<div dir="ltr">Is there a way to get it so the alert that sets the flowbit does not alert, only the one that follows where it checks to see if it was set?</div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jan 26, 2017 at 12:00 PM, <span dir="ltr"><<a href="mailto:oisf-users-request@lists.openinfosecfoundation.org" target="_blank">oisf-users-request@lists.openinfosecfoundation.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Send Oisf-users mailing list submissions to<br>
<a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users@lists.<wbr>openinfosecfoundation.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.<wbr>openinfosecfoundation.org/<wbr>mailman/listinfo/oisf-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:oisf-users-request@lists.openinfosecfoundation.org">oisf-users-request@lists.<wbr>openinfosecfoundation.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:oisf-users-owner@lists.openinfosecfoundation.org">oisf-users-owner@lists.<wbr>openinfosecfoundation.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of Oisf-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: suricata 3.2.0 for 10Gb performance (erik clark)<br>
2. Re: suricata 3.2.0 for 10Gb performance (Michał Purzyński)<br>
3. Re: af_packet and rss queue count (Michał Purzyński)<br>
4. question about http_uri and file_data (erik clark)<br>
5. Re: question about http_uri and file_data (Victor Julien)<br>
<br>
<br>
------------------------------<wbr>------------------------------<wbr>----------<br>
<br>
Message: 1<br>
Date: Thu, 26 Jan 2017 10:35:16 -0500<br>
From: erik clark <<a href="mailto:philosnef@gmail.com">philosnef@gmail.com</a>><br>
To: "Cooper F. Nelson" <<a href="mailto:cnelson@ucsd.edu">cnelson@ucsd.edu</a>><br>
Cc: <a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users@lists.<wbr>openinfosecfoundation.org</a><br>
Subject: Re: [Oisf-users] suricata 3.2.0 for 10Gb performance<br>
Message-ID:<br>
<CAK6atxpQE4gsepRKS_<wbr>TE3Hquo8D55wZ25T+HioR=<a href="mailto:zPyWYbSYAA@mail.gmail.com">zPyWYbSY<wbr>AA@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Cooper, just to followup. RedHat has confirmed that tpacket_v3 commits are<br>
in the 3.10 branch of RHEL7. They report it as being better supported in<br>
the 4 kernel line, but it is indeed supported though. If you are aware of<br>
specific commits for tpacket that you would like to see, pass them on and<br>
we can get them into 7.4 probably.<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20170126/e8b27732/attachment-0001.html" rel="noreferrer" target="_blank">http://lists.<wbr>openinfosecfoundation.org/<wbr>pipermail/oisf-users/<wbr>attachments/20170126/e8b27732/<wbr>attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Thu, 26 Jan 2017 08:31:50 -0800<br>
From: Michał Purzyński <<a href="mailto:michalpurzynski1@gmail.com">michalpurzynski1@gmail.com</a>><br>
To: erik clark <<a href="mailto:philosnef@gmail.com">philosnef@gmail.com</a>><br>
Cc: <a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users@lists.<wbr>openinfosecfoundation.org</a><br>
Subject: Re: [Oisf-users] suricata 3.2.0 for 10Gb performance<br>
Message-ID: <<a href="mailto:57394CC6-A016-46B8-A4C4-942D74ECE0D1@gmail.com">57394CC6-A016-46B8-A4C4-<wbr>942D74ECE0D1@gmail.com</a>><br>
Content-Type: text/plain; charset=us-ascii<br>
<br>
How about fixing the hash calculations, a patch that went upstream in the late 4.4<br>
<br>
> On Jan 26, 2017, at 7:35 AM, erik clark <<a href="mailto:philosnef@gmail.com">philosnef@gmail.com</a>> wrote:<br>
><br>
> Cooper, just to followup. RedHat has confirmed that tpacket_v3 commits are in the 3.10 branch of RHEL7. They report it as being better supported in the 4 kernel line, but it is indeed supported though. If you are aware of specific commits for tpacket that you would like to see, pass them on and we can get them into 7.4 probably.<br>
