<div dir="ltr"><div><div>Hey folks,<br><br></div>I've developed a barnyard2 SNMP output plugin using a merger of the version 0.2.0 barnyard2 SNMP module patch and the current syslog output plugin. It's useful to us to forward alerts to our SNMP management console, as well as the normal log handling systems such as snorby. Alerts can go to both etc.<br>
<br>Here's an extract from our barnyard2.conf file:<br><br># Examples:<br># output alert_snmp<br># output alert_snmp: hostname=<a href="http://nms.example.com">nms.example.com</a><br># output alert_snmp: retries=2<br>
# output alert_snmp: remote_port=161<br># output alert_snmp: transport=udp | tcp<br># output alert_snmp: events_per_sec_limit: 10<br># output alert_snmp: community=public<br># output alert_snmp: snmp_trap_type=normal | agentx<br>
# output alert_snmp: snmp_version=1 | 2c<br># output alert_snmp: enterprise_oid=1.3.6.1.4.1.999<br>#<br>output alert_snmp: hostname=<a href="http://snmphost.example.com">snmphost.example.com</a>, remote_port=161, transport=udp, community=public, events_per_sec_limit=20, snmp_version=2c, snmp_trap_type=normal, enterprise_oid=1.3.6.1.4.1.999<br>
<br>What I've noticed is the SNMP OIDs being seen on the receiving host were those of Snort:<br><br>Ent Value 0: .1.3.6.1.4.1.10234.2.1.2.1.2.0.199283=02/03/14-16:56:25.481721<br>Ent Value 1: .1.3.6.1.4.1.10234.2.1.2.1.33.0.199283=1<br>
Ent Value 2: .1.3.6.1.4.1.10234.2.1.2.1.34.0.199283=0<br>Ent Value 3: .1.3.6.1.4.1.10234.2.1.2.1.29.0.199283=2221021<br>Ent Value 4: .1.3.6.1.4.1.10234.2.1.2.1.30.0.199283=1<br>Ent Value 5: .1.3.6.1.4.1.10234.2.1.2.1.31.0.199283=SURICATA HTTP response header invalid<br>
Ent Value 6: .1.3.6.1.4.1.10234.2.1.2.1.28.0.199283=TCP<br>Ent Value 7: .1.3.6.1.4.1.10234.2.1.2.1.7.0.199283=123.123.123.30<br>Ent Value 8: .1.3.6.1.4.1.10234.2.1.2.1.9.0.199283=10.10.10.61<br>Ent Value 9: .1.3.6.1.4.1.10234.2.1.2.1.10.0.199283=80<br>
Ent Value 10: .1.3.6.1.4.1.10234.2.1.2.1.11.0.199283=53927<br>Ent Value 11: .1.3.6.1.4.1.10234.2.1.2.1.35.0.199283=Generic Protocol Command Decode<br>Ent Value 12: .1.3.6.1.4.1.10234.2.1.2.1.25.0.199283=3<br><br>10234 is the enterprise number for <a href="http://snort.org">snort.org</a> as seen here:<br>
<br><a href="https://www.iana.org/assignments/enterprise-numbers/enterprise-numbers">https://www.iana.org/assignments/enterprise-numbers/enterprise-numbers</a><br>10234 Snort.org Glenn Mansfield Keeni glenn&<a href="http://cysols.com">cysols.com</a><br>
<br>The reason that was used is because of the definitions in the SNMP plugin .h file. Back when the file was created, snort was the tool generating the input to barnyard2. I essentially left the OIDs as they were and can now see it's probably not logical to do so:<br>
<span style="font-family:courier new,monospace"><br>% cat spo_snmp_mib.h<br>#ifndef OP_SNMP_MIB_H_<br>#define OP_SNMP_MIB_H_<br>#define OID_SIDA_ALERT { 1, 3, 6, 1, 4, 1, 10234, 2, 1, 2, 1, 0, 0, 0 }<br>#define OID_SIDA_ALERT_GENERIC { 1, 3, 6, 1, 4, 1, 10234, 2, 1, 3, 3 }<br>
enum {<br> SIDA_ALERT_PARAM_IDX = 11,<br> SIDA_ALERT_SENSOR_ID_IDX = 12,<br> SIDA_ALERT_EVENT_ID_IDX = 13,<br> <br> ALERTID = 1, <br> ALERTTIMESTAMP = 2, <br>
ALERTACTIONSTAKEN = 3, <br> ALERTMSG = 4, <br> ALERTMOREINFO = 5, </span><br><br>I was considering altering the enterprise number and using our own internal number, but that would infer that our companies' software is the creator of these traps, when in reality it's information generated from suricata and passed on via barnyard2. It's certainly not coming from snort any more so that should be changed. It's a bit of an issue as Networks want a MIB file to describe these OIDs. I have created some but which enterprise number to use is the problem.<br>
<br></div><div>So, what's the best creator ID to use in the OID? suricata or barnyard2? If it's barnyard2, then I can ask Ian Firns to register a number for it. I'd like to see suricata have their own though, and the barnyard2 SNMP output plugin be configured to send it. I can convert the MIBs to be <a href="http://suricata.org">suricata.org</a> MIBs and submit them as a feature addition in git.</div>
<div><br>Suricata can ask for their own enterprise number here:<br><a href="http://pen.iana.org/pen/PenApplication.page">http://pen.iana.org/pen/PenApplication.page</a><br><br></div><div>Thoughts?<br><br>ta,<br>Mark.<br>
<br>
</div><div><br></div></div>