[Oisf-users] tcp.reassembly_gap
Luke Whitworth
l.a.whitworth at gmail.com
Tue Jan 26 11:33:30 UTC 2016
Thanks for the reply. I'm looking at seeing if I can get a PCAP of the
alert that was missed out of Snorts unified log (using u2boat if memory
serves). Until then here's the current stats.log:
Date: 1/26/2016 -- 11:30:17 (uptime: 0d, 02h 23m 02s)
-------------------------------------------------------------------
Counter | TM Name | Value
-------------------------------------------------------------------
capture.kernel_packets | Total | 682560755
capture.kernel_drops | Total | 58551
decoder.pkts | Total | 682631014
decoder.bytes | Total | 560340398074
decoder.invalid | Total | 16
decoder.ipv4 | Total | 682297726
decoder.ipv6 | Total | 2707083
decoder.ethernet | Total | 682631014
decoder.raw | Total | 0
decoder.null | Total | 0
decoder.sll | Total | 0
decoder.tcp | Total | 615528819
decoder.udp | Total | 66707900
decoder.sctp | Total | 0
decoder.icmpv4 | Total | 340969
decoder.icmpv6 | Total | 40166
decoder.ppp | Total | 1847
decoder.pppoe | Total | 0
decoder.gre | Total | 1847
decoder.vlan | Total | 0
decoder.vlan_qinq | Total | 0
decoder.teredo | Total | 1402773
decoder.ipv4_in_ipv6 | Total | 0
decoder.ipv6_in_ipv6 | Total | 0
decoder.mpls | Total | 0
decoder.avg_pkt_size | Total | 820
decoder.max_pkt_size | Total | 1514
decoder.erspan | Total | 0
flow.memcap | Total | 0
defrag.ipv4.fragments | Total | 11194
defrag.ipv4.reassembled | Total | 5420
defrag.ipv4.timeouts | Total | 0
defrag.ipv6.fragments | Total | 663
defrag.ipv6.reassembled | Total | 314
defrag.ipv6.timeouts | Total | 0
defrag.max_frag_hits | Total | 0
tcp.sessions | Total | 3176947
tcp.ssn_memcap_drop | Total | 0
tcp.pseudo | Total | 880612
tcp.pseudo_failed | Total | 0
tcp.invalid_checksum | Total | 3089
tcp.no_flow | Total | 0
tcp.syn | Total | 3678418
tcp.synack | Total | 3391449
tcp.rst | Total | 2451453
tcp.segment_memcap_drop | Total | 0
tcp.stream_depth_reached | Total | 22919
tcp.reassembly_gap | Total | 316061
detect.alert | Total | 33
flow_mgr.closed_pruned | Total | 2579970
flow_mgr.new_pruned | Total | 912247
flow_mgr.est_pruned | Total | 2167370
flow.spare | Total | 50481
flow.emerg_mode_entered | Total | 0
flow.emerg_mode_over | Total | 0
flow.tcp_reuse | Total | 98282
tcp.memuse | Total | 33052864
tcp.reassembly_memuse | Total | 2067435230
dns.memuse | Total | 16785488
dns.memcap_state | Total | 0
dns.memcap_global | Total | 2703798
http.memuse | Total | 251321971
http.memcap | Total | 0
flow.memuse | Total | 93978880
Cheers,
Luke
On 26 January 2016 at 11:28, Victor Julien <lists at inliniac.net> wrote:
> On 26-01-16 11:32, Luke Whitworth wrote:
>
>> Still sadly seeing some gaps in detection on Suricata that I'm not
>> seeing in Snort on this host. Both Snort and Suricata are pulling from
>> pfring, running side by side on the same server. If I check detections
>> side by side:
>>
>> Snort
>> GB 138.250.4.235 CN 140.207.217.32 ET TROJAN Possible
>> Win32/Hupigon ip.txt with a Non-Mozilla UA 9:15 AM
>> GB 138.250.128.17 GB 138.250.13.32 ET TROJAN Downloader User-Agent
>> HTTPGET 9:35 AM
>> GB 138.250.5.215 DE 46.33.68.72 ET CURRENT_EVENTS Fake Virus
>> Phone Scam Landing Nov 16 9:41 AM
>> GB 138.250.72.201 -- 104.66.229.96 ET CURRENT_EVENTS Terse
>> alphanumeric executable downloader hig... 9:49 AM
>>
>> Suricata
>> 01/26/2016-09:15:14.166186 [**] [1:2016950:2] ET TROJAN Possible
>> Win32/Hupigon ip.txt with a Non-Mozilla UA [**] [Classification: A
>> Network Trojan was detected] [Priority: 1] {TCP} 138.250.4.235:63342
>> <http://138.250.4.235:63342> -> 115.159.15.29:80 <http://115.159.15.29:80
>> >
>> 01/26/2016-09:41:37.799048 [**] [1:2022103:2] ET CURRENT_EVENTS Fake
>> Virus Phone Scam Landing Nov 16 [**] [Classification: A Network Trojan
>> was detected] [Priority: 1] {TCP} 138.250.5.215:58869
>> <http://138.250.5.215:58869> -> 46.33.68.72:80 <http://46.33.68.72:80>
>> 01/26/2016-09:49:24.287326 [**] [1:2019714:3] ET CURRENT_EVENTS Terse
>> alphanumeric executable downloader high likelihood of being hostile [**]
>> [Classification: Potentially Bad Traffic] [Priority: 2] {TCP}
>> 138.250.72.201:65131 <http://138.250.72.201:65131> -> 104.66.229.96:80
>> <http://104.66.229.96:80>
>>
>> So for some reason Snort managed to detect the event at 9:35 AM that
>> Suricata didn't. I'm having a bit of trouble getting to the bottom of
>> why this might be the case. Does anyone have any suggestions for me
>> where to start?
>>
>
>
> Pcap would be useful of course :)
>
> Also, can you share a full section of your stats.log?
>
> --
> ---------------------------------------------
> Victor Julien
> http://www.inliniac.net/
> PGP: http://www.inliniac.net/victorjulien.asc
> ---------------------------------------------
>
>
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Suricata User Conference November 9-11 in Washington, DC:
> http://oisfevents.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20160126/85cce961/attachment-0002.html>
More information about the Oisf-users
mailing list