> ______________________________<wbr>_________________<br>
> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@<wbr>openinfosecfoundation.org</a><br>
> Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/<wbr>support/</a><br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.<wbr>openinfosecfoundation.org/<wbr>mailman/listinfo/oisf-users</a><br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Thu, 26 Jan 2017 08:34:50 -0800<br>
From: Michał Purzyński <<a href="mailto:michalpurzynski1@gmail.com">michalpurzynski1@gmail.com</a>><br>
To: erik clark <<a href="mailto:philosnef@gmail.com">philosnef@gmail.com</a>><br>
Cc: "<a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users@lists.<wbr>openinfosecfoundation.org</a>"<br>
<<a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users@lists.<wbr>openinfosecfoundation.org</a>><br>
Subject: Re: [Oisf-users] af_packet and rss queue count<br>
Message-ID: <<a href="mailto:7EA678C7-26EC-40DD-80C8-8B09BB6B7068@gmail.com">7EA678C7-26EC-40DD-80C8-<wbr>8B09BB6B7068@gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Pinning threads and disabling flow director should help. No time to test it though. Well, a quick test with bro half a year ago looked promising. There are more issues no one is aware of, I'll describe it later.<br>
<br>
> On Jan 26, 2017, at 7:05 AM, erik clark <<a href="mailto:philosnef@gmail.com">philosnef@gmail.com</a>> wrote:<br>
><br>
> If you set a symmetric queue (posted elsewhere in some thread), I believe you do not see issues with reordering. We have seen output from pf_ring and af_packet as being near identical in logged connections, events, so unless pf_ring is also mangling connectings the same way as if_packet/AF_PACKET, we can assume this is a non-issue. Packet loss is actually substantually lower for both suricata and bro using a symmetric key, proper udp/tcp hashing, and af_packet compared to pf_ring on identical hardware. It comes at cost of cpu over memory however.<br>
><br>
><br>
>> On Thu, Jan 26, 2017 at 9:56 AM, Seth Hall <<a href="mailto:seth@icir.org">seth@icir.org</a>> wrote:<br>
>><br>
>> > On Jan 26, 2017, at 8:29 AM, erik clark <<a href="mailto:philosnef@gmail.com">philosnef@gmail.com</a>> wrote:<br>
>> ><br>
>> > This is going into RHEL7.4, which is a 3.10 branch. We will be staying on RHEL7 as we have a full support contract with them, and to be honest, their engineers are amazing.<br>
>><br>
>> I would still be concerned about the packet reordering issue coming from the NIC with having multiple queues enabled. This appears to be an actual hardware behavior and not fixable through software. The effects from it can be fairly hard to discern too, but you may see an inflated capture_loss (in Bro, I forget what the Suricata equivalent is called) due to the packet reordering. It can also more directly effect things in UDP DNS query and reply matching.<br>
>><br>
>> Sorry for the Bro stuff on the OISF mailing list, but I thought it was relevant since Erik is running Bro as well as Suricata on his system and I assume that Suricata would also have the same or similar issues with reordered packets. It's not an easy problem to diagnose.<br>
>><br>
>> .Seth<br>
>><br>
>> --<br>
>> Seth Hall<br>
>> International Computer Science Institute<br>
>> (Bro) because everyone has a network<br>
>> <a href="http://www.bro.org/" rel="noreferrer" target="_blank">http://www.bro.org/</a><br>
>><br>
><br>
> ______________________________<wbr>_________________<br>
> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@<wbr>openinfosecfoundation.org</a><br>
> Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/<wbr>support/</a><br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.<wbr>openinfosecfoundation.org/<wbr>mailman/listinfo/oisf-users</a><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20170126/692e5abb/attachment-0001.html" rel="noreferrer" target="_blank">http://lists.<wbr>openinfosecfoundation.org/<wbr>pipermail/oisf-users/<wbr>attachments/20170126/692e5abb/<wbr>attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Thu, 26 Jan 2017 11:52:49 -0500<br>
