<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Upon recently upgrading my sensors from Suricata 1.4.1 to 1.4.3,
events that trigger my "pass" rules are now getting dumped into my
unified2 output file right alongside all the "alert" events.
Multiple sites are affected by this and it's filling up my event
databases with unwanted non-alert events. Did something change
between 1.4.1 and 1.4.3 such that I need to do something special to
keep "pass" events from being output to my unified2 files? I did
not change the suricata.yaml files at all during the upgrade
process.<br>
<br>
The relevant outputs section from my suricata.yaml files:<br>
<blockquote>outputs:<br>
<br>
# alert output for use with Barnyard2<br>
- unified2-alert:<br>
enabled: yes<br>
filename: snort.u2<br>
<br>
# File size limit. Can be specified in kb, mb, gb. Just a
number<br>
# is parsed as bytes.<br>
limit: 128mb<br>
</blockquote>
Example custom pass rule that is firing a great deal and flooding me
with events I don't want to see<br>
<blockquote>pass tcp 172.18.2.215 80 -> 172.17.235.2 any (msg:"ET
ATTACK_RESPONSE Frequent HTTP 401 Unauthorized - Possible Brute
Force Attack"; flow:from_server,established; content:"HTTP/1.";
depth:7; content:" 401"; within:5; sid:5000025;)<br>
</blockquote>
I'm using barnyard 2.1.9 to move the unified2 records to a database
with this output directive <br>
<blockquote>output database: alert, mysql, user=snort dbname=snort
password=xxx host=xxxxxxx sensor_name=xxxxxxx<br>
</blockquote>
Here is the redacted alert-debug log accounting for the above pass
rule firing. What particularly stands out to me is that the "<tt>FLOW
ACTION:" section explicitly states the event is a PASS event. So
why are we writing it to the alert log?<br>
</tt>
<blockquote><tt>+================<br>
TIME: 06/25/2013-09:34:41.902360<br>
SRC IP: 172.18.2.215<br>
DST IP: 172.17.235.2<br>
PROTO: 6<br>
SRC PORT: 80<br>
DST PORT: 57649<br>
TCP SEQ: 3333329689<br>
TCP ACK: 2497971516<br>
FLOW: to_server: FALSE, to_client: TRUE<br>
FLOW Start TS: 06/25/2013-09:34:40.758394<br>
FLOW IPONLY SET: TOSERVER: TRUE, TOCLIENT: TRUE<br>
FLOW ACTION: DROP: FALSE, PASS TRUE<br>
FLOW NOINSPECTION: PACKET: FALSE, PAYLOAD: FALSE, APP_LAYER:
TRUE<br>
FLOW APP_LAYER: DETECTED: FALSE, PROTO 0<br>
PACKET LEN: 60<br>
PACKET:<br>
...<br>
ALERT CNT: 1<br>
ALERT MSG [00]: ET ATTACK_RESPONSE Frequent HTTP 401
Unauthorized - Possible Brute Force Attack<br>
ALERT GID [00]: 1<br>
ALERT SID [00]: 5000025<br>
ALERT REV [00]: 0<br>
ALERT CLASS [00]: <none><br>
ALERT PRIO [00]: 3<br>
ALERT FOUND IN [00]: STREAM<br>
STREAM DATA LEN: 610<br>
STREAM DATA:<br>
...<br>
+================<br>
</tt></blockquote>
Thanks in advance for your advice on how to get this behaving like
it used to. I really don't want to downgrade all my sensors back to
an older Suricata version.<br>
<br>
Thanks!<br>
Kevin<br>
</body>
</html>