<div class="literalblock">\r
<div class="content">\r
<pre><code> ,,_ -*> Snort++ <*-\r
-o" )~ Version 3.0.0-a1 (Build 144) from 2.9.6-9\r
+o" )~ Version 3.0.0-a1 (Build 150) from 2.9.7-177\r
'''' By Martin Roesch & The Snort Team\r
http://snort.org/contact#team\r
Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved.\r
</li>\r
</ul></div>\r
</div>\r
+<div class="sect2">\r
+<h3 id="_packet_processing">Packet Processing</h3>\r
+<div class="paragraph"><p>One of the goals of Snort++ is to provide a more flexible framework for\r
+packet processing by implementing an event-driven approach. Another is to\r
+produce data only when needed, to minimize expensive normalizations. To help\r
+explain these concepts, let’s start by examining how Snort processes\r
+packets. The key steps are given in the following figure:</p></div>\r
+<div class="imageblock">\r
+<div class="content">\r
+<img src="./snort2x.png" alt="Snort 2X" width="640" />\r
+</div>\r
+</div>\r
+<div class="paragraph"><p>The preprocess step is highly configurable. Arbitrary preprocessors can be\r
+loaded dynamically at startup, configured in snort.conf, and then executed\r
+at runtime. Basically, the preprocessors are put into a list which is\r
+iterated for each packet. Recent versions have tweaked the list handling\r
+some, but the same basic architecture has allowed Snort to grow from a\r
+sniffer, with no preprocessing, to a full-fledged IPS, with lots of\r
+preprocessing.</p></div>\r
+<div class="paragraph"><p>While this "list of plugins" approach has considerable flexibility, it\r
+hampers future development when the flow of data from one preprocessor to\r
+the next depends on traffic conditions, a common situation with advanced\r
+features like application identification. In this case, a preprocessor\r
+like HTTP may be extracting and normalizing data that ultimately is not\r
+used, or app ID may be repeatedly checking for data that is just not\r
+available.</p></div>\r
+<div class="paragraph"><p>Callbacks help break out of the preprocess straightjacket. This is where\r
+one preprocessor supplies another with a function to call when certain data\r
+is available. Snort has started to take this approach to pass some HTTP and\r
+SIP preprocessor data to app ID. However, it remains a peripheral feature\r
+and still requires the production of data that may not be consumed.</p></div>\r
+<div class="paragraph"><p>The basic processing steps Snort<code> takes are similar to Snort’s as seen in\r
+the following diagram. The preprocess step employs specific inspector\r
+types instead of a generalized list, but the basic procedure includes\r
+stateless packet decoding, TCP stream reassembly, and service specific\r
+analysis in both cases. (Snort</code> provides hooks for arbitrary inspectors,\r
+but they are not central to basic flow processing and are not shown.)</p></div>\r
+<div class="imageblock">\r
+<div class="content">\r
+<img src="./snort3x.png" alt="Snort 3X" width="640" />\r
+</div>\r
+</div>\r
+<div class="paragraph"><p>However, Snort++ also provides a more flexible mechanism than callback\r
+functions. By using inspection events, it is possible for an inspector to\r
+supply data that other inspectors can process. This is known as the\r
+observer pattern or publish-subscribe pattern.</p></div>\r
+<div class="paragraph"><p>Note that the data is not actually published. Instead, access to the data\r
+is published, and that means that subscribers can access the raw or\r
+normalized version(s) as needed. Normalizations are done only on the first\r
+access, and subsequent accesses get the previously normalized data. This\r
+results in just in time (JIT) processing.</p></div>\r
+<div class="paragraph"><p>A basic example of this in action is provided by the extra data_log plugin.\r
+It is a passive inspector, ie it does nothing until it receives the data it\r
+subscribed for (<em>other</em> in the above diagram). By adding data_log = { key\r
+= <em>http_raw_uri</em> } to your snort.lua configuration, you will get a simple\r
+URI logger.</p></div>\r
+<div class="paragraph"><p>Inspection events coupled with pluggable inspectors provide a very flexible\r
+framework for implementing new features. And JIT buffer stuffers allow\r
+Snort<code> to work smarter, not harder. These capabilities will be leveraged\r
+more and more as Snort</code> development continues.</p></div>\r
+</div>\r
</div>\r
</div>\r
<div class="sect1">\r
</li>\r
<li>\r
<p>\r
+w3m from <a href="http://sourceforge.net/projects/w3m/">http://sourceforge.net/projects/w3m/</a> to build the plain text\r
+ manual\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
check from <a href="http://check.sourceforge.net">http://check.sourceforge.net</a> to build unit tests\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-string <strong>daq.var</strong>: list of name=value DAQ-specific parameters\r
+string <strong>daq.vars</strong>: comma separated list of name=value DAQ-specific parameters\r
</p>\r
</li>\r
<li>\r
int <strong>file_id.show_data_depth</strong> = 100: print this many octets { 0: }\r
</p>\r
</li>\r
+<li>\r
+<p>\r
+int <strong>file_id.file_rules[].rev</strong> = 0: rule revision { 0: }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+string <strong>file_id.file_rules[].msg</strong>: information about the file type\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+string <strong>file_id.file_rules[].type</strong>: file type name\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>file_id.file_rules[].id</strong> = 0: file type id { 0: }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+string <strong>file_id.file_rules[].category</strong>: file type category\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+string <strong>file_id.file_rules[].version</strong>: file type version\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+string <strong>file_id.file_rules[].magic[].content</strong>: file magic content\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>file_id.file_rules[].magic[].offset</strong> = 0: file magic offset { 0: }\r
+</p>\r
+</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
</li>\r
<li>\r
<p>\r
-string <strong>output.event_trace.file</strong>: where to write event trace logs\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
int <strong>output.event_trace.max_data</strong> = 0: maximum amount of packet data to capture { 0:65535 }\r
</p>\r
</li>\r
<h2 id="_data_modules">Data Modules</h2>\r
<div class="sectionbody">\r
<div class="paragraph"><p>Data modules are adjunct configurations for use with certain inspectors.</p></div>\r
+<div class="paragraph"><p>no match\r
+no match</p></div>\r
+</div>\r
+</div>\r
+<div class="sect1">\r
+<h2 id="_inspector_modules">Inspector Modules</h2>\r
+<div class="sectionbody">\r
+<div class="paragraph"><p>These modules perform a variety of functions, including analysis of\r
+protocols beyond basic decoding.</p></div>\r
<div class="sect2">\r
-<h3 id="_ftp_client">ftp_client</h3>\r
-<div class="paragraph"><p>What: FTP client configuration module for use with ftp_server</p></div>\r
-<div class="paragraph"><p>Type: data</p></div>\r
+<h3 id="_arp_spoof">arp_spoof</h3>\r
+<div class="paragraph"><p>What: detect ARP attacks and anomalies</p></div>\r
+<div class="paragraph"><p>Type: inspector</p></div>\r
<div class="paragraph"><p>Configuration:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-bool <strong>ftp_client.bounce</strong> = false: check for bounces\r
+ip4 <strong>arp_spoof.hosts[].ip</strong>: host ip address\r
</p>\r
</li>\r
<li>\r
<p>\r
-addr <strong>ftp_client.bounce_to[].address</strong> = 1.0.0.0/32: allowed ip address in CIDR format\r
+mac <strong>arp_spoof.hosts[].mac</strong>: host mac address\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Rules:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-port <strong>ftp_client.bounce_to[].port</strong> = 20: allowed port { 1: }\r
+<strong>112:1</strong> (arp_spoof) unicast ARP request\r
</p>\r
</li>\r
<li>\r
<p>\r
-port <strong>ftp_client.bounce_to[].last_port</strong>: optional allowed range from port to last_port inclusive { 0: }\r
+<strong>112:2</strong> (arp_spoof) ethernet/ARP mismatch request for source\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>ftp_client.ignore_telnet_erase_cmds</strong> = false: ignore erase character and erase line commands when normalizing\r
+<strong>112:3</strong> (arp_spoof) ethernet/ARP mismatch request for destination\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>ftp_client.max_resp_len</strong> = -1: maximum ftp response accepted by client { -1: }\r
+<strong>112:4</strong> (arp_spoof) attempted ARP cache overwrite attack\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-bool <strong>ftp_client.telnet_cmds</strong> = false: detect telnet escape sequences on ftp control channel\r
+<strong>arp_spoof.packets</strong>: total packets\r
</p>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_http_global">http_global</h3>\r
-<div class="paragraph"><p>What: http inspector global configuration and client rules for use with http_server</p></div>\r
-<div class="paragraph"><p>Type: data</p></div>\r
-<div class="paragraph"><p>Configuration:</p></div>\r
+<h3 id="_back_orifice">back_orifice</h3>\r
+<div class="paragraph"><p>What: back orifice detection</p></div>\r
+<div class="paragraph"><p>Type: inspector</p></div>\r
+<div class="paragraph"><p>Rules:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-int <strong>http_global.compress_depth</strong> = 65535: maximum amount of packet payload to decompress { 1:65535 }\r
+<strong>105:1</strong> (back_orifice) BO traffic detected\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>http_global.decode.b64_decode_depth</strong> = 0: single packet decode depth { -1:65535 }\r
+<strong>105:2</strong> (back_orifice) BO client traffic detected\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>http_global.decode.bitenc_decode_depth</strong> = 0: single packet decode depth { -1:65535 }\r
+<strong>105:3</strong> (back_orifice) BO server traffic detected\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>http_global.decode.max_mime_mem</strong> = 838860: single packet decode depth { 3276: }\r
+<strong>105:4</strong> (back_orifice) BO Snort buffer attack\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-int <strong>http_global.decode.qp_decode_depth</strong> = 0: single packet decode depth { -1:65535 }\r
+<strong>back_orifice.packets</strong>: total packets\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_binder">binder</h3>\r
+<div class="paragraph"><p>What: configure processing based on CIDRs, ports, services, etc.</p></div>\r
+<div class="paragraph"><p>Type: inspector</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-int <strong>http_global.decode.uu_decode_depth</strong> = 0: single packet decode depth { -1:65535 }\r
+int <strong>binder[].when.policy_id</strong> = 0: unique ID for selection of this config by external logic { 0: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>http_global.decompress_depth</strong> = 65535: maximum amount of decompressed data to process { 1:65535 }\r
+bit_list <strong>binder[].when.ifaces</strong>: list of interface indices { 255 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>http_global.detect_anomalous_servers</strong> = false: inspect non-configured ports for HTTP - bad idea\r
+bit_list <strong>binder[].when.vlans</strong>: list of VLAN IDs { 4095 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>http_global.max_gzip_mem</strong> = 838860: total memory used for decompression across all active sessions { 3276: }\r