From: erik clark <<a href="mailto:philosnef@gmail.com">philosnef@gmail.com</a>><br>
To: <a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users@lists.<wbr>openinfosecfoundation.org</a><br>
Subject: [Oisf-users] question about http_uri and file_data<br>
Message-ID:<br>
<<a href="mailto:CAK6atxqVcrpKomr_h4m3Grc9d7D1tF4T2ypono1OXjfzCuEgXQ@mail.gmail.com">CAK6atxqVcrpKomr_<wbr>h4m3Grc9d7D1tF4T2ypono1OXjfzCu<wbr>EgXQ@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
I have a pcap I am trying to get a signature to fire off of. Here is the<br>
sig:<br>
<br>
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"packer";<br>
content:"menu|2e|js"; http_uri; file_data;<br>
content:"eval(function(p,a,c,<wbr>k,e,d)"; fast_pattern:only; sid:1; rev:7;)<br>
<br>
I can't provide a pcap, but this is a standard dean edwards packer menu<br>
javascript.<br>
<br>
The problem I have is:<br>
<br>
the http_uri hit comes from local to remote (this is a get request).<br>
the file_data hit comes remote to local<br>
<br>
Is there any way to get one rule to fire off this? Maybe with flowbits?<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20170126/c310160e/attachment-0001.html" rel="noreferrer" target="_blank">http://lists.<wbr>openinfosecfoundation.org/<wbr>pipermail/oisf-users/<wbr>attachments/20170126/c310160e/<wbr>attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 5<br>
Date: Thu, 26 Jan 2017 17:55:21 +0100<br>
From: Victor Julien <<a href="mailto:lists@inliniac.net">lists@inliniac.net</a>><br>
To: <a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users@lists.<wbr>openinfosecfoundation.org</a><br>
Subject: Re: [Oisf-users] question about http_uri and file_data<br>
Message-ID: <<a href="mailto:910e5ab8-925b-8ea9-ffbc-2c9f91662d95@inliniac.net">910e5ab8-925b-8ea9-ffbc-<wbr>2c9f91662d95@inliniac.net</a>><br>
Content-Type: text/plain; charset=utf-8<br>
<br>
On 26-01-17 17:52, erik clark wrote:<br>
> I have a pcap I am trying to get a signature to fire off of. Here is the<br>
> sig:<br>
><br>
> alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"packer";<br>
> content:"menu|2e|js"; http_uri; file_data;<br>
> content:"eval(function(p,a,c,<wbr>k,e,d)"; fast_pattern:only; sid:1; rev:7;)<br>
><br>
> I can't provide a pcap, but this is a standard dean edwards packer menu<br>
> javascript.<br>
><br>
> The problem I have is:<br>
><br>
> the http_uri hit comes from local to remote (this is a get request).<br>
> the file_data hit comes remote to local<br>
><br>
> Is there any way to get one rule to fire off this? Maybe with flowbits?<br>
<br>
Right now only flowbits can solve this.<br>
<br>
We're thinking about adding a class of bidirectional rules for this<br>
scenario, but thats for the future.<br>
--<br>
------------------------------<wbr>---------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/" rel="noreferrer" target="_blank">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc" rel="noreferrer" target="_blank">http://www.inliniac.net/<wbr>victorjulien.asc</a><br>
------------------------------<wbr>---------------<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
______________________________<wbr>_________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@lists.openinfosecfoundation.org">Oisf-users@lists.<wbr>openinfosecfoundation.org</a><br>
<a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.<wbr>openinfosecfoundation.org/<wbr>mailman/listinfo/oisf-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of Oisf-users Digest, Vol 86, Issue 27<br>
******************************<wbr>************<br>
</blockquote></div><br></div>