<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Oops, nevermind. I should have looked
at the source code first. :) I found the "async-oneside" flag,
and that's fixed it. I am still curious as to why the tcp rule
produces two alerts, though.<br>
<pre class="moz-signature" cols="72">Matt</pre>
On 1/24/2013 3:38 PM, Matt wrote:<br>
</div>
<blockquote cite="mid:51019BB8.5070009@somedamn.com" type="cite">Due
to some peculiarities in my environment, I sometimes only see
outbound packets. I have "midstream: true" set in my config, but
I'm having trouble with HTTP rules when the SYN packet is present,
but the SYN|ACK is missing. Here are two test rules:
<br>
<br>
alert http any any -> any 80 (msg:<a class="moz-txt-link-rfc2396E" href="http://lockedoutofheaven.in/http">"http://lockedoutofheaven.in/
http"</a>; content:"/4/config.bin"; http_uri; content:"Host:
lockedoutofheaven.in"; nocase; http_header;
classtype:trojan-activity; sid:1;)
<br>
alert tcp any any -> any 80 (msg:<a class="moz-txt-link-rfc2396E" href="http://lockedoutofheaven.in/tcp">"http://lockedoutofheaven.in/
tcp"</a>; content:"/4/config.bin"; offset:4; content:"Host:
lockedoutofheaven.in"; nocase; distance:10;
classtype:trojan-activity; sid:2;)
<br>
<br>
Test case #1: Full 3-way handshake
<br>
<br>
0 1 0.000000 85.167.26.187 -> 53.177.243.126 TCP 2084 >
80 [SYN] Seq=0 Win=16384 Len=0 MSS=1460 WS=1 SACK_PERM=1
<br>
0 2 0.154565 53.177.243.126 -> 85.167.26.187 TCP 80 >
2084 [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1460 SACK_PERM=1
WS=64
<br>
0 3 0.164244 85.167.26.187 -> 53.177.243.126 TCP 2084 >
80 [ACK] Seq=1 Ack=1 Win=16384 Len=0
<br>
0 4 0.164342 85.167.26.187 -> 53.177.243.126 TCP 2084 >
80 [PSH, ACK] Seq=1 Ack=1 Win=16384 Len=270
<br>
<br>
Three alerts are produced for some reason. The tcp alert hits
twice, and the http alert hits once.
<br>
<br>
01/24/2013-10:55:25.079657 [**] [1:2:0]
<a class="moz-txt-link-freetext" href="http://lockedoutofheaven.in/">http://lockedoutofheaven.in/</a> tcp [**] [Classification: A Network
Trojan was detected] [Priority: 1] {TCP} 85.167.26.187:2084 ->
53.177.243.126:80
<br>
01/24/2013-10:55:25.079657 [**] [1:2:0]
<a class="moz-txt-link-freetext" href="http://lockedoutofheaven.in/">http://lockedoutofheaven.in/</a> tcp [**] [Classification: A Network
Trojan was detected] [Priority: 1] {TCP} 85.167.26.187:2084 ->
53.177.243.126:80
<br>
01/24/2013-10:55:25.079657 [**] [1:1:0]
<a class="moz-txt-link-freetext" href="http://lockedoutofheaven.in/">http://lockedoutofheaven.in/</a> http [**] [Classification: A Network
Trojan was detected] [Priority: 1] {TCP} 85.167.26.187:2084 ->
53.177.243.126:80
<br>
<br>
Test case #2: SYN|ACK missing
<br>
<br>
0 1 0.000000 85.167.26.187 -> 53.177.243.126 TCP 2084 >
80 [SYN] Seq=0 Win=16384 Len=0 MSS=1460 WS=1 SACK_PERM=1
<br>
0 2 0.164244 85.167.26.187 -> 53.177.243.126 TCP 2084 >
80 [ACK] Seq=1 Ack=1 Win=16384 Len=0
<br>
0 3 0.164342 85.167.26.187 -> 53.177.243.126 TCP 2084 >
80 [PSH, ACK] Seq=1 Ack=1 Win=16384 Len=270
<br>
<br>
Only one tcp alert is produced:
<br>
<br>
01/24/2013-10:55:25.079657 [**] [1:2:0]
