<!DOCTYPE html PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'>
<html><head><meta http-equiv="Content-Type" content="text/html;charset=us-ascii">
<style>BODY{font:10pt Tahoma,Verdana,sans-serif} .MsoNormal{line-height:120%;margin:0}</style></head><body>
<DIV>Is the <FONT face="Courier New">stream.inline option include using af-packet IPS mode or is that for NFQ IPS mode?</FONT></DIV>
<DIV><FONT face="Courier New"></FONT> </DIV>
<DIV><FONT face="Courier New">We are using af-packet IPS method not NFQ.</FONT></DIV><BR>Leonard
<BLOCKQUOTE style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
<HR>
<B>From:</B> Victor Julien [mailto:lists@inliniac.net]<BR><B>To:</B> Leonard Jacobs [mailto:ljacobs@netsecuris.com]<BR><B>Cc:</B> oisf-users@openinfosecfoundation.org<BR><B>Sent:</B> Wed, 15 May 2013 05:27:51 -0600<BR><B>Subject:</B> Re: [Oisf-users] Question on combined protocols<BR><BR>On 05/14/2013 08:50 PM, Leonard Jacobs wrote:<BR>> So I am trying to understand the flow timeouts better. So flow timeouts<BR>> are the maximum time Suricata has to process the packets, correct? So<BR>> increasing the flow timeout gives a better chance to getting the packets<BR>> completely processed, correct?<BR><BR>No, the flow timeout controls how long Suricata keeps tracking a flow<BR>after the last packet was received. So if you have a TCP connection that<BR>sees no packets for 1 hour, Suricata cleans it up internally. Each time<BR>a packet is received, the timer is reset.<BR><BR>If a packet comes in for a already cleaned up TCP session it will be<BR>rejected if you use the stream.inline option. This could cause<BR>connections to fail (time out).<BR><BR>> IPS takes longer to process packets than IDS, correct? Could explain why<BR>> packets are being dropped and not making it through the processing chain<BR>> so that the SSL VPN is not getting the packets, correct?<BR><BR>IPS may take a little bit more time per packet as we have to<BR>reinject/verdict them, but this is not related to flow timeouts.<BR><BR>Cheers,<BR>Victor<BR><BR>> <BR>> Thanks.<BR>> <BR>> Leonard<BR>> <BR>> ------------------------------------------------------------------------<BR>> *From:* Victor Julien [mailto:<A href="mailto:lists@inliniac.net">lists@inliniac.net</A>]<BR>> *To:* <A href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</A><BR>> *Sent:* Tue, 14 May 2013 09:06:00 -0600<BR>> *Subject:* Re: [Oisf-users] Question on combined protocols<BR>> <BR>> Btw you mail server still rejects my emails, very annoying to get an<BR>> error each time I mail you:<BR>> <BR>> he original message was received at Tue, 14 May 2013 15:46:19 +0200<BR>> from a80-101-90-58.adsl.xs4all.nl [80.101.90.58]<BR>> <BR>> ----- The following addresses had permanent fatal errors -----<BR>> <<A href="mailto:ljacobs@netsecuris.com">ljacobs@netsecuris.com</A> <mailto:<A href="mailto:ljacobs@netsecuris.com">ljacobs@netsecuris.com</A>>><BR>> (reason: 550 5.7.1 Service unavailable; Client host [83.215.238.27]<BR>> blocked using Trend Micro RBL+. Please<BR>> s...ail-abuse.com/cgi-bin/lookup?ip_address=83.215.238.27; User defined<BR>> policy matched for 83.215.238.27)<BR>> <BR>> ----- Transcript of session follows -----<BR>> ... while talking to in.sjc.mx.trendmicro.com.:<BR>> >>> DATA<BR>> <<< 550 5.7.1 Service unavailable; Client host [83.215.238.27] blocked<BR>> using Trend Micro RBL+. Please see<BR>> <A href="http://www.mail-abuse.com/cgi-bin/lookup?ip_address=83.215.238.27;" target=_blank>http://www.mail-abuse.com/cgi-bin/lookup?ip_address=83.215.238.27;</A> User<BR>> defined policy matched for 83.215.238.27<BR>> 550 5.1.1 <<A href="mailto:ljacobs@netsecuris.com">ljacobs@netsecuris.com</A><BR>> <mailto:<A href="mailto:ljacobs@netsecuris.com">ljacobs@netsecuris.com</A>>>... User unknown<BR>> <<< 554 5.5.1 Error: no valid recipients<BR>> <BR>> <BR>> On 05/14/2013 04:02 PM, Victor Julien wrote:<BR>> > On 05/14/2013 02:52 PM, Leonard Jacobs wrote:<BR>> >> According to references on the web, SonicWALL Adventail SSL VPN<BR>> uses non-RFC compliant SSL VPN by using SOCKS over HTTPS. The<BR>> references refer to problems similar to what we experience with<BR>> af-packet IPS mode where packets are getting dropped (not due to IPS<BR>> but just flow stops). When doing a packet capture, we see a lot of<BR>> TCP Retransmissions. According to references, turning off statefull<BR>> inspection for 443 on firewall solves the problem but Suricata is<BR>> not a firewall so there is no stateful inspection.