<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Feb 15, 2012, at 3:29 PM, Nikolay Denev wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div><br>On Feb 15, 2012, at 1:52 PM, Peter Manev wrote:<br><br><blockquote type="cite"><br></blockquote><blockquote type="cite">Just from observation -<br></blockquote><blockquote type="cite">"PACKET LEN: 68" in debug alert<br></blockquote><blockquote type="cite">but in Snorby it says "40" - so it does seem there is a bit of discrepancy ....<br></blockquote><blockquote type="cite">If you use pcap.log(ing) in yaml , does this packet indeed have 68 or 40 length ?<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">-- <br></blockquote><blockquote type="cite">Peter Manev<br></blockquote><br>I've just turned on pcap-log in suricata.yaml.<br><br></div></blockquote></div><br><div>Ok here's another one. The rule is :</div><div><br></div><div>alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Alexa Spyware Reporting"; flow:established,to_server; uricontent:"/data?"; nocase; uricontent:"cli="; nocase; uricontent:"&dat="; nocase; uricontent:"&ver="; nocase; uricontent:"&uid="; nocase; reference:url,<a href="http://doc.emergingthreats.net/bin/view/Main/2003219">doc.emergingthreats.net/bin/view/Main/2003219</a>; classtype:trojan-activity; sid:2003219; rev:4;)</div><div><br></div><div><img id="4d4866d4-ff74-4048-820e-57c6397960b9" height="538" width="986" apple-width="yes" apple-height="yes" src="cid:76974E86-2610-415C-912F-F4BF22036A82@moneybookers.net"></div><div><br></div><div><br></div><div><div>+================</div><div>TIME: 02/15/2012-16:02:56.567244</div><div>SRC IP: X.X.X.X</div><div>DST IP: Y.Y.Y.Y</div><div>PROTO: 6</div><div>SRC PORT: 58761</div><div>DST PORT: 80</div><div>TCP SEQ: 3317584075</div><div>TCP ACK: 2654953614</div><div>FLOW: to_server: TRUE, to_client: FALSE</div><div>FLOW Start TS: 02/15/2012-16:02:56.295055</div><div>FLOW IPONLY SET: TOSERVER: TRUE, TOCLIENT: TRUE</div><div>FLOW ACTION: DROP: FALSE, PASS FALSE</div><div>FLOW NOINSPECTION: PACKET: FALSE, PAYLOAD: FALSE, APP_LAYER: TRUE</div><div>FLOW APP_LAYER: DETECTED: TRUE, PROTO 1</div><div>PACKET LEN: 68</div><div>PACKET:</div><div> 0000 02 04 96 37 53 8D F0 DE F1 75 DD AE 81 00 00 00 ...7S... .u......</div><div> 0010 81 00 00 6C 08 00 45 00 00 28 24 DD 40 00 80 06 ...l..E. .($.@...</div><div> 0020 CF F9 0A 81 0D 47 4B 65 A2 CC E5 89 00 50 C5 BE .....GKe .....P..</div><div> 0030 50 CB 9E 3F 60 8E 50 10 3F 05 6F A4 00 00 00 00 P..?`.P. ?.o.....</div><div> 0040 00 00 00 00 ....</div><div>ALERT CNT: 1</div><div>ALERT MSG [00]: ET MALWARE Alexa Spyware Reporting</div><div>ALERT GID [00]: 1</div><div>ALERT SID [00]: 2003219</div><div>ALERT REV [00]: 4</div><div>ALERT CLASS [00]: A Network Trojan was Detected</div><div>ALERT PRIO [00]: 1</div><div>ALERT FOUND IN [00]: OTHER</div><div>+================</div></div><div><br></div><div><br></div><div>And this is from the pcap log :</div><div><br></div><div><div><div>16:02:56.295055 IP X.X.X.X.58761 > Y.Y.Y.Y.80: Flags [S], seq 3317583354, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0</div><div>16:02:56.425664 IP X.X.X.X.58761 > Y.Y.Y.Y.80: Flags [.], ack 2654949527, win 16425, length 0</div><div>16:02:56.425473 IP Y.Y.Y.Y.80 > X.X.X.X.58761: Flags [S.], seq 2654949526, ack 3317583355, win 5840, options [mss 1460,nop,nop,sackOK,nop,wscale 2], length 0</div><div>16:02:56.426276 IP X.X.X.X.58761 > Y.Y.Y.Y.80: Flags [P.], seq 1:721, ack 1, win 16425, length 720</div><div>16:02:56.563356 IP truncated-ip - 4 bytes missing! Y.Y.Y.Y.80 > X.X.X.X.58761: Flags [.], seq 1:1461, ack 721, win 1820, length 1460</div><div>16:02:56.563365 IP truncated-ip - 4 bytes missing! Y.Y.Y.Y.80 > X.X.X.X.58761: Flags [.], seq 1461:2921, ack 721, win 1820, length 1460</div><div>16:02:56.563927 IP X.X.X.X.58761 > Y.Y.Y.Y.80: Flags [.], ack 2921, win 16425, length 0</div><div>16:02:56.564533 IP Y.Y.Y.Y.80 > X.X.X.X.58761: Flags [FP.], seq 2921:4087, ack 721, win 1820, length 1166</div><div>16:02:56.567872 IP X.X.X.X.58761 > Y.Y.Y.Y.80: Flags [R.], seq 721, ack 4088, win 0, length 0</div><div>16:02:56.567244 IP X.X.X.X.58761 > Y.Y.Y.Y.80: Flags [.], ack 4088, win 16133, length 0</div></div></div><div><br></div><div>Notice the truncated-ip packets. </div><div><br></div><div>My interface is Intel 10G card with MTU 9000 and suricata is set : default-packet-size: 1522</div><div>The switch has the port set like this "Jumbo:<span class="Apple-tab-span" style="white-space:pre"> </span>Enabled, MTU= 9216"</div><div><br></div><div>Also, just for info, this is extreme networks switch, that is mirroring the packets in one direction with VLAN tag, and and untagged in the other. Just like the recent thred in oisf-users@</div><div><br></div></body></html>