<br><br><div class="gmail_quote">On Wed, Nov 9, 2011 at 6:22 PM, carlopmart <span dir="ltr"><<a href="mailto:carlopmart@gmail.com">carlopmart@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div><div></div><div class="h5">On 11/09/2011 06:20 PM, carlopmart wrote:<br>
> On 11/09/2011 06:04 PM, Victor Julien wrote:<br>
>> On 11/09/2011 05:51 PM, carlopmart wrote:<br>
>>>> Can you try the attached patch?<br>
>>>><br>
>>><br>
>>> Apply patch works well and compilation too ... Starting suricata:<br>
>>><br>
>>> root@eorlingas:~# suricata -c /data/config/etc/suricata/suricata.yaml -i<br>
>>> eth8 -F /data/config/etc/suricata/bpf.conf<br>
>>> [21899] 9/11/2011 -- 16:48:26 - (runmode-pcap.c:140)<Info><br>
>>> (ParsePcapConfig) -- BPF filter set from command line or via old<br>
>>> 'bpf-filter' option.<br>
>><br>
>>><br>
>>> ... uhmm, why is saying "BPF filter set from command line or via old<br>
>>> 'bpf-filter' option."??<br>
>><br>
>> I agree the output is confusing. What I think is happening is that you<br>
>> can set a bpf filter in the config (suricata.yaml). If you add it on the<br>
>> commandline, like you did, it will tell you it uses that instead of the<br>
>> one in the config.<br>
>><br>
>>> Anyway, seems it works ... Yes, works. Suricata only sees http<br>
>>> traffic ...<br>
>><br>
>> Cool, thanks for your report!<br>
>><br>
><br>
> Uhmmm ... but no alerts are displayed. For example, I configure<br>
> rbn.rules and I execute:<br>
><br>
> [carlos@desktop etc]$ telnet 118.218.219.178 80<br>
> Trying 118.218.219.178...<br>
> Connected to 118.218.219.178.<br>
> Escape character is '^]'.<br>
> get<br>
> <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><br>
> <html><head><br>
> <title>400 Bad Request</title><br>
> </head><body><br>
> <h1>Bad Request</h1><br>
> <p>Your browser sent a request that this server could not understand.<br /><br>
> </p><br>
> <hr><br>
> <address>Microsoft-IIS/5.0 Server at <a href="http://mybookmake.co.kr" target="_blank">mybookmake.co.kr</a> Port 80</address><br>
> </body></html><br>
> Connection closed by foreign host.<br>
><br>
> 118.218.219.178 appears in rbn.rules (and it is configured under rules<br>
> section on suricata.yaml) file, but suricata doesn't fire any alarm ...<br>
> Why??<br>
><br>
><br>
<br>
</div></div>And pcap exists:<br>
<br>
root@eorlingas:/nsm/sguil_sensor/idpesx02/dailylogs/2011-11-09# tcpdump<br>
-ttt -env -r suricata.log.1320858835 host 118.218.219.178<br>
reading from file suricata.log.1320858835, link-type EN10MB (Ethernet)<br>
00:00:00.000000 00:1c:25:72:56:e5 > 00:50:56:0e:ad:ba, ethertype IPv4<br>
(0x0800), length 74: (tos 0x10, ttl 64, id 16746, offset 0, flags [DF],<br>
proto TCP (6), length 60)<br>
172.25.50.30.37232 > 118.218.219.178.80: Flags [S], cksum 0xbf0f<br>
(correct), seq 3454548, win 5840, options [mss 1460,sackOK,TS val<br>
30799678 ecr 0,nop,wscale 6], length 0<br>
00:00:00.393515 00:50:56:0e:ad:ba > 00:1c:25:72:56:e5, ethertype IPv4<br>
(0x0800), length 74: (tos 0x0, ttl 45, id 0, offset 0, flags [DF], proto<br>
TCP (6), length 60)<br>
118.218.219.178.80 > 172.25.50.30.37232: Flags [S.], cksum 0xb365<br>
(correct), seq 189466986, ack 3454549, win 5792, options [mss<br>
1460,sackOK,TS val 278652535 ecr 30799678,nop,wscale 7], length 0<br>
