<!DOCTYPE html PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'>
<html><head><meta http-equiv="Content-Type" content="text/html;charset=us-ascii">
<style>BODY{font:10pt Tahoma,Verdana,sans-serif} .MsoNormal{line-height:120%;margin:0}</style></head><body>
<DIV>We get the following message in large amounts when the SSL VPN is used but usually different socket numbers only with af-packet IPS mode enabled. Is it indicative of the flow timeouts being too small?</DIV>
<DIV> </DIV>
<DIV>SC_ERR_INVALID_ACTION(142) Sending packet failed on Socket 8: Message too long Unable to release packet data</DIV>
<P class=MsoPlainText>Leonard<BR></P>
<BLOCKQUOTE style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
<HR>
<B>From:</B> Victor Julien [mailto:lists@inliniac.net]<BR><B>To:</B> oisf-users@openinfosecfoundation.org<BR><B>Sent:</B> Tue, 14 May 2013 09:06:00 -0600<BR><B>Subject:</B> Re: [Oisf-users] Question on combined protocols<BR><BR>Btw you mail server still rejects my emails, very annoying to get an<BR>error each time I mail you:<BR><BR>he original message was received at Tue, 14 May 2013 15:46:19 +0200<BR>from a80-101-90-58.adsl.xs4all.nl [80.101.90.58]<BR><BR>----- The following addresses had permanent fatal errors -----<BR><<A href="mailto:ljacobs@netsecuris.com">ljacobs@netsecuris.com</A>><BR>(reason: 550 5.7.1 Service unavailable; Client host [83.215.238.27]<BR>blocked using Trend Micro RBL+. Please<BR>s...ail-abuse.com/cgi-bin/lookup?ip_address=83.215.238.27; User defined<BR>policy matched for 83.215.238.27)<BR><BR>----- Transcript of session follows -----<BR>... while talking to in.sjc.mx.trendmicro.com.:<BR>>>> DATA<BR><<< 550 5.7.1 Service unavailable; Client host [83.215.238.27] blocked<BR>using Trend Micro RBL+. Please see<BR><A href="http://www.mail-abuse.com/cgi-bin/lookup?ip_address=83.215.238.27;" target=_blank>http://www.mail-abuse.com/cgi-bin/lookup?ip_address=83.215.238.27;</A> User<BR>defined policy matched for 83.215.238.27<BR>550 5.1.1 <<A href="mailto:ljacobs@netsecuris.com">ljacobs@netsecuris.com</A>>... User unknown<BR><<< 554 5.5.1 Error: no valid recipients<BR><BR><BR>On 05/14/2013 04:02 PM, Victor Julien wrote:<BR>> On 05/14/2013 02:52 PM, Leonard Jacobs wrote:<BR>>> According to references on the web, SonicWALL Adventail SSL VPN uses non-RFC compliant SSL VPN by using SOCKS over HTTPS. The references refer to problems similar to what we experience with af-packet IPS mode where packets are getting dropped (not due to IPS but just flow stops). When doing a packet capture, we see a lot of TCP Retransmissions. According to references, turning off statefull inspection for 443 on firewall solves the problem but Suricata is not a firewall so there is no stateful inspection.<BR>>><BR>>> I am suggesting to the firewall folks that they need to turn off stateful inspection for this SSL VPN traffic because the SSL VPN device is in a DMZ on their firewall. They are checking with firewall vendor.<BR>> <BR>> Suricata's inspection is definitely stateful.<BR>> <BR>>> IDS mode with Suricata works fine.<BR>>><BR>>> We have tried decreasing the TCP flow timeouts but that does not solve the problem. We have considered using an alternative IPS to Suricata as a test to see if the problem goes away.<BR>> <BR>> I would suggest /increasing/ the time outs, not decreasing.<BR>> <BR>>> Do you have any ideas or suggestions?<BR>> <BR>> To me it sounds like your SSL product is broken, so I'd push them for a<BR>> fix. If their answer is to disable stateful inspection, you know they<BR>> have problems for sure.<BR>> <BR>> Cheers,<BR>> Victor<BR>> <BR>> <BR>>><BR>>> Thanks.<BR>>><BR>>> -----Original Message-----<BR>>> From: <A href="mailto:oisf-users-bounces@openinfosecfoundation.org">oisf-users-bounces@openinfosecfoundation.org</A> [mailto:<A href="mailto:oisf-users-bounces@openinfosecfoundation.org">oisf-users-bounces@openinfosecfoundation.org</A>] On Behalf Of Victor Julien<BR>>> Sent: Tuesday, May 14, 2013 5:43 AM<BR>>> To: <A href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</A><BR>>> Subject: Re: [Oisf-users] Question on combined protocols<BR>>><BR>>> On 05/13/2013 08:47 PM, Leonard Jacobs wrote:<BR>>>> <BR>>>> Would Suricata and af-packet in IPS mode have difficulty processing <BR>>>> network traffic using combined protocols such as SOCKS over HTTPS?<BR>>><BR>>> It shouldn't have. Are you seeing problems?<BR>>><BR>>> --<BR>>> ---------------------------------------------<BR>>> Victor Julien<BR>>> <A href="http://www.inliniac.net/" target=_blank>http://www.inliniac.net/</A><BR>>> PGP: <A href="http://www.inliniac.net/victorjulien.asc" target=_blank>http://www.inliniac.net/victorjulien.asc</A><BR>>> ---------------------------------------------<BR>>><BR>>> _______________________________________________<BR>>> Suricata IDS Users mailing list: <A href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</A><BR>>> Site: <A href="http://suricata-ids.org" target=_blank>http://suricata-ids.org</A> | Support: <A href="http://suricata-ids.org/support/" target=_blank>http://suricata-ids.org/support/</A><BR>>> List: <A href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target=_blank>https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</A><BR>>> OISF: <A href="http://www.openinfosecfoundation.org/" target=_blank>http://www.openinfosecfoundation.org/</A><BR>>><BR>> <BR>> <BR><BR><BR>-- <BR>---------------------------------------------<BR>Victor Julien<BR><A href="http://www.inliniac.net/" target=_blank>http://www.inliniac.net/</A><BR>PGP: <A href="http://www.inliniac.net/victorjulien.asc" target=_blank>http://www.inliniac.net/victorjulien.asc</A><BR>---------------------------------------------<BR><BR>_______________________________________________<BR>Suricata IDS Users mailing list: <A href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</A><BR>Site: <A href="http://suricata-ids.org" target=_blank>http://suricata-ids.org</A> | Support: <A href="http://suricata-ids.org/support/" target=_blank>http://suricata-ids.org/support/</A><BR>List: <A href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target=_blank>https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</A><BR>OISF: <A href="http://www.openinfosecfoundation.org/" target=_blank>http://www.openinfosecfoundation.org/</A><BR></BLOCKQUOTE>
<STYLE>
</STYLE>
<DIV> </DIV>
<DIV> </DIV></body></html>