+addr_list <strong>binder[].when.nets</strong>: list of networks\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>http_global.memcap</strong> = 150994944: limit of memory used for logging extra data { 2304: }\r
+enum <strong>binder[].when.proto</strong>: protocol { any | ip | icmp | tcp | udp }\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>http_global.proxy_alert</strong> = false: alert on proxy usage for servers without allow_proxy_use\r
+bit_list <strong>binder[].when.ports</strong>: list of ports { 65535 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>http_global.unicode_map.code_page</strong> = 1252: select code page in map file { 0: }\r
+enum <strong>binder[].when.role</strong> = any: use the given configuration on one or any end of a session { client | server | any }\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>http_global.unicode_map.map_file</strong>: unicode map file\r
+string <strong>binder[].when.service</strong>: override default configuration\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Rules:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>119:1</strong> (http_global) ascii encoding\r
+enum <strong>binder[].use.action</strong> = inspect: what to do with matching traffic { block | allow | inspect }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:2</strong> (http_global) double decoding attack\r
+string <strong>binder[].use.file</strong>: use configuration in given file\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:3</strong> (http_global) u encoding\r
+string <strong>binder[].use.service</strong>: override automatic service identification\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:4</strong> (http_global) bare byte unicode encoding\r
+string <strong>binder[].use.type</strong>: select module for binding\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:5</strong> (http_global) base36 encoding\r
+string <strong>binder[].use.name</strong>: symbol name (defaults to type)\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>119:6</strong> (http_global) UTF-8 encoding\r
+<strong>binder.packets</strong>: initial bindings\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:7</strong> (http_global) IIS unicode codepoint encoding\r
+<strong>binder.blocks</strong>: block bindings\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:8</strong> (http_global) multi_slash encoding\r
+<strong>binder.allows</strong>: allow bindings\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:9</strong> (http_global) IIS backslash evasion\r
+<strong>binder.inspects</strong>: inspect bindings\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_dns">dns</h3>\r
+<div class="paragraph"><p>What: dns inspection</p></div>\r
+<div class="paragraph"><p>Type: inspector</p></div>\r
+<div class="paragraph"><p>Rules:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>119:10</strong> (http_global) self directory traversal\r
+<strong>131:1</strong> (dns) Obsolete DNS RR Types\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:11</strong> (http_global) directory traversal\r
+<strong>131:2</strong> (dns) Experimental DNS RR Types\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:12</strong> (http_global) apache whitespace (tab)\r
+<strong>131:3</strong> (dns) DNS Client rdata txt Overflow\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>119:13</strong> (http_global) non-RFC http delimiter\r
+<strong>dns.packets</strong>: total packets\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_ftp_client">ftp_client</h3>\r
+<div class="paragraph"><p>What: FTP client configuration module for use with ftp_server</p></div>\r
+<div class="paragraph"><p>Type: inspector</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>119:14</strong> (http_global) non-RFC defined char\r
+bool <strong>ftp_client.bounce</strong> = false: check for bounces\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:15</strong> (http_global) oversize request-URI directory\r
+addr <strong>ftp_client.bounce_to[].address</strong> = 1.0.0.0/32: allowed ip address in CIDR format\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:16</strong> (http_global) oversize chunk encoding\r
+port <strong>ftp_client.bounce_to[].port</strong> = 20: allowed port { 1: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:17</strong> (http_global) unauthorized proxy use detected\r
+port <strong>ftp_client.bounce_to[].last_port</strong>: optional allowed range from port to last_port inclusive { 0: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:18</strong> (http_global) webroot directory traversal\r
+bool <strong>ftp_client.ignore_telnet_erase_cmds</strong> = false: ignore erase character and erase line commands when normalizing\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:19</strong> (http_global) long header\r
+int <strong>ftp_client.max_resp_len</strong> = -1: maximum ftp response accepted by client { -1: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:20</strong> (http_global) max header fields\r
+bool <strong>ftp_client.telnet_cmds</strong> = false: detect telnet escape sequences on ftp control channel\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_ftp_data">ftp_data</h3>\r
+<div class="paragraph"><p>What: FTP data channel handler</p></div>\r
+<div class="paragraph"><p>Type: inspector</p></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>119:21</strong> (http_global) multiple content length\r
+<strong>ftp_data.packets</strong>: total packets\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_ftp_server">ftp_server</h3>\r
+<div class="paragraph"><p>What: main FTP module; ftp_client should also be configured</p></div>\r
+<div class="paragraph"><p>Type: inspector</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>119:22</strong> (http_global) chunk size mismatch detected\r
+string <strong>ftp_server.chk_str_fmt</strong>: check the formatting of the given commands\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:23</strong> (http_global) invalid ip in true-client-IP/XFF header\r
+string <strong>ftp_server.data_chan_cmds</strong>: check the formatting of the given commands\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:24</strong> (http_global) multiple host hdrs detected\r
+string <strong>ftp_server.data_xfer_cmds</strong>: check the formatting of the given commands\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:25</strong> (http_global) hostname exceeds 255 characters\r
+string <strong>ftp_server.directory_cmds[].dir_cmd</strong>: directory command\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:26</strong> (http_global) header parsing space saturation\r
+int <strong>ftp_server.directory_cmds[].rsp_code</strong> = 200: expected successful response code for command { 200: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:27</strong> (http_global) client consecutive small chunk sizes\r
+string <strong>ftp_server.file_put_cmds</strong>: check the formatting of the given commands\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:28</strong> (http_global) post w/o content-length or chunks\r
+string <strong>ftp_server.file_get_cmds</strong>: check the formatting of the given commands\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:29</strong> (http_global) multiple true IPs in a session\r
+string <strong>ftp_server.encr_cmds</strong>: check the formatting of the given commands\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:30</strong> (http_global) both true-client-IP and XFF hdrs present\r
+string <strong>ftp_server.login_cmds</strong>: check the formatting of the given commands\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:31</strong> (http_global) unknown method\r
+bool <strong>ftp_server.check_encrypted</strong> = false: check for end of encryption\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:32</strong> (http_global) simple request\r
+string <strong>ftp_server.cmd_validity[].command</strong>: command string\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:33</strong> (http_global) unescaped space in http URI\r
+string <strong>ftp_server.cmd_validity[].format</strong>: format specification\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:34</strong> (http_global) too many pipelined requests\r
+int <strong>ftp_server.cmd_validity[].length</strong> = 0: specify non-default maximum for command { 0: }\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Peg counts:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>http_global.packets</strong>: total packets processed\r
+int <strong>ftp_server.def_max_param_len</strong> = 100: default maximum length of commands handled by server; 0 is unlimited { 1: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.gets</strong>: GET requests\r
+bool <strong>ftp_server.encrypted_traffic</strong> = false: check for encrypted telnet and ftp\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.posts</strong>: POST requests\r
+string <strong>ftp_server.ftp_cmds</strong>: specify additional commands supported by server beyond RFC 959\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.request headers</strong>: total requests\r
+bool <strong>ftp_server.ignore_data_chan</strong> = false: do not inspect ftp data channels\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.response headers</strong>: total responses\r
+bool <strong>ftp_server.ignore_telnet_erase_cmds</strong> = false: ignore erase character and erase line commands when normalizing\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.request cookies</strong>: requests with Cookie\r
+bool <strong>ftp_server.print_cmds</strong> = false: print command configurations on start up\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.response cookies</strong>: responses with Set-Cookie\r
+bool <strong>ftp_server.telnet_cmds</strong> = false: detect telnet escape sequences of ftp control channel\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Rules:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>http_global.post params</strong>: POST parameters extracted\r
+<strong>125:1</strong> (ftp_server) TELNET cmd on FTP command channel\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.unicode</strong>: unicode normalizations\r
+<strong>125:2</strong> (ftp_server) invalid FTP command\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.double unicode</strong>: double unicode normalizations\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>http_global.non-ascii</strong>: non-ascii normalizations\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>http_global.paths with ../</strong>: directory traversal normalizations\r
+<strong>125:3</strong> (ftp_server) FTP command parameters were too long\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.paths with //</strong>: double slash normalizations\r
+<strong>125:4</strong> (ftp_server) FTP command parameters were malformed\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.paths with ./</strong>: relative directory normalizations\r
+<strong>125:5</strong> (ftp_server) FTP command parameters contained potential string format\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.gzip packets</strong>: packets with gzip compression\r
+<strong>125:6</strong> (ftp_server) FTP response message was too long\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.compressed bytes</strong>: total comparessed bytes processed\r