<BR>> >><BR>> >> I am suggesting to the firewall folks that they need to turn off<BR>> stateful inspection for this SSL VPN traffic because the SSL VPN<BR>> device is in a DMZ on their firewall. They are checking with<BR>> firewall vendor.<BR>> ><BR>> > Suricata's inspection is definitely stateful.<BR>> ><BR>> >> IDS mode with Suricata works fine.<BR>> >><BR>> >> We have tried decreasing the TCP flow timeouts but that does not<BR>> solve the problem. We have considered using an alternative IPS to<BR>> Suricata as a test to see if the problem goes away.<BR>> ><BR>> > I would suggest /increasing/ the time outs, not decreasing.<BR>> ><BR>> >> Do you have any ideas or suggestions?<BR>> ><BR>> > To me it sounds like your SSL product is broken, so I'd push them<BR>> for a<BR>> > fix. If their answer is to disable stateful inspection, you know they<BR>> > have problems for sure.<BR>> ><BR>> > Cheers,<BR>> > Victor<BR>> ><BR>> ><BR>> >><BR>> >> Thanks.<BR>> >><BR>> >> -----Original Message-----<BR>> >> From: <A href="mailto:oisf-users-bounces@openinfosecfoundation.org">oisf-users-bounces@openinfosecfoundation.org</A><BR>> <mailto:<A href="mailto:oisf-users-bounces@openinfosecfoundation.org">oisf-users-bounces@openinfosecfoundation.org</A>><BR>> [mailto:<A href="mailto:oisf-users-bounces@openinfosecfoundation.org">oisf-users-bounces@openinfosecfoundation.org</A><BR>> <mailto:<A href="mailto:oisf-users-bounces@openinfosecfoundation.org">oisf-users-bounces@openinfosecfoundation.org</A>>] On Behalf Of<BR>> Victor Julien<BR>> >> Sent: Tuesday, May 14, 2013 5:43 AM<BR>> >> To: <A href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</A><BR>> <mailto:<A href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</A>><BR>> >> Subject: Re: [Oisf-users] Question on combined protocols<BR>> >><BR>> >> On 05/13/2013 08:47 PM, Leonard Jacobs wrote:<BR>> >>><BR>> >>> Would Suricata and af-packet in IPS mode have difficulty processing<BR>> >>> network traffic using combined protocols such as SOCKS over HTTPS?<BR>> >><BR>> >> It shouldn't have. Are you seeing problems?<BR>> >><BR>> >> --<BR>> >> ---------------------------------------------<BR>> >> Victor Julien<BR>> >> <A href="http://www.inliniac.net/" target=_blank>http://www.inliniac.net/</A><BR>> >> PGP: <A href="http://www.inliniac.net/victorjulien.asc" target=_blank>http://www.inliniac.net/victorjulien.asc</A><BR>> >> ---------------------------------------------<BR>> >><BR>> >> _______________________________________________<BR>> >> Suricata IDS Users mailing list:<BR>> <A href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</A><BR>> <mailto:<A href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</A>><BR>> >> Site: <A href="http://suricata-ids.org" target=_blank>http://suricata-ids.org</A> | Support:<BR>> <A href="http://suricata-ids.org/support/" target=_blank>http://suricata-ids.org/support/</A><BR>> >> List:<BR>> <A href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target=_blank>https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</A><BR>> >> OISF: <A href="http://www.openinfosecfoundation.org/" target=_blank>http://www.openinfosecfoundation.org/</A><BR>> >><BR>> ><BR>> ><BR>> <BR>> <BR>> -- <BR>> ---------------------------------------------<BR>> Victor Julien<BR>> <A href="http://www.inliniac.net/" target=_blank>http://www.inliniac.net/</A><BR>> PGP: <A href="http://www.inliniac.net/victorjulien.asc" target=_blank>http://www.inliniac.net/victorjulien.asc</A><BR>> ---------------------------------------------<BR>> <BR>> _______________________________________________<BR>> Suricata IDS Users mailing list:<BR>> <A href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</A><BR>> <mailto:<A href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</A>><BR>> Site: <A href="http://suricata-ids.org" target=_blank>http://suricata-ids.org</A> | Support:<BR>> <A href="http://suricata-ids.org/support/" target=_blank>http://suricata-ids.org/support/</A><BR>> List:<BR>> <A href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target=_blank>https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</A><BR>> OISF: <A href="http://www.openinfosecfoundation.org/" target=_blank>http://www.openinfosecfoundation.org/</A><BR>> <BR>> <BR>> <BR><BR><BR>-- <BR>---------------------------------------------<BR>Victor Julien<BR><A href="http://www.inliniac.net/" target=_blank>http://www.inliniac.net/</A><BR>PGP: <A href="http://www.inliniac.net/victorjulien.asc" target=_blank>http://www.inliniac.net/victorjulien.asc</A><BR>---------------------------------------------<BR><BR></BLOCKQUOTE>
<STYLE>
</STYLE>
<DIV> </DIV>
<DIV> </DIV></body></html>