<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;">Hello, </div><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;">I'm testing suricata 1.4.1 </div><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;"><br></div><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;">The first purpose of the test is to show events on a GUI: I choose BASE (1.4.5) as a GUI, Barnyard2 (2.1.12) to parse suricata's unified2 files and to put alerts on the data base.</div><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;"> I got the following results : </div><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;"><br></div><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;"><ul style="margin-right: 0px; margin-bottom: 20px; margin-left: 1em; padding-right: 0px; padding-left: 1em;"><li style="margin: 0px 0px 3px;"><span style="line-height: 22px; font-size: 12pt;">I wrote a simple ICMP rule : </span><span style="line-height: 22px; font-size: 12pt;">alert icmp any any -> any any (msg:"ICMP Testing Rule"; sid:1000001; rev:1;)</span></li></ul><div>Suricata can detect and put the ICMP into the unified2 file but Barnyard2 is unable to parse it and put the alert into the DB. I got this error : </div></div><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;"><br></div><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;"><div>WARNING database [Database()]: Called with Event[0x37e5170] Event Type [72] (P)acket [0x0], information has not been outputed.</div><div>WARNING database [Database()]: Called with Event[0x0] Event Type [0] (P)acket [0x3328e30], information has not been outputed.</div></div><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;"><br></div><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;"><span style="background-color: rgb(0, 0, 255);">Can it be an issue related to the unified2 file ? the way that Suricata logs on unified? (Barnyard2 installation is verified and OK) ??</span></div><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;"><br></div><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;"><ul style="margin-right: 0px; margin-bottom: 20px; margin-left: 1em; padding-right: 0px; padding-left: 1em;"><li style="margin: 0px 0px 3px;">I tested the following voip scan (sivus) rule which is a VRT one : </li></ul><div><br></div></div><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;"><span lang="EN-US" style="line-height: 17px; font-size: 9pt; font-family: Verdana, sans-serif;">alert udp $EXTERNAL_NET any -> $SIP_SERVERS $SIP_PORTS (msg:"VOIP-SIP-UDP Sivus scanner detected"; flow:to_server;content:"From|3A|"; fast_pattern:only; pcre:"/^From\x3A\s*sivus-discovery/Hsmi"; reference:url,www.vopsecurity.org/; classtype:network-scan; sid:12112; rev:4;)</span></div><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;"><span lang="EN-US" style="line-height: 17px; font-size: 9pt; font-family: Verdana, sans-serif;"><br></span></div><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;"><span style="background-color: rgb(0, 0, 255);">But no alerts in the unified2 file ! does Suricata supports snort rules ??? </span></div><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;"><span style="background-color: rgb(0, 0, 255);"><br></span></div><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;"><ul style="margin-right: 0px; margin-bottom: 20px; margin-left: 1em; padding-right: 0px; padding-left: 1em;"><li style="margin: 0px 0px 3px;">I tested the following voip scan (sipvicious) rule which is an ET rule : </li></ul><div><br></div><div><span lang="EN-US" style="line-height: 17px; font-size: 9pt; font-family: Verdana, sans-serif;">alert udp $EXTERNAL_NET any -> $SIP_SERVERS $SIP_PORTS (msg:"VOIP-SIP- SCAN Sipvicious User-Agent Detected"; content:"|0d 0a|User-Agent|3A| friendly-scanner"; classtype: network-scan; reference:url,blog.sipvicious.org/; sid:2011716; rev:2;)</span></div></div><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;"><span lang="EN-US" style="line-height: 17px; font-size: 9pt; font-family: Verdana, sans-serif;"><br></span></div><div style="line-height: 21px; color: rgb(68, 68, 68); font-size: 15px;"><span lang="EN-US" style="line-height: 17px; font-size: 9pt; font-family: Verdana, sans-serif;"><div style="line-height: 22px; font-family: Calibri, sans-serif; font-size: 16px;"><span style="background-color: rgb(0, 0, 255);">But no alerts in the unified2 file ! does Suricata has somme issues with ET rules ??? </span></div><div style="line-height: 22px; font-family: Calibri, sans-serif; font-size: 16px;"><span style="background-color: rgb(0, 0, 255);"><br></span></div><div style="line-height: 22px; font-family: Calibri, sans-serif; font-size: 16px;"><font style="line-height: normal;"><br style="line-height: 22px;"></font></div><div><font style="line-height: normal;">I'm interested in your IDS and would like to make other tests especially on VoIP. Could you please give me some responses about the mentionned issues??</font></div><div><font style="line-height: normal;"><br style="line-height: 17px;"></font></div><div><font style="line-height: normal;">Thank you</font></div><div><font style="line-height: normal;"><br style="line-height: 17px;"></font></div><div><font style="line-height: normal;">Marwane AZZOUZI</font></div></span></div> </div></body>
</html>