+<strong>125:7</strong> (ftp_server) FTP traffic encrypted\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.decompressed bytes</strong>: total bytes decompressed\r
+<strong>125:8</strong> (ftp_server) FTP bounce attempt\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_port_scan_global">port_scan_global</h3>\r
-<div class="paragraph"><p>What: shared settings for port_scan inspectors for use with port_scan</p></div>\r
-<div class="paragraph"><p>Type: data</p></div>\r
-<div class="paragraph"><p>Configuration:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-int <strong>port_scan_global.memcap</strong> = 1048576: maximum tracker memory { 1: }\r
+<strong>125:9</strong> (ftp_server) evasive (incomplete) TELNET cmd on FTP command channel\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>port_scan_global.packets</strong>: total packets\r
+<strong>ftp_server.packets</strong>: total packets\r
</p>\r
</li>\r
</ul></div>\r
</div>\r
-</div>\r
-</div>\r
-<div class="sect1">\r
-<h2 id="_inspector_modules">Inspector Modules</h2>\r
-<div class="sectionbody">\r
-<div class="paragraph"><p>These modules perform a variety of functions, including analysis of\r
-protocols beyond basic decoding.</p></div>\r
<div class="sect2">\r
-<h3 id="_arp_spoof">arp_spoof</h3>\r
-<div class="paragraph"><p>What: detect ARP attacks and anomalies</p></div>\r
+<h3 id="_http_global">http_global</h3>\r
+<div class="paragraph"><p>What: http inspector global configuration and client rules for use with http_server</p></div>\r
<div class="paragraph"><p>Type: inspector</p></div>\r
<div class="paragraph"><p>Configuration:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-ip4 <strong>arp_spoof.hosts[].ip</strong>: host ip address\r
+int <strong>http_global.compress_depth</strong> = 65535: maximum amount of packet payload to decompress { 1:65535 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-mac <strong>arp_spoof.hosts[].mac</strong>: host mac address\r
+int <strong>http_global.decode.b64_decode_depth</strong> = 0: single packet decode depth { -1:65535 }\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Rules:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>112:1</strong> (arp_spoof) unicast ARP request\r
+int <strong>http_global.decode.bitenc_decode_depth</strong> = 0: single packet decode depth { -1:65535 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>112:2</strong> (arp_spoof) ethernet/ARP mismatch request for source\r
+int <strong>http_global.decode.max_mime_mem</strong> = 838860: single packet decode depth { 3276: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>112:3</strong> (arp_spoof) ethernet/ARP mismatch request for destination\r
+int <strong>http_global.decode.qp_decode_depth</strong> = 0: single packet decode depth { -1:65535 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>112:4</strong> (arp_spoof) attempted ARP cache overwrite attack\r
+int <strong>http_global.decode.uu_decode_depth</strong> = 0: single packet decode depth { -1:65535 }\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Peg counts:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>arp_spoof.packets</strong>: total packets\r
+int <strong>http_global.decompress_depth</strong> = 65535: maximum amount of decompressed data to process { 1:65535 }\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_back_orifice">back_orifice</h3>\r
-<div class="paragraph"><p>What: back orifice detection</p></div>\r
-<div class="paragraph"><p>Type: inspector</p></div>\r
-<div class="paragraph"><p>Rules:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>105:1</strong> (back_orifice) BO traffic detected\r
+bool <strong>http_global.detect_anomalous_servers</strong> = false: inspect non-configured ports for HTTP - bad idea\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>105:2</strong> (back_orifice) BO client traffic detected\r
+int <strong>http_global.max_gzip_mem</strong> = 838860: total memory used for decompression across all active sessions { 3276: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>105:3</strong> (back_orifice) BO server traffic detected\r
+int <strong>http_global.memcap</strong> = 150994944: limit of memory used for logging extra data { 2304: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>105:4</strong> (back_orifice) BO Snort buffer attack\r
+bool <strong>http_global.proxy_alert</strong> = false: alert on proxy usage for servers without allow_proxy_use\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Peg counts:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>back_orifice.packets</strong>: total packets\r
+int <strong>http_global.unicode_map.code_page</strong> = 1252: select code page in map file { 0: }\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_binder">binder</h3>\r
-<div class="paragraph"><p>What: configure processing based on CIDRs, ports, services, etc.</p></div>\r
-<div class="paragraph"><p>Type: inspector</p></div>\r
-<div class="paragraph"><p>Configuration:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-int <strong>binder[].when.policy_id</strong> = 0: unique ID for selection of this config by external logic { 0: }\r
+string <strong>http_global.unicode_map.map_file</strong>: unicode map file\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Rules:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-bit_list <strong>binder[].when.ifaces</strong>: list of interface indices { 255 }\r
+<strong>119:1</strong> (http_global) ascii encoding\r
</p>\r
</li>\r
<li>\r
<p>\r
-bit_list <strong>binder[].when.vlans</strong>: list of VLAN IDs { 4095 }\r
+<strong>119:2</strong> (http_global) double decoding attack\r
</p>\r
</li>\r
<li>\r
<p>\r
-addr_list <strong>binder[].when.nets</strong>: list of networks\r
+<strong>119:3</strong> (http_global) u encoding\r
</p>\r
</li>\r
<li>\r
<p>\r
-enum <strong>binder[].when.proto</strong>: protocol { any | ip | icmp | tcp | udp }\r
+<strong>119:4</strong> (http_global) bare byte unicode encoding\r
</p>\r
</li>\r
<li>\r
<p>\r
-bit_list <strong>binder[].when.ports</strong>: list of ports { 65535 }\r
+<strong>119:5</strong> (http_global) base36 encoding\r
</p>\r
</li>\r
<li>\r
<p>\r
-enum <strong>binder[].when.role</strong> = any: use the given configuration on one or any end of a session { client | server | any }\r
+<strong>119:6</strong> (http_global) UTF-8 encoding\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>binder[].when.service</strong>: override default configuration\r
+<strong>119:7</strong> (http_global) IIS unicode codepoint encoding\r
</p>\r
</li>\r
<li>\r
<p>\r
-enum <strong>binder[].use.action</strong> = inspect: what to do with matching traffic { block | allow | inspect }\r
+<strong>119:8</strong> (http_global) multi_slash encoding\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>binder[].use.file</strong>: use configuration in given file\r
+<strong>119:9</strong> (http_global) IIS backslash evasion\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>binder[].use.service</strong>: override automatic service identification\r
+<strong>119:10</strong> (http_global) self directory traversal\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>binder[].use.type</strong>: select module for binding\r
+<strong>119:11</strong> (http_global) directory traversal\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>binder[].use.name</strong>: symbol name (defaults to type)\r
+<strong>119:12</strong> (http_global) apache whitespace (tab)\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Peg counts:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>binder.packets</strong>: initial bindings\r
+<strong>119:13</strong> (http_global) non-RFC http delimiter\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>binder.blocks</strong>: block bindings\r
+<strong>119:14</strong> (http_global) non-RFC defined char\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>binder.allows</strong>: allow bindings\r
+<strong>119:15</strong> (http_global) oversize request-URI directory\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>binder.inspects</strong>: inspect bindings\r
+<strong>119:16</strong> (http_global) oversize chunk encoding\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_dns">dns</h3>\r
-<div class="paragraph"><p>What: dns inspection</p></div>\r
-<div class="paragraph"><p>Type: inspector</p></div>\r
-<div class="paragraph"><p>Rules:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>131:1</strong> (dns) Obsolete DNS RR Types\r
+<strong>119:17</strong> (http_global) unauthorized proxy use detected\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>131:2</strong> (dns) Experimental DNS RR Types\r
+<strong>119:18</strong> (http_global) webroot directory traversal\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>131:3</strong> (dns) DNS Client rdata txt Overflow\r
+<strong>119:19</strong> (http_global) long header\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Peg counts:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>dns.packets</strong>: total packets\r
+<strong>119:20</strong> (http_global) max header fields\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_ftp_data">ftp_data</h3>\r
-<div class="paragraph"><p>What: FTP data channel handler</p></div>\r
-<div class="paragraph"><p>Type: inspector</p></div>\r
-<div class="paragraph"><p>Peg counts:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>ftp_data.packets</strong>: total packets\r
+<strong>119:21</strong> (http_global) multiple content length\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_ftp_server">ftp_server</h3>\r
-<div class="paragraph"><p>What: main FTP module; ftp_client should also be configured</p></div>\r
-<div class="paragraph"><p>Type: inspector</p></div>\r
-<div class="paragraph"><p>Configuration:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-string <strong>ftp_server.chk_str_fmt</strong>: check the formatting of the given commands\r
+<strong>119:22</strong> (http_global) chunk size mismatch detected\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>ftp_server.data_chan_cmds</strong>: check the formatting of the given commands\r
+<strong>119:23</strong> (http_global) invalid ip in true-client-IP/XFF header\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>ftp_server.data_xfer_cmds</strong>: check the formatting of the given commands\r
+<strong>119:24</strong> (http_global) multiple host hdrs detected\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>ftp_server.directory_cmds[].dir_cmd</strong>: directory command\r
+<strong>119:25</strong> (http_global) hostname exceeds 255 characters\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>ftp_server.directory_cmds[].rsp_code</strong> = 200: expected successful response code for command { 200: }\r
+<strong>119:26</strong> (http_global) header parsing space saturation\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>ftp_server.file_put_cmds</strong>: check the formatting of the given commands\r
+<strong>119:27</strong> (http_global) client consecutive small chunk sizes\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>ftp_server.file_get_cmds</strong>: check the formatting of the given commands\r
+<strong>119:28</strong> (http_global) post w/o content-length or chunks\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>ftp_server.encr_cmds</strong>: check the formatting of the given commands\r
+<strong>119:29</strong> (http_global) multiple true IPs in a session\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>ftp_server.login_cmds</strong>: check the formatting of the given commands\r
