<div dir="ltr">You have set them up to alert in any direction (the '<>') [1]. If you had say A -> B it would only alert if this was a packet from host A towards host B. Also, might be better to define some netvariables like say HOME_NET[2] and so on to better divide where the rules will trigger, rather than doing single IP management in the rules.<div><br></div><div>[1] <a href="http://manual.snort.org/node29.html#SECTION00425000000000000000">http://manual.snort.org/node29.html#SECTION00425000000000000000</a><br></div><div>[2] <a href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml#Rule-vars">https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml#Rule-vars</a></div></div><div class="gmail_extra"><br><div class="gmail_quote">2015-05-04 23:05 GMT+02:00 James Moe <span dir="ltr"><<a href="mailto:jimoe@sohnen-moe.com" target="_blank">jimoe@sohnen-moe.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
Hello,<br>
suricata 2.0.7<br>
linux 3.16.7-21-desktop x86_64<br>
<br>
Last night suricata exploded in action, logging huge numbers<br>
(2,688,052) of "invalid ack" alerts between 2:19am and 8:58am (when I<br>
stopped suricata). The alerts were only two SIDs: 2210029 and 2210045.<br>
<br>
I have two problems with this:<br>
1. Why are the modified rules (see below) not effective? My<br>
understanding is that the alert would be valid for all IPs *except*<br>
192.168.69.245 in either direction.<br>
<br>
2. Why do these alerts stop after restarting suricata?<br>
<br>
<br>
- ----[ modified rules ]----<br>
alert tcp ![192.168.69.245] any <> any any \<br>
(msg:"SURICATA STREAM ESTABLISHED invalid ack"; \<br>
stream-event:est_invalid_ack; sid:2210029; rev:1;)<br>
<br>
alert tcp ![192.168.69.245] any <> any any \<br>
(msg:"SURICATA STREAM Packet with invalid ack"; \<br>
stream-event:pkt_invalid_ack; sid:2210045; rev:1;)<br>
- ----[ end ]----<br>
<br>
- ----[ 2 of 2,688,052 alerts ]----<br>
05/04/2015-02:19:39.051549 [**] [1:2210029:1] \<br>
SURICATA STREAM ESTABLISHED invalid ack [**] \<br>
[Classification: (null)] [Priority: 3] {TCP} \<br>
<a href="http://192.168.69.245:2049" target="_blank">192.168.69.245:2049</a> -> <a href="http://192.168.69.115:883" target="_blank">192.168.69.115:883</a><br>
<br>
05/04/2015-02:19:39.051549 [**] [1:2210045:1] \<br>
SURICATA STREAM Packet with invalid ack [**] \<br>
[Classification: (null)] [Priority: 3] {TCP} \<br>
<a href="http://192.168.69.245:2049" target="_blank">192.168.69.245:2049</a> -> <a href="http://192.168.69.115:883" target="_blank">192.168.69.115:883</a><br>
- ----[ end ]----<br>
<br>
28/4/2015 -- 20:10:34 - <Info> - 48 rule files processed. 16417 rules<br>
successfully loaded, 0 rules failed<br>
<br>
28/4/2015 -- 20:10:38 - <Warning> - [ERRCODE: SC_ERR_PCAP_CREATE(21)]<br>
- - Using Pcap capture with GRO or LRO activated can lead to capture<br>
problems<br>
<br>
<br>
- --<br>
James Moe<br>
moe dot james at sohnen-moe dot com<br>
520.743.3936<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v2<br>
<br>
iEYEARECAAYFAlVH3zEACgkQzTcr8Prq0ZNXSwCfbmt8fusI1DV3tTgvYFDXPKYB<br>
B9kAoLUei7QRXad2Y9E8R7SLN2/Yf+3A<br>
=vvmL<br>
-----END PGP SIGNATURE-----<br>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
Suricata User Conference November 4 & 5 in Barcelona: <a href="http://oisfevents.net" target="_blank">http://oisfevents.net</a><br>
</blockquote></div><br></div>