<a class="moz-txt-link-freetext" href="http://lockedoutofheaven.in/">http://lockedoutofheaven.in/</a> tcp [**] [Classification: A Network
Trojan was detected] [Priority: 1] {TCP} 85.167.26.187:2084 ->
53.177.243.126:80
<br>
<br>
Test case #3: Both SYN and SYN|ACK missing
<br>
<br>
0 1 0.000000 85.167.26.187 -> 53.177.243.126 TCP 2084 >
80 [ACK] Seq=1 Ack=1 Win=16384 Len=0
<br>
0 2 0.000098 85.167.26.187 -> 53.177.243.126 TCP 2084 >
80 [PSH, ACK] Seq=1 Ack=1 Win=16384 Len=270
<br>
<br>
01/24/2013-10:55:25.079657 [**] [1:2:0]
<a class="moz-txt-link-freetext" href="http://lockedoutofheaven.in/">http://lockedoutofheaven.in/</a> tcp [**] [Classification: A Network
Trojan was detected] [Priority: 1] {TCP} 85.167.26.187:2084 ->
53.177.243.126:80
<br>
01/24/2013-10:55:25.079657 [**] [1:2:0]
<a class="moz-txt-link-freetext" href="http://lockedoutofheaven.in/">http://lockedoutofheaven.in/</a> tcp [**] [Classification: A Network
Trojan was detected] [Priority: 1] {TCP} 85.167.26.187:2084 ->
53.177.243.126:80
<br>
01/24/2013-10:55:25.079657 [**] [1:1:0]
<a class="moz-txt-link-freetext" href="http://lockedoutofheaven.in/">http://lockedoutofheaven.in/</a> http [**] [Classification: A Network
Trojan was detected] [Priority: 1] {TCP} 85.167.26.187:2084 ->
53.177.243.126:80
<br>
<br>
Again, I see two tcp alerts and one http alert.
<br>
<br>
Test case #4: Only the HTTP GET is present
<br>
<br>
0 1 0.000000 85.167.26.187 -> 53.177.243.126 TCP 2084 >
80 [PSH, ACK] Seq=1 Ack=1 Win=16384 Len=270
<br>
<br>
This produces the same output as before. Two tcp alerts and one
http:
<br>
<br>
01/24/2013-10:55:25.079657 [**] [1:2:0]
<a class="moz-txt-link-freetext" href="http://lockedoutofheaven.in/">http://lockedoutofheaven.in/</a> tcp [**] [Classification: A Network
Trojan was detected] [Priority: 1] {TCP} 85.167.26.187:2084 ->
53.177.243.126:80
<br>
01/24/2013-10:55:25.079657 [**] [1:2:0]
<a class="moz-txt-link-freetext" href="http://lockedoutofheaven.in/">http://lockedoutofheaven.in/</a> tcp [**] [Classification: A Network
Trojan was detected] [Priority: 1] {TCP} 85.167.26.187:2084 ->
53.177.243.126:80
<br>
01/24/2013-10:55:25.079657 [**] [1:1:0]
<a class="moz-txt-link-freetext" href="http://lockedoutofheaven.in/">http://lockedoutofheaven.in/</a> http [**] [Classification: A Network
Trojan was detected] [Priority: 1] {TCP} 85.167.26.187:2084 ->
53.177.243.126:80
<br>
<br>
So it appears that the stream processor can't recover when it sees
a SYN, misses the SYN|ACK, and then sees subsequent packets in the
stream. I've attached anonymized pcaps for each test case.
<br>
<br>
- Matt
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Suricata IDS Users mailing list: <a class="moz-txt-link-abbreviated" href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a>
Site: <a class="moz-txt-link-freetext" href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a class="moz-txt-link-freetext" href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a>
List: <a class="moz-txt-link-freetext" href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a>
OISF: <a class="moz-txt-link-freetext" href="http://www.openinfosecfoundation.org/">http://www.openinfosecfoundation.org/</a></pre>
</blockquote>
<br>
</body>
</html>