00:00:00.000519 00:1c:25:72:56:e5 > 00:50:56:0e:ad:ba, ethertype IPv4<br>
(0x0800), length 66: (tos 0x10, ttl 64, id 16747, offset 0, flags [DF],<br>
proto TCP (6), length 52)<br>
172.25.50.30.37232 > 118.218.219.178.80: Flags [.], cksum 0xf6eb<br>
(correct), ack 1, win 92, options [nop,nop,TS val 30800072 ecr<br>
278652535], length 0<br>
00:00:01.309976 00:1c:25:72:56:e5 > 00:50:56:0e:ad:ba, ethertype IPv4<br>
(0x0800), length 71: (tos 0x10, ttl 64, id 16748, offset 0, flags [DF],<br>
proto TCP (6), length 57)<br>
172.25.50.30.37232 > 118.218.219.178.80: Flags [P.], cksum 0x0c4e<br>
(correct), seq 1:6, ack 1, win 92, options [nop,nop,TS val 30801382 ecr<br>
278652535], length 5<br>
00:00:00.405636 00:50:56:0e:ad:ba > 00:1c:25:72:56:e5, ethertype IPv4<br>
(0x0800), length 66: (tos 0x0, ttl 45, id 58432, offset 0, flags [DF],<br>
proto TCP (6), length 52)<br>
118.218.219.178.80 > 172.25.50.30.37232: Flags [.], cksum 0xeb42<br>
(correct), ack 6, win 46, options [nop,nop,TS val 278654251 ecr<br>
30801382], length 0<br>
00:00:00.000005 00:50:56:0e:ad:ba > 00:1c:25:72:56:e5, ethertype IPv4<br>
(0x0800), length 369: (tos 0x0, ttl 45, id 58433, offset 0, flags [DF],<br>
proto TCP (6), length 355)<br>
118.218.219.178.80 > 172.25.50.30.37232: Flags [P.], cksum 0x3267<br>
(correct), seq 1:304, ack 6, win 46, options [nop,nop,TS val 278654252<br>
ecr 30801382], length 303<br>
00:00:00.000002 00:50:56:0e:ad:ba > 00:1c:25:72:56:e5, ethertype IPv4<br>
(0x0800), length 66: (tos 0x0, ttl 45, id 58434, offset 0, flags [DF],<br>
proto TCP (6), length 52)<br>
118.218.219.178.80 > 172.25.50.30.37232: Flags [F.], cksum 0xea11<br>
(correct), seq 304, ack 6, win 46, options [nop,nop,TS val 278654252 ecr<br>
30801382], length 0<br>
00:00:00.000797 00:1c:25:72:56:e5 > 00:50:56:0e:ad:ba, ethertype IPv4<br>
(0x0800), length 66: (tos 0x10, ttl 64, id 16749, offset 0, flags [DF],<br>
proto TCP (6), length 52)<br>
172.25.50.30.37232 > 118.218.219.178.80: Flags [.], cksum 0xe83e<br>
(correct), ack 304, win 108, options [nop,nop,TS val 30801788 ecr<br>
278654252], length 0<br>
00:00:00.000002 00:1c:25:72:56:e5 > 00:50:56:0e:ad:ba, ethertype IPv4<br>
(0x0800), length 66: (tos 0x10, ttl 64, id 16750, offset 0, flags [DF],<br>
proto TCP (6), length 52)<br>
172.25.50.30.37232 > 118.218.219.178.80: Flags [F.], cksum 0xe83c<br>
(correct), seq 6, ack 305, win 108, options [nop,nop,TS val 30801788 ecr<br>
278654252], length 0<br>
00:00:00.403635 00:50:56:0e:ad:ba > 00:1c:25:72:56:e5, ethertype IPv4<br>
(0x0800), length 66: (tos 0x0, ttl 45, id 58435, offset 0, flags [DF],<br>
proto TCP (6), length 52)<br>
118.218.219.178.80 > 172.25.50.30.37232: Flags [.], cksum 0xe6e6<br>
(correct), ack 7, win 46, options [nop,nop,TS val 278654656 ecr<br>
30801788], length 0<br>
tcpdump: pcap_loop: truncated dump file; tried to read 16 header bytes,<br>
only got 6<br>
<div><div></div><div class="h5"><br>
--<br>
CL Martinez<br>
carlopmart {at} gmail {d0t} com<br>
_______________________________________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
</div></div></blockquote></div><br>What happens if you read the pcap with Suricata?<br>Do you mind sharing the pcap? <br><br>thanks<br clear="all"><br>-- <br>Peter Manev<br>
<div style="visibility: hidden; left: -5000px;" id="avg_ls_inline_popup"></div>