+<strong>119:30</strong> (http_global) both true-client-IP and XFF hdrs present\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>ftp_server.check_encrypted</strong> = false: check for end of encryption\r
+<strong>119:31</strong> (http_global) unknown method\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>ftp_server.cmd_validity[].command</strong>: command string\r
+<strong>119:32</strong> (http_global) simple request\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>ftp_server.cmd_validity[].format</strong>: format specification\r
+<strong>119:33</strong> (http_global) unescaped space in http URI\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>ftp_server.cmd_validity[].length</strong> = 0: specify non-default maximum for command { 0: }\r
+<strong>119:34</strong> (http_global) too many pipelined requests\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-int <strong>ftp_server.def_max_param_len</strong> = 100: default maximum length of commands handled by server; 0 is unlimited { 1: }\r
+<strong>http_global.packets</strong>: total packets processed\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>ftp_server.encrypted_traffic</strong> = false: check for encrypted telnet and ftp\r
+<strong>http_global.gets</strong>: GET requests\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>ftp_server.ftp_cmds</strong>: specify additional commands supported by server beyond RFC 959\r
+<strong>http_global.posts</strong>: POST requests\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>ftp_server.ignore_data_chan</strong> = false: do not inspect ftp data channels\r
+<strong>http_global.request headers</strong>: total requests\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>ftp_server.ignore_telnet_erase_cmds</strong> = false: ignore erase character and erase line commands when normalizing\r
+<strong>http_global.response headers</strong>: total responses\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>ftp_server.print_cmds</strong> = false: print command configurations on start up\r
+<strong>http_global.request cookies</strong>: requests with Cookie\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>ftp_server.telnet_cmds</strong> = false: detect telnet escape sequences of ftp control channel\r
+<strong>http_global.response cookies</strong>: responses with Set-Cookie\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Rules:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>125:1</strong> (ftp_server) TELNET cmd on FTP command channel\r
+<strong>http_global.post params</strong>: POST parameters extracted\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>125:2</strong> (ftp_server) invalid FTP command\r
+<strong>http_global.unicode</strong>: unicode normalizations\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>125:3</strong> (ftp_server) FTP command parameters were too long\r
+<strong>http_global.double unicode</strong>: double unicode normalizations\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>125:4</strong> (ftp_server) FTP command parameters were malformed\r
+<strong>http_global.non-ascii</strong>: non-ascii normalizations\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>125:5</strong> (ftp_server) FTP command parameters contained potential string format\r
+<strong>http_global.paths with ../</strong>: directory traversal normalizations\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>125:6</strong> (ftp_server) FTP response message was too long\r
+<strong>http_global.paths with //</strong>: double slash normalizations\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>125:7</strong> (ftp_server) FTP traffic encrypted\r
+<strong>http_global.paths with ./</strong>: relative directory normalizations\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>125:8</strong> (ftp_server) FTP bounce attempt\r
+<strong>http_global.gzip packets</strong>: packets with gzip compression\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>125:9</strong> (ftp_server) evasive (incomplete) TELNET cmd on FTP command channel\r
+<strong>http_global.compressed bytes</strong>: total comparessed bytes processed\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Peg counts:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>ftp_server.packets</strong>: total packets\r
+<strong>http_global.decompressed bytes</strong>: total bytes decompressed\r
</p>\r
</li>\r
</ul></div>\r
</li>\r
<li>\r
<p>\r
-bool <strong>http_inspect.decompress_pdf</strong> = false: ????\r
+bool <strong>http_inspect.decompress_pdf</strong> = false: enable decompression of the compressed portions of PDF files\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>http_inspect.decompress_swf</strong> = false: ????\r
+bool <strong>http_inspect.decompress_swf</strong> = false: enable decompression of SWF (Adobe Flash content)\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-bool <strong>http_inspect.xff_headers</strong> = false: ????\r
+bool <strong>http_inspect.xff_headers</strong> = false: not implemented\r
</p>\r
</li>\r
</ul></div>\r
</li>\r
<li>\r
<p>\r
-<strong>120:8</strong> (http_inspect) invalid content-length or chunk size\r
+<strong>120:8</strong> (http_inspect) invalid content-length or chunk size\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>120:9</strong> (http_inspect) javascript obfuscation levels exceeds 1\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>120:10</strong> (http_inspect) javascript whitespaces exceeds max allowed\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>120:11</strong> (http_inspect) multiple encodings within javascript obfuscated data\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>120:12</strong> (http_inspect) HTTP response SWF file zlib decompression failure\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>120:13</strong> (http_inspect) HTTP response SWF file LZMA decompression failure\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>120:14</strong> (http_inspect) HTTP response PDF file deflate decompression failure\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>120:15</strong> (http_inspect) HTTP response PDF file unsupported compression type\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>120:16</strong> (http_inspect) HTTP response PDF file cascaded compression\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>120:17</strong> (http_inspect) HTTP response PDF file parse failure\r
+</p>\r
+</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_imap">imap</h3>\r
+<div class="paragraph"><p>What: imap inspection</p></div>\r
+<div class="paragraph"><p>Type: inspector</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+int <strong>imap.b64_decode_depth</strong> = 1460: base64 decoding depth { -1:65535 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>120:9</strong> (http_inspect) javascript obfuscation levels exceeds 1\r
+int <strong>imap.bitenc_decode_depth</strong> = 1460: Non-Encoded MIME attachment extraction depth { -1:65535 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>120:10</strong> (http_inspect) javascript whitespaces exceeds max allowed\r
+int <strong>imap.qp_decode_depth</strong> = 1460: Quoted Printable decoding depth { -1:65535 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>120:11</strong> (http_inspect) multiple encodings within javascript obfuscated data\r
+int <strong>imap.uu_decode_depth</strong> = 1460: Unix-to-Unix decoding depth { -1:65535 }\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Rules:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>120:12</strong> (http_inspect) HTTP response SWF file zlib decompression failure\r
+<strong>141:1</strong> (imap) Unknown IMAP3 command\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>120:13</strong> (http_inspect) HTTP response SWF file LZMA decompression failure\r
+<strong>141:2</strong> (imap) Unknown IMAP3 response\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>120:14</strong> (http_inspect) HTTP response PDF file deflate decompression failure\r
+<strong>141:4</strong> (imap) Base64 Decoding failed.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>120:15</strong> (http_inspect) HTTP response PDF file unsupported compression type\r
+<strong>141:5</strong> (imap) Quoted-Printable Decoding failed.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>120:16</strong> (http_inspect) HTTP response PDF file cascaded compression\r
+<strong>141:7</strong> (imap) Unix-to-Unix Decoding failed.\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>120:17</strong> (http_inspect) HTTP response PDF file parse failure\r
+<strong>imap.packets</strong>: total packets\r
</p>\r
</li>\r
</ul></div>\r
<strong>219:51</strong> (new_http_inspect) PDF file parse failure\r
</p>\r
</li>\r
+<li>\r
+<p>\r
+<strong>219:52</strong> (new_http_inspect) HTTP misformatted or not really HTTP\r
+</p>\r
+</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
</ul></div>\r
</div>\r
<div class="sect2">\r
+<h3 id="_pop">pop</h3>\r
+<div class="paragraph"><p>What: pop inspection</p></div>\r
+<div class="paragraph"><p>Type: inspector</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+int <strong>pop.b64_decode_depth</strong> = 1460: base64 decoding depth { -1:65535 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>pop.bitenc_decode_depth</strong> = 1460: Non-Encoded MIME attachment extraction depth { -1:65535 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>pop.qp_decode_depth</strong> = 1460: Quoted Printable decoding depth { -1:65535 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>pop.uu_decode_depth</strong> = 1460: Unix-to-Unix decoding depth { -1:65535 }\r
+</p>\r
+</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Rules:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<strong>142:1</strong> (pop) Unknown POP3 command\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>142:2</strong> (pop) Unknown POP3 response\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>142:4</strong> (pop) Base64 Decoding failed.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>142:5</strong> (pop) Quoted-Printable Decoding failed.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>142:7</strong> (pop) Unix-to-Unix Decoding failed.\r
+</p>\r
+</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<strong>pop.packets</strong>: total packets\r
+</p>\r
+</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
<h3 id="_port_scan">port_scan</h3>\r
<div class="paragraph"><p>What: port scan inspector; also configure port_scan_global</p></div>\r
<div class="paragraph"><p>Type: inspector</p></div>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
+<h3 id="_port_scan_global">port_scan_global</h3>\r
+<div class="paragraph"><p>What: shared settings for port_scan inspectors for use with port_scan</p></div>\r
+<div class="paragraph"><p>Type: inspector</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+int <strong>port_scan_global.memcap</strong> = 1048576: maximum tracker memory { 1: }\r
+</p>\r
+</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<strong>port_scan_global.packets</strong>: total packets\r
+</p>\r
+</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
<h3 id="_rpc_decode">rpc_decode</h3>\r
<div class="paragraph"><p>What: RPC inspector</p></div>\r
<div class="paragraph"><p>Type: inspector</p></div>\r
</li>\r
<li>\r
<p>\r
-string <strong>daq.var</strong>: list of name=value DAQ-specific parameters\r
+string <strong>daq.vars</strong>: comma separated list of name=value DAQ-specific parameters\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
