o:p>

    256
#   11      Stealth scan: Vecna =
scan<o:p></o:p>

    257
#   12      Stealth scan: NMAP =
fingerprint
scan stateful detect<o:p></o:p></=
p>

    258
#   13      Stealth scan: SYN-FIN =
scan<o:p></o:p>

    259
#   14      TCP forward =
overlap<o:p></o:p>

    260 =
<o:p></o:p>

    261 =
preprocessor
stream4: detect_scans, timeout 35, memcap 8388608, min_ttl 3 , =
ttl_limit 8<o:p></o:p>

    262 =
<o:p></o:p>

    263 =
# tcp
stream reassembly directive<o:p></o:p></=
p>

    264 =
# no
arguments loads the default configuration<o:p></o:p></=
p>

    265
#   Only reassemble the client,<o:p></o:p></=
p>

    266
#   Only reassemble the default list of ports (See =
below),<o:p></o:p>

    267
#   Give alerts for "bad" =
streams<o:p></o:p>

    268 =
#<o:p></o:p>

    269 =
# Available
options (comma delimited):<o:p></o:p></=
p>

    270
#   clientonly - reassemble traffic for the client side of a
connection only<o:p></o:p></=
p>

    271
#   serveronly - reassemble traffic for the server side of a
connection only<o:p></o:p></=
p>

    272
#   both - reassemble both sides of a =
session<o:p></o:p>

    273
#   noalerts - turn off alerts from the stream reassembly =
stage of
stream4<o:p></o:p></=
p>

    274
#   ports [list] - use the space separated list of ports in =
[list], "all"<o:p></o:p>

    275
#            =
;     
will turn on reassembly for all ports, "default" will =
turn<o:p></o:p>

    276
#            =
;     
on reassembly for ports 21, 23, 25, 53, 80, 143, 110, =
111<o:p></o:p>

    277
#            =
;     
and 513<o:p></o:p></=
p>

    278 =
<o:p></o:p>

    279 =
preprocessor
stream4_reassemble: both, ports all<o:p></o:p></=
p>

    280 =
<o:p></o:p>

    281 =
# http_inspect:
normalize and detect HTTP traffic and protocol =
anomalies<o:p></o:p>

    282 =
#<o:p></o:p>

    283 =
# lots of
options available here. See doc/README.http_inspect.<o:p></o:p></=
p>

    284 =
# unicode.map
should be wherever your snort.conf lives, or given<o:p></o:p></=
p>

    285 =
# a full
path to where snort can find it.<o:p></o:p></=
p>

    286 =
preprocessor
http_inspect: 80 443 8080 unicode iis_alt_unicode<o:p></o:p></=
p>

    =
287    
double_encode iis_flip_slash full_whitespace<o:p></o:p></=
p>

<o:p> </o:p></f=
ont>

<o:p> </o:p></f=
ont>

Thanks
very much to all of you !!<o:p></o:p>

</div>

</body>

</html>

------_=_NextPart_001_01C49CA7.388859F6--

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users