flexresp2 is broken in Snort 2.8.0 because of the inclusion of IPv6
support in Snort - there are conflicting types in the Snort code and
libdnet. This should be fixed in the 2.8.1 release (not sure on the
date yet for this release). Use the original flexresp
(--enable-flexresp) if you want to block requests or send resets.
Zakai Kinan wrote:
Are you saying that I should use --enable-flexresp
instead of --enable-flexresp2? --enable-flexresp2
does not work for me with my configure options used.
Some clarification would be helpful.
Thanks,
ZK
--- Todd Wease <twease@sourcefire.com> wrote:
Rob,
I just tested this and it seems to work fine with
the 2.8.0.1 tarball on
the snort.org site. Can you post the command line
you used to configure
Snort? The configure line I used was:
$ ./configure --enable-pthread
--enable-linux-smp-stats
--enable-dynamicplugin --enable-sourcefire
--enable-gre
--enable-targetbased --enable-flexresp
The rule I used was:
alert tcp $HOME_NET any -> 192.168.0.2 80 (msg:"You
bastard";
flow:to_server,established; content:"cmd.exe";
nocase;
classtype:policy-violation; sid:100000001; rev:8;
react:block;)
The snort.conf I used was the default one with the
above rule added at
the end of the file.
The snort command line I used was (running from top
level of source tree):
$ sudo ./src/snort -c ./etc/snort.conf.work -k none
-A cmg -i eth0
When I tried to use the url
"http://192.168.0.2/cmd.exe";, I got an alert
as well as the flexresp react block page sent to my
browser.
Also tried the resp rule:
alert tcp $HOME_NET any -> 192.168.0.2 80 (msg:"You
bastard";
flow:to_server,established; content:"cmd.exe";
nocase;
classtype:policy-violation; sid:100000001; rev:8;
resp:rst_snd;)
and I get a message sent to my browser that the
connection was reset.
This was not tested on a Cent OS 5 machine, but a
Fedora Core 8 intel.
I downloaded libnet-1.0.2a.tar.gz and just did the
normal './configure
&& make && sudo make install'.
Thanks,
Todd
Ward, Rob wrote:
I've installed with Flexresp and when I try to add
react:block; to a rule I get the message below, any
ideas please anyone?
FATAL ERROR: Warning:
/etc/snort/rules/local.rules(1) => Unknown keyword '
react' in rule!
The rule syntax looks OK to me and I've used this
before without a problem. I'm running snort 2.8.0.1
on Cent OS 5.
The rule looks like this:
alert tcp $HOME_NET any -> $EXTERNAL_NET 8888
(msg:"P2P napster login";
flow:to_server,established; content:"|00 02 00|";
depth:3; offset:1; classtype:policy-violation;
sid:549; rev:8; react:block;)
Also with Flexresp in which file do you put your
variables i.e:
# just stop the offender
var RESP_TCP resp:rst_snd;
I get the same error when I put this in snort.conf
and replace react:block; with $RESP_TCP in my rules.
I also get the same error with resp:rst_snd; in the
rules.
Any help would be appreciated, thanks!
Rob Ward
Network Northwest Support
University of Liverpool
Computing Services Department
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio
2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or
unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio
2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or
unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
____________________________________________________________________________________
Be a better friend, newshound, and
know-it-all with Yahoo! Mobile. Try it now.
http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