+string <strong>file_id.file_rules[].category</strong>: file type category\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>file_id.file_rules[].id</strong> = 0: file type id { 0: }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+string <strong>file_id.file_rules[].magic[].content</strong>: file magic content\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>file_id.file_rules[].magic[].offset</strong> = 0: file magic offset { 0: }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+string <strong>file_id.file_rules[].msg</strong>: information about the file type\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>file_id.file_rules[].rev</strong> = 0: rule revision { 0: }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+string <strong>file_id.file_rules[].type</strong>: file type name\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+string <strong>file_id.file_rules[].version</strong>: file type version\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
int <strong>file_id.lookup_timeout</strong> = 2: give up on lookup after this many seconds { 0: }\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-bool <strong>http_inspect.decompress_pdf</strong> = false: ????\r
+bool <strong>http_inspect.decompress_pdf</strong> = false: enable decompression of the compressed portions of PDF files\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>http_inspect.decompress_swf</strong> = false: ????\r
+bool <strong>http_inspect.decompress_swf</strong> = false: enable decompression of SWF (Adobe Flash content)\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-bool <strong>http_inspect.xff_headers</strong> = false: ????\r
+bool <strong>http_inspect.xff_headers</strong> = false: not implemented\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
+int <strong>imap.b64_decode_depth</strong> = 1460: base64 decoding depth { -1:65535 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>imap.bitenc_decode_depth</strong> = 1460: Non-Encoded MIME attachment extraction depth { -1:65535 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>imap.qp_decode_depth</strong> = 1460: Quoted Printable decoding depth { -1:65535 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>imap.uu_decode_depth</strong> = 1460: Unix-to-Unix decoding depth { -1:65535 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
string <strong>ip_proto.~proto</strong>: [!|>|<] name or number\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-string <strong>output.event_trace.file</strong>: where to write event trace logs\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
int <strong>output.event_trace.max_data</strong> = 0: maximum amount of packet data to capture { 0:65535 }\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+int <strong>pop.b64_decode_depth</strong> = 1460: base64 decoding depth { -1:65535 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>pop.bitenc_decode_depth</strong> = 1460: Non-Encoded MIME attachment extraction depth { -1:65535 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>pop.qp_decode_depth</strong> = 1460: Quoted Printable decoding depth { -1:65535 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>pop.uu_decode_depth</strong> = 1460: Unix-to-Unix decoding depth { -1:65535 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
string <strong>port_scan.ignore_scanned</strong>: list of CIDRs with optional ports to ignore if the destination of scan alerts\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>imap.packets</strong>: total packets\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>ipv4.bad checksum</strong>: nonzero ip checksums\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>pop.packets</strong>: total packets\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>port_scan_global.packets</strong>: total packets\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>141</strong>: imap\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>142</strong>: pop\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>219</strong>: new_http_inspect\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>141:1</strong> (imap) Unknown IMAP3 command\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>141:2</strong> (imap) Unknown IMAP3 response\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>141:4</strong> (imap) Base64 Decoding failed.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>141:5</strong> (imap) Quoted-Printable Decoding failed.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>141:7</strong> (imap) Unix-to-Unix Decoding failed.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>142:1</strong> (pop) Unknown POP3 command\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>142:2</strong> (pop) Unknown POP3 response\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>142:4</strong> (pop) Base64 Decoding failed.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>142:5</strong> (pop) Quoted-Printable Decoding failed.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>142:7</strong> (pop) Unix-to-Unix Decoding failed.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>219:1</strong> (new_http_inspect) ascii encoding\r
</p>\r
</li>\r
<strong>219:51</strong> (new_http_inspect) PDF file parse failure\r
</p>\r
</li>\r
+<li>\r
+<p>\r
+<strong>219:52</strong> (new_http_inspect) HTTP misformatted or not really HTTP\r
+</p>\r
+</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
</li>\r
<li>\r
<p>\r
-<strong>ftp_client</strong> (data): FTP client configuration module for use with ftp_server\r
+<strong>ftp_client</strong> (inspector): FTP client configuration module for use with ftp_server\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global</strong> (data): http inspector global configuration and client rules for use with http_server\r
+<strong>http_global</strong> (inspector): http inspector global configuration and client rules for use with http_server\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
+<strong>imap</strong> (inspector): imap inspection\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>ip_proto</strong> (ips_option): rule option to check the IP protocol number\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>pop</strong> (inspector): pop inspection\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>port_scan</strong> (inspector): port scan inspector; also configure port_scan_global\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>port_scan_global</strong> (data): shared settings for port_scan inspectors for use with port_scan\r
+<strong>port_scan_global</strong> (inspector): shared settings for port_scan inspectors for use with port_scan\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>codec::ppp</strong>: support for point-to-point encapsulation (DLT 9)\r
+<strong>codec::ppp</strong>: support for point-to-point encapsulation (DLT DLT_PPP)\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>data::ftp_client</strong>: FTP inspector client module\r
+<strong>inspector::arp_spoof</strong>: detect ARP attacks and anomalies\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>data::http_global</strong>: shared HTTP inspector settings\r
+<strong>inspector::back_orifice</strong>: back orifice detection\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>data::port_scan_global</strong>: shared settings for port_scan inspectors for use with port_scan\r
+<strong>inspector::binder</strong>: configure processing based on CIDRs, ports, services, etc.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>inspector::arp_spoof</strong>: detect ARP attacks and anomalies\r
+<strong>inspector::dns</strong>: dns inspection\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>inspector::back_orifice</strong>: back orifice detection\r
+<strong>inspector::ftp_client</strong>: FTP inspector client module\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>inspector::binder</strong>: configure processing based on CIDRs, ports, services, etc.\r
+<strong>inspector::ftp_data</strong>: FTP data channel handler\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>inspector::dns</strong>: dns inspection\r
+<strong>inspector::ftp_server</strong>: FTP inspector server module\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>inspector::ftp_data</strong>: FTP data channel handler\r
+<strong>inspector::http_global</strong>: shared HTTP inspector settings\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>inspector::ftp_server</strong>: FTP inspector server module\r
+<strong>inspector::http_inspect</strong>: main HTTP inspector module\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>inspector::http_inspect</strong>: main HTTP inspector module\r
+<strong>inspector::imap</strong>: imap inspection\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
+<strong>inspector::pop</strong>: pop inspection\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>inspector::port_scan</strong>: port scan inspector; also configure port_scan_global\r
</p>\r
</li>\r
<li>\r
<p>\r
+<strong>inspector::port_scan_global</strong>: shared settings for port_scan inspectors for use with port_scan\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>inspector::rpc_decode</strong>: RPC inspector\r
</p>\r
</li>\r
<div id="footnotes"><hr /></div>\r
<div id="footer">\r
<div id="footer-text">\r
-Last updated 2015-03-30 16:54:22 EDT\r
+Last updated 2015-04-29 17:19:10 EDT\r
</div>\r
</div>\r
</body>\r
1.3. Plugins and Scripts
1.4. New Http Inspector
1.5. Binder and Wizard
+ 1.6. Packet Processing
2. Getting Started
4.22. wlan
5. Data Modules
-
- 5.1. ftp_client
- 5.2. http_global
- 5.3. port_scan_global
-
6. Inspector Modules
6.1. arp_spoof
6.2. back_orifice
6.3. binder
6.4. dns
- 6.5. ftp_data
- 6.6. ftp_server
- 6.7. http_inspect
- 6.8. new_http_inspect
- 6.9. normalizer
- 6.10. perf_monitor
- 6.11. port_scan
- 6.12. rpc_decode
- 6.13. ssh
- 6.14. stream
- 6.15. stream_icmp
- 6.16. stream_ip
- 6.17. stream_tcp
- 6.18. stream_udp
- 6.19. telnet
- 6.20. wizard
+ 6.5. ftp_client
+ 6.6. ftp_data
+ 6.7. ftp_server
+ 6.8. http_global
+ 6.9. http_inspect
+ 6.10. imap
+ 6.11. new_http_inspect
+ 6.12. normalizer
+ 6.13. perf_monitor
+ 6.14. pop
+ 6.15. port_scan
+ 6.16. port_scan_global
+ 6.17. rpc_decode
+ 6.18. ssh
+ 6.19. stream
+ 6.20. stream_icmp
+ 6.21. stream_ip
+ 6.22. stream_tcp
+ 6.23. stream_udp
+ 6.24. telnet
+ 6.25. wizard
7. IPS Action Modules
Snorty
,,_ -*> Snort++ <*-
-o" )~ Version 3.0.0-a1 (Build 145) from 2.9.6-9
+o" )~ Version 3.0.0-a1 (Build 150) from 2.9.7-177
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved.
--help-module binder, etc.
+1.6. Packet Processing
+
+------------
+
+One of the goals of Snort++ is to provide a more flexible framework
+for packet processing by implementing an event-driven approach.
+Another is to produce data only when needed, to minimize expensive
+normalizations. To help explain these concepts, let’s start by
+examining how Snort processes packets. The key steps are given in the
+following figure:
+
+Snort 2X
+
+The preprocess step is highly configurable. Arbitrary preprocessors
+can be loaded dynamically at startup, configured in snort.conf, and
+then executed at runtime. Basically, the preprocessors are put into a
+list which is iterated for each packet. Recent versions have tweaked
+the list handling some, but the same basic architecture has allowed
+Snort to grow from a sniffer, with no preprocessing, to a
+full-fledged IPS, with lots of preprocessing.
+
+While this "list of plugins" approach has considerable flexibility,
+it hampers future development when the flow of data from one
+preprocessor to the next depends on traffic conditions, a common
+situation with advanced features like application identification. In
+this case, a preprocessor like HTTP may be extracting and normalizing
+data that ultimately is not used, or app ID may be repeatedly
+checking for data that is just not available.
+
+Callbacks help break out of the preprocess straightjacket. This is
+where one preprocessor supplies another with a function to call when
+certain data is available. Snort has started to take this approach to
+pass some HTTP and SIP preprocessor data to app ID. However, it
+remains a peripheral feature and still requires the production of
+data that may not be consumed.
+
+The basic processing steps Snort takes are similar to Snort’s as seen
+in the following diagram. The preprocess step employs specific
+inspector types instead of a generalized list, but the basic
+procedure includes stateless packet decoding, TCP stream reassembly,
+and service specific analysis in both cases. (Snort provides hooks
+for arbitrary inspectors, but they are not central to basic flow
+processing and are not shown.)
+
+Snort 3X
+
+However, Snort++ also provides a more flexible mechanism than
+callback functions. By using inspection events, it is possible for an
+inspector to supply data that other inspectors can process. This is
+known as the observer pattern or publish-subscribe pattern.
+
+Note that the data is not actually published. Instead, access to the
+data is published, and that means that subscribers can access the raw
+or normalized version(s) as needed. Normalizations are done only on
+the first access, and subsequent accesses get the previously
+normalized data. This results in just in time (JIT) processing.
+
+A basic example of this in action is provided by the extra data_log
+plugin. It is a passive inspector, ie it does nothing until it
+receives the data it subscribed for (other in the above diagram). By
+adding data_log = { key = http_raw_uri } to your snort.lua
+configuration, you will get a simple URI logger.
+
+Inspection events coupled with pluggable inspectors provide a very
+flexible framework for implementing new features. And JIT buffer
+stuffers allow Snort to work smarter, not harder. These capabilities
+will be leveraged more and more as Snort development continues.
+
+
---------------------------------------------------------------------
2. Getting Started
HTML manual
* dblatex from http://dblatex.sourceforge.net to build the pdf
manual (in addition to asciidoc)
+ * w3m from http://sourceforge.net/projects/w3m/ to build the plain
+ text manual
* check from http://check.sourceforge.net to build unit tests
* bool daq.no_promisc = false: whether to put DAQ device into
promiscuous mode
* string daq.type: select type of DAQ
- * string daq.var: list of name=value DAQ-specific parameters
+ * string daq.vars: comma separated list of name=value DAQ-specific
+ parameters
* int daq.snaplen = deflt: set snap length (same as -P) { 0:65535 }
* bool daq.decode_data_link = false: display the second layer
header info
* bool file_id.enable_signature = false: enable signature
calculation
* int file_id.show_data_depth = 100: print this many octets { 0: }
+ * int file_id.file_rules[].rev = 0: rule revision { 0: }
+ * string file_id.file_rules[].msg: information about the file type
+ * string file_id.file_rules[].type: file type name
+ * int file_id.file_rules[].id = 0: file type id { 0: }
+ * string file_id.file_rules[].category: file type category
+ * string file_id.file_rules[].version: file type version
+ * string file_id.file_rules[].magic[].content: file magic content
+ * int file_id.file_rules[].magic[].offset = 0: file magic offset {
+ 0: }
3.11. hosts
starting at link layer (same as -X)
* bool output.log_ipv6_extra_data = false: log IPv6 source and
destination addresses as unified2 extra data records
- * string output.event_trace.file: where to write event trace logs
* int output.event_trace.max_data = 0: maximum amount of packet
data to capture { 0:65535 }
* bool output.quiet = false: suppress non-fatal information (still
Data modules are adjunct configurations for use with certain
inspectors.
-
-5.1. ftp_client
-
-------------
-
-What: FTP client configuration module for use with ftp_server
-
-Type: data
-
-Configuration:
-
- * bool ftp_client.bounce = false: check for bounces
- * addr ftp_client.bounce_to[].address = 1.0.0.0/32: allowed ip
- address in CIDR format
- * port ftp_client.bounce_to[].port = 20: allowed port { 1: }
- * port ftp_client.bounce_to[].last_port: optional allowed range
- from port to last_port inclusive { 0: }
- * bool ftp_client.ignore_telnet_erase_cmds = false: ignore erase
- character and erase line commands when normalizing
- * int ftp_client.max_resp_len = -1: maximum ftp response accepted
- by client { -1: }
- * bool ftp_client.telnet_cmds = false: detect telnet escape
- sequences on ftp control channel
-
-
-5.2. http_global
-
-------------
-
-What: http inspector global configuration and client rules for use
-with http_server
-
-Type: data
-
-Configuration:
-
- * int http_global.compress_depth = 65535: maximum amount of packet
- payload to decompress { 1:65535 }
- * int http_global.decode.b64_decode_depth = 0: single packet decode
- depth { -1:65535 }
- * int http_global.decode.bitenc_decode_depth = 0: single packet
- decode depth { -1:65535 }
- * int http_global.decode.max_mime_mem = 838860: single packet
- decode depth { 3276: }
- * int http_global.decode.qp_decode_depth = 0: single packet decode
- depth { -1:65535 }
- * int http_global.decode.uu_decode_depth = 0: single packet decode
- depth { -1:65535 }
- * int http_global.decompress_depth = 65535: maximum amount of
- decompressed data to process { 1:65535 }
- * bool http_global.detect_anomalous_servers = false: inspect
- non-configured ports for HTTP - bad idea
- * int http_global.max_gzip_mem = 838860: total memory used for
- decompression across all active sessions { 3276: }
- * int http_global.memcap = 150994944: limit of memory used for
- logging extra data { 2304: }
- * bool http_global.proxy_alert = false: alert on proxy usage for
- servers without allow_proxy_use
- * int http_global.unicode_map.code_page = 1252: select code page in
- map file { 0: }
- * string http_global.unicode_map.map_file: unicode map file
-
-Rules:
-
- * 119:1 (http_global) ascii encoding
- * 119:2 (http_global) double decoding attack
- * 119:3 (http_global) u encoding
- * 119:4 (http_global) bare byte unicode encoding
- * 119:5 (http_global) base36 encoding
- * 119:6 (http_global) UTF-8 encoding
- * 119:7 (http_global) IIS unicode codepoint encoding
- * 119:8 (http_global) multi_slash encoding
- * 119:9 (http_global) IIS backslash evasion
- * 119:10 (http_global) self directory traversal
- * 119:11 (http_global) directory traversal
- * 119:12 (http_global) apache whitespace (tab)
- * 119:13 (http_global) non-RFC http delimiter
- * 119:14 (http_global) non-RFC defined char
- * 119:15 (http_global) oversize request-URI directory
- * 119:16 (http_global) oversize chunk encoding
- * 119:17 (http_global) unauthorized proxy use detected
- * 119:18 (http_global) webroot directory traversal
- * 119:19 (http_global) long header
- * 119:20 (http_global) max header fields
- * 119:21 (http_global) multiple content length
- * 119:22 (http_global) chunk size mismatch detected
- * 119:23 (http_global) invalid ip in true-client-IP/XFF header
- * 119:24 (http_global) multiple host hdrs detected
- * 119:25 (http_global) hostname exceeds 255 characters
- * 119:26 (http_global) header parsing space saturation
- * 119:27 (http_global) client consecutive small chunk sizes
- * 119:28 (http_global) post w/o content-length or chunks
- * 119:29 (http_global) multiple true IPs in a session
- * 119:30 (http_global) both true-client-IP and XFF hdrs present
- * 119:31 (http_global) unknown method
- * 119:32 (http_global) simple request
- * 119:33 (http_global) unescaped space in http URI
- * 119:34 (http_global) too many pipelined requests
-
-Peg counts:
-
- * http_global.packets: total packets processed
- * http_global.gets: GET requests
- * http_global.posts: POST requests
- * http_global.request headers: total requests
- * http_global.response headers: total responses
- * http_global.request cookies: requests with Cookie
- * http_global.response cookies: responses with Set-Cookie
- * http_global.post params: POST parameters extracted
- * http_global.unicode: unicode normalizations
- * http_global.double unicode: double unicode normalizations
- * http_global.non-ascii: non-ascii normalizations
- * http_global.paths with ../: directory traversal normalizations
- * http_global.paths with //: double slash normalizations
- * http_global.paths with ./: relative directory normalizations
- * http_global.gzip packets: packets with gzip compression
- * http_global.compressed bytes: total comparessed bytes processed
- * http_global.decompressed bytes: total bytes decompressed
-
-
-5.3. port_scan_global
-
-------------
-
-What: shared settings for port_scan inspectors for use with port_scan
-
-Type: data
-
-Configuration:
-
- * int port_scan_global.memcap = 1048576: maximum tracker memory {
- 1: }
-
-Peg counts:
-
- * port_scan_global.packets: total packets
+no match no match
---------------------------------------------------------------------
* dns.packets: total packets
-6.5. ftp_data
+6.5. ftp_client
+
+------------
+
+What: FTP client configuration module for use with ftp_server
+
+Type: inspector
+
+Configuration:
+
+ * bool ftp_client.bounce = false: check for bounces
+ * addr ftp_client.bounce_to[].address = 1.0.0.0/32: allowed ip
+ address in CIDR format
+ * port ftp_client.bounce_to[].port = 20: allowed port { 1: }
+ * port ftp_client.bounce_to[].last_port: optional allowed range
+ from port to last_port inclusive { 0: }
+ * bool ftp_client.ignore_telnet_erase_cmds = false: ignore erase
+ character and erase line commands when normalizing
+ * int ftp_client.max_resp_len = -1: maximum ftp response accepted
+ by client { -1: }
+ * bool ftp_client.telnet_cmds = false: detect telnet escape
+ sequences on ftp control channel
+
+
+6.6. ftp_data
------------
* ftp_data.packets: total packets
-6.6. ftp_server
+6.7. ftp_server
------------
* ftp_server.packets: total packets
-6.7. http_inspect
+6.8. http_global
+
+------------
+
+What: http inspector global configuration and client rules for use
+with http_server
+
+Type: inspector
+
+Configuration:
+
+ * int http_global.compress_depth = 65535: maximum amount of packet
+ payload to decompress { 1:65535 }
+ * int http_global.decode.b64_decode_depth = 0: single packet decode
+ depth { -1:65535 }
+ * int http_global.decode.bitenc_decode_depth = 0: single packet
+ decode depth { -1:65535 }
+ * int http_global.decode.max_mime_mem = 838860: single packet
+ decode depth { 3276: }
+ * int http_global.decode.qp_decode_depth = 0: single packet decode
+ depth { -1:65535 }
+ * int http_global.decode.uu_decode_depth = 0: single packet decode
+ depth { -1:65535 }
+ * int http_global.decompress_depth = 65535: maximum amount of
+ decompressed data to process { 1:65535 }
+ * bool http_global.detect_anomalous_servers = false: inspect
+ non-configured ports for HTTP - bad idea
+ * int http_global.max_gzip_mem = 838860: total memory used for
+ decompression across all active sessions { 3276: }
+ * int http_global.memcap = 150994944: limit of memory used for
+ logging extra data { 2304: }
+ * bool http_global.proxy_alert = false: alert on proxy usage for
+ servers without allow_proxy_use
+ * int http_global.unicode_map.code_page = 1252: select code page in
+ map file { 0: }
+ * string http_global.unicode_map.map_file: unicode map file
+
+Rules:
+
+ * 119:1 (http_global) ascii encoding
+ * 119:2 (http_global) double decoding attack
+ * 119:3 (http_global) u encoding
+ * 119:4 (http_global) bare byte unicode encoding
+ * 119:5 (http_global) base36 encoding
+ * 119:6 (http_global) UTF-8 encoding
+ * 119:7 (http_global) IIS unicode codepoint encoding
+ * 119:8 (http_global) multi_slash encoding
+ * 119:9 (http_global) IIS backslash evasion
+ * 119:10 (http_global) self directory traversal
+ * 119:11 (http_global) directory traversal
+ * 119:12 (http_global) apache whitespace (tab)
+ * 119:13 (http_global) non-RFC http delimiter
+ * 119:14 (http_global) non-RFC defined char
+ * 119:15 (http_global) oversize request-URI directory
+ * 119:16 (http_global) oversize chunk encoding
+ * 119:17 (http_global) unauthorized proxy use detected
+ * 119:18 (http_global) webroot directory traversal
+ * 119:19 (http_global) long header
+ * 119:20 (http_global) max header fields
+ * 119:21 (http_global) multiple content length
+ * 119:22 (http_global) chunk size mismatch detected
+ * 119:23 (http_global) invalid ip in true-client-IP/XFF header
+ * 119:24 (http_global) multiple host hdrs detected
+ * 119:25 (http_global) hostname exceeds 255 characters
+ * 119:26 (http_global) header parsing space saturation
+ * 119:27 (http_global) client consecutive small chunk sizes
+ * 119:28 (http_global) post w/o content-length or chunks
+ * 119:29 (http_global) multiple true IPs in a session
+ * 119:30 (http_global) both true-client-IP and XFF hdrs present
+ * 119:31 (http_global) unknown method
+ * 119:32 (http_global) simple request
+ * 119:33 (http_global) unescaped space in http URI
+ * 119:34 (http_global) too many pipelined requests
+
+Peg counts:
+
+ * http_global.packets: total packets processed
+ * http_global.gets: GET requests
+ * http_global.posts: POST requests
+ * http_global.request headers: total requests
+ * http_global.response headers: total responses
+ * http_global.request cookies: requests with Cookie
+ * http_global.response cookies: responses with Set-Cookie
+ * http_global.post params: POST parameters extracted
+ * http_global.unicode: unicode normalizations
+ * http_global.double unicode: double unicode normalizations
+ * http_global.non-ascii: non-ascii normalizations
+ * http_global.paths with ../: directory traversal normalizations
+ * http_global.paths with //: double slash normalizations
+ * http_global.paths with ./: relative directory normalizations
+ * http_global.gzip packets: packets with gzip compression
+ * http_global.compressed bytes: total comparessed bytes processed
+ * http_global.decompressed bytes: total bytes decompressed
+
+
+6.9. http_inspect
------------
* bool http_inspect.allow_proxy_use = false: don’t alert on proxy
use for this server
- * bool http_inspect.decompress_pdf = false: ????
- * bool http_inspect.decompress_swf = false: ????
+ * bool http_inspect.decompress_pdf = false: enable decompression of
+ the compressed portions of PDF files
+ * bool http_inspect.decompress_swf = false: enable decompression of
+ SWF (Adobe Flash content)
* bool http_inspect.enable_cookies = true: extract cookies
* bool http_inspect.enable_xff = false: log True-Client-IP and
X-Forwarded-For headers with unified2 alerts as extra data
preceded by a space is considered a delimiter or part of URI
* bool http_inspect.unlimited_decompress = true: decompress across
multiple packets
- * bool http_inspect.xff_headers = false: ????
+ * bool http_inspect.xff_headers = false: not implemented
Rules:
* 120:17 (http_inspect) HTTP response PDF file parse failure
-6.8. new_http_inspect
+6.10. imap
+
+------------
+
+What: imap inspection
+
+Type: inspector
+
+Configuration:
+
+ * int imap.b64_decode_depth = 1460: base64 decoding depth {
+ -1:65535 }
+ * int imap.bitenc_decode_depth = 1460: Non-Encoded MIME attachment
+ extraction depth { -1:65535 }
+ * int imap.qp_decode_depth = 1460: Quoted Printable decoding depth
+ { -1:65535 }
+ * int imap.uu_decode_depth = 1460: Unix-to-Unix decoding depth {
+ -1:65535 }
+
+Rules:
+
+ * 141:1 (imap) Unknown IMAP3 command
+ * 141:2 (imap) Unknown IMAP3 response
+ * 141:4 (imap) Base64 Decoding failed.
+ * 141:5 (imap) Quoted-Printable Decoding failed.
+ * 141:7 (imap) Unix-to-Unix Decoding failed.
+
+Peg counts:
+
+ * imap.packets: total packets
+
+
+6.11. new_http_inspect
------------
* 219:52 (new_http_inspect) HTTP misformatted or not really HTTP
-6.9. normalizer
+6.12. normalizer
------------
segments
-6.10. perf_monitor
+6.13. perf_monitor
------------
* perf_monitor.packets: total packets
-6.11. port_scan
+6.14. pop
+
+------------
+
+What: pop inspection
+
+Type: inspector
+
+Configuration:
+
+ * int pop.b64_decode_depth = 1460: base64 decoding depth { -1:65535
+ }
+ * int pop.bitenc_decode_depth = 1460: Non-Encoded MIME attachment
+ extraction depth { -1:65535 }
+ * int pop.qp_decode_depth = 1460: Quoted Printable decoding depth {
+ -1:65535 }
+ * int pop.uu_decode_depth = 1460: Unix-to-Unix decoding depth {
+ -1:65535 }
+
+Rules:
+
+ * 142:1 (pop) Unknown POP3 command
+ * 142:2 (pop) Unknown POP3 response
+ * 142:4 (pop) Base64 Decoding failed.
+ * 142:5 (pop) Quoted-Printable Decoding failed.
+ * 142:7 (pop) Unix-to-Unix Decoding failed.
+
+Peg counts:
+
+ * pop.packets: total packets
+
+
+6.15. port_scan
------------
* 122:27 (port_scan) open port
-6.12. rpc_decode
+6.16. port_scan_global
+
+------------
+
+What: shared settings for port_scan inspectors for use with port_scan
+
+Type: inspector
+
+Configuration:
+
+ * int port_scan_global.memcap = 1048576: maximum tracker memory {
+ 1: }
+
+Peg counts:
+
+ * port_scan_global.packets: total packets
+
+
+6.17. rpc_decode
------------
* rpc_decode.packets: total packets
-6.13. ssh
+6.18. ssh
------------
* ssh.packets: total packets
-6.14. stream
+6.19. stream
------------
* stream.ip prunes: ip sessions pruned
-6.15. stream_icmp
+6.20. stream_icmp
------------
* stream_icmp.released: icmp session trackers released
-6.16. stream_ip
+6.21. stream_ip
------------
* stream_ip.nodes deleted: fragments deleted from tracker
-6.17. stream_tcp
+6.22. stream_tcp
------------
flushed when session released
-6.18. stream_udp
+6.23. stream_udp
------------
* stream_udp.timeouts: udp session timeouts
-6.19. telnet
+6.24. telnet
------------
* telnet.packets: total packets
-6.20. wizard
+6.25. wizard
------------
promiscuous mode
* int daq.snaplen = deflt: set snap length (same as -P) { 0:65535 }
* string daq.type: select type of DAQ
- * string daq.var: list of name=value DAQ-specific parameters
+ * string daq.vars: comma separated list of name=value DAQ-specific
+ parameters
* int detection.asn1 = 256: maximum decode nodes { 1: }
* bool detection.pcre_enable = true: disable pcre pattern matching
* int detection.pcre_match_limit = 1500: limit pcre backtracking,
* bool file_id.enable_signature = false: enable signature
calculation
* bool file_id.enable_type = false: enable type ID
+ * string file_id.file_rules[].category: file type category
+ * int file_id.file_rules[].id = 0: file type id { 0: }
+ * string file_id.file_rules[].magic[].content: file magic content
+ * int file_id.file_rules[].magic[].offset = 0: file magic offset {
+ 0: }
+ * string file_id.file_rules[].msg: information about the file type
+ * int file_id.file_rules[].rev = 0: rule revision { 0: }
+ * string file_id.file_rules[].type: file type name
+ * string file_id.file_rules[].version: file type version
* int file_id.lookup_timeout = 2: give up on lookup after this many
seconds { 0: }
* int file_id.show_data_depth = 100: print this many octets { 0: }
* string http_header.~name: restrict to given header
* bool http_inspect.allow_proxy_use = false: don’t alert on proxy
use for this server
- * bool http_inspect.decompress_pdf = false: ????
- * bool http_inspect.decompress_swf = false: ????
+ * bool http_inspect.decompress_pdf = false: enable decompression of
+ the compressed portions of PDF files
+ * bool http_inspect.decompress_swf = false: enable decompression of
+ SWF (Adobe Flash content)
* bool http_inspect.enable_cookies = true: extract cookies
* bool http_inspect.enable_xff = false: log True-Client-IP and
X-Forwarded-For headers with unified2 alerts as extra data
preceded by a space is considered a delimiter or part of URI
* bool http_inspect.unlimited_decompress = true: decompress across
multiple packets
- * bool http_inspect.xff_headers = false: ????
+ * bool http_inspect.xff_headers = false: not implemented
* string icmp_id.~range: check if icmp id is id | min<>max | <max |
>min
* string icmp_seq.~range: check if icmp sequence number is seq |
| >min
* string id.~range: check if the IP ID is id | min<>max | <max | >
min
+ * int imap.b64_decode_depth = 1460: base64 decoding depth {
+ -1:65535 }
+ * int imap.bitenc_decode_depth = 1460: Non-Encoded MIME attachment
+ extraction depth { -1:65535 }
+ * int imap.qp_decode_depth = 1460: Quoted Printable decoding depth
+ { -1:65535 }
+ * int imap.uu_decode_depth = 1460: Unix-to-Unix decoding depth {
+ -1:65535 }
* string ip_proto.~proto: [!|>|<] name or number
* select ipopts.~opt: output format { rr|eol|nop|ts|sec|esec|lsrr|
lsrre|ssrr|satid|any }
as -d)
* bool output.dump_payload_verbose = false: dumps raw packet
starting at link layer (same as -X)
- * string output.event_trace.file: where to write event trace logs
* int output.event_trace.max_data = 0: maximum amount of packet
data to capture { 0:65535 }
* bool output.log_ipv6_extra_data = false: log IPv6 source and
each reporting interval
* int perf_monitor.seconds = 60: report interval; 0 means report at
exit only { 0: }
+ * int pop.b64_decode_depth = 1460: base64 decoding depth { -1:65535
+ }
+ * int pop.bitenc_decode_depth = 1460: Non-Encoded MIME attachment
+ extraction depth { -1:65535 }
+ * int pop.qp_decode_depth = 1460: Quoted Printable decoding depth {
+ -1:65535 }
+ * int pop.uu_decode_depth = 1460: Unix-to-Unix decoding depth {
+ -1:65535 }
* string port_scan.ignore_scanned: list of CIDRs with optional
ports to ignore if the destination of scan alerts
* string port_scan.ignore_scanners: list of CIDRs with optional
* icmp4.bad checksum: non-zero icmp checksums
* icmp6.bad checksum (ip4): nonzero ipcm4 checksums
* icmp6.bad checksum (ip6): nonzero ipcm6 checksums
+ * imap.packets: total packets
* ipv4.bad checksum: nonzero ip checksums
* normalizer.icmp4 echo: icmp4 ping normalizations
* normalizer.icmp6 echo: icmp6 echo normalizations
* normalizer.test tcp urgent ptr: During inline mode, would have
packets without data with urgent pointer cleared
* perf_monitor.packets: total packets
+ * pop.packets: total packets
* port_scan_global.packets: total packets
* rpc_decode.packets: total packets
* snort.attribute table hosts: total number of hosts in table
* 129: stream_tcp
* 131: dns
* 134: ppm
+ * 141: imap
+ * 142: pop
* 219: new_http_inspect
* 134:1 (ppm) rule options disabled by rule latency
* 134:2 (ppm) rule options re-enabled by rule latency
* 134:3 (ppm) packet aborted due to latency
+ * 141:1 (imap) Unknown IMAP3 command
+ * 141:2 (imap) Unknown IMAP3 response
+ * 141:4 (imap) Base64 Decoding failed.
+ * 141:5 (imap) Quoted-Printable Decoding failed.
+ * 141:7 (imap) Unix-to-Unix Decoding failed.
+ * 142:1 (pop) Unknown POP3 command
+ * 142:2 (pop) Unknown POP3 response
+ * 142:4 (pop) Base64 Decoding failed.
+ * 142:5 (pop) Quoted-Printable Decoding failed.
+ * 142:7 (pop) Unix-to-Unix Decoding failed.
* 219:1 (new_http_inspect) ascii encoding
* 219:2 (new_http_inspect) double decoding attack
* 219:3 (new_http_inspect) u encoding
boolean flags
* fragbits (ips_option): rule option to test IP frag flags
* fragoffset (ips_option): rule option to test IP frag offset
- * ftp_client (data): FTP client configuration module for use with
- ftp_server
+ * ftp_client (inspector): FTP client configuration module for use
+ with ftp_server
* ftp_data (inspector): FTP data channel handler
* ftp_server (inspector): main FTP module; ftp_client should also
be configured
cursor to the request body
* http_cookie (ips_option): rule option to set the detection cursor
to the HTTP cookie
- * http_global (data): http inspector global configuration and
+ * http_global (inspector): http inspector global configuration and
client rules for use with http_server
* http_header (ips_option): rule option to set the detection cursor
to the normalized header(s)
* icode (ips_option): rule option to check ICMP code
* id (ips_option): rule option to check the IP ID field
* igmp (codec): support for Internet group management protocol
+ * imap (inspector): imap inspection
* ip_proto (ips_option): rule option to check the IP protocol
number
* ipopts (ips_option): rule option to check for IP options
* pgm (codec): support for pragmatic general multicast
* pkt_data (ips_option): rule option to set the detection cursor to
the normalized packet data
+ * pop (inspector): pop inspection
* port_scan (inspector): port scan inspector; also configure
port_scan_global
- * port_scan_global (data): shared settings for port_scan inspectors
- for use with port_scan
+ * port_scan_global (inspector): shared settings for port_scan
+ inspectors for use with port_scan
* ppm (basic): packet and rule latency monitoring and control
(requires --enable-ppm)
* pppoe (codec): support for point-to-point protocol over ethernet
* codec::null: support for null encapsulation (DLT 0)
* codec::pflog: support for OpenBSD PF log (DLT 117)
* codec::pgm: support for pragmatic general multicast
- * codec::ppp: support for point-to-point encapsulation (DLT 9)
+ * codec::ppp: support for point-to-point encapsulation (DLT
+ DLT_PPP)
* codec::ppp_encap: support for point-to-point encapsulation
* codec::pppoe_disc: support for point-to-point discovery
* codec::pppoe_sess: support for point-to-point session
* codec::vlan: support for local area network
* codec::wlan: support for wireless local area network protocol
(DLT 105)
- * data::ftp_client: FTP inspector client module
- * data::http_global: shared HTTP inspector settings
- * data::port_scan_global: shared settings for port_scan inspectors
- for use with port_scan
* inspector::arp_spoof: detect ARP attacks and anomalies
* inspector::back_orifice: back orifice detection
* inspector::binder: configure processing based on CIDRs, ports,
services, etc.
* inspector::dns: dns inspection
+ * inspector::ftp_client: FTP inspector client module
* inspector::ftp_data: FTP data channel handler
* inspector::ftp_server: FTP inspector server module
+ * inspector::http_global: shared HTTP inspector settings
* inspector::http_inspect: main HTTP inspector module
+ * inspector::imap: imap inspection
* inspector::new_http_inspect: the new HTTP inspector!
* inspector::normalizer: packet scrubbing for inline mode
* inspector::perf_monitor: performance monitoring and flow
statistics collection
+ * inspector::pop: pop inspection
* inspector::port_scan: port scan inspector; also configure
port_scan_global
+ * inspector::port_scan_global: shared settings for port_scan
+ inspectors for use with port_scan
* inspector::rpc_decode: RPC inspector
* inspector::ssh: ssh inspection
* inspector::stream: common flow tracking
projects / thirdparty / snort3.git / commitdiff
