From: Russ Combs (rucombs) Date: Fri, 4 Nov 2016 15:10:43 +0000 (-0400) Subject: Merge pull request #695 in SNORT/snort3 from 218 to master X-Git-Tag: 3.0.0-233~201 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4b57dee389d6ab1e3a74063ad3ccf4b0978d3511;p=thirdparty%2Fsnort3.git Merge pull request #695 in SNORT/snort3 from 218 to master Squashed commit of the following: commit 3b7c746f92338501ef2c88656b841d867e982a3d Author: Russ Combs Date: Fri Nov 4 10:28:04 2016 -0400 build 218 --- diff --git a/ChangeLog b/ChangeLog index f269698bd..342217b30 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,11 @@ +16/11/04 - build 218 + +-- fix shutdown stats +-- fix misc appid issues +-- rewrite appid loading of lua detectors +-- add sip inspector events for appid +-- update default manuals + 16/10/28 - build 217 -- update appid to 2983 diff --git a/doc/snort_manual.html b/doc/snort_manual.html index 1a4758b31..7b44e05e6 100644 --- a/doc/snort_manual.html +++ b/doc/snort_manual.html @@ -779,7 +779,7 @@ asciidoc.install(2); 
 ,,_     -*> Snort++ <*-
-o"  )~   Version 3.0.0-a4 (Build 206) from 2.9.7-262
+o"  )~   Version 3.0.0-a4 (Build 217) from 2.9.7-262
  ''''    By Martin Roesch & The Snort Team
          http://snort.org/contact#team
          Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
@@ -1024,18 +1024,16 @@ settings, etc., you can also script Loggers and IpsOptions.

New Http Inspector

One of the major undertakings for Snort 3.0 is developing a completely new -HTTP inspector. It is incomplete right now but you can examine the -work-in-progress. You can configure it by adding:

+HTTP inspector. You can configure it by adding:

-
new_http_inspect = {}
+
http_inspect = {}

to your snort.lua configuration file. Or you can read it in the source code -under src/service_inspectors/nhttp_inspect.

-

The classic HTTP preprocessor is still available in the alpha release as -http_inspect. It’s probably the better choice for now if you just want to -do some work and do not feel like experimenting. Be sure not to configure - both old and new HTTP inspectors at the same time.

+under src/service_inspectors/http_inspect.

+

The classic HTTP preprocessor is still available in the alpha release under +extra. It has been renamed http_server. Be sure not to configure both old +and new HTTP inspectors at the same time.

So why a new HTTP inspector?

For starters it is object-oriented. That’s good for us because we maintain this software. But it should also be really nice for open-source @@ -1044,20 +1042,20 @@ processing without having to understand the whole thing. In fact much of the new HTTP inspector’s knowledge of HTTP is centralized in a series of tables where it can be easily reviewed and modified. Many significant changes can be made just by updating these tables.

-

New_http_inspect is the first inspector written specifically for the new +

Http_inspect is the first inspector written specifically for the new Snort 3.0 architecture. That provides access to one of the very best -features of Snort 3.0: purely PDU-based inspection. Classic http_inspect +features of Snort 3.0: purely PDU-based inspection. The classic preprocessor processes HTTP messages, but even while doing so it is constantly aware of IP packets and how they divide up the TCP data stream. The same HTTP message might be processed differently depending on how the sender (bad guy) divided it up into IP packets.

-

New_http_inspect is free of this burden and can focus exclusively on HTTP. -That makes it much more simple, easier to test, and less prone to false +

Http_inspect is free of this burden and can focus exclusively on HTTP. +That makes it much simpler, easier to test, and less prone to false positives. It also greatly reduces the opportunity for adversaries to probe the inspector for weak spots by adjusting packet boundaries to disguise bad behavior.

Dealing solely with HTTP messages also opens the door for developing major -new features. The new_http_inspect design supports true stateful +new features. The http_inspect design supports true stateful processing. Want to ask questions that involve both the client request and the server response? Or different requests in the same session? These things are possible.

@@ -1067,10 +1065,9 @@ the name, it is better to think of HTTP/2 not as a newer version of HTTP/1.1, but rather a separate protocol layer that runs under HTTP/1.1 and on top of TLS or TCP. It’s a perfect fit for the new Snort 3.0 architecture because a new HTTP/2 inspector would naturally output HTTP/1.1 messages but -not any underlying packets. Exactly what the new_http_inspect wants to -input.

-

New_http_inspect is taking a very different approach to HTTP header fields. -Classic http_inspect divides all the HTTP headers following the start line +not any underlying packets. Exactly what http_inspect wants to input.

+

Http_inspect is taking a very different approach to HTTP header fields. +The classic preprocessor divides all the HTTP headers following the start line into cookies and everything else. It normalizes the two pieces using a generic process and puts them in buffers that one can write rules against. There is some limited support for examining individual headers within the @@ -1082,7 +1079,9 @@ normalization means put that date in a standard format.

Binder and Wizard

-

One of the fundamental differences between Snort and Snort++ concerns configuration related to networks and ports. Here is a brief review of Snort’s configuration for network and service related components:

+

One of the fundamental differences between Snort and Snort++ concerns configuration +related to networks and ports. Here is a brief review of Snort’s configuration for +network and service related components:

  • @@ -2477,7 +2476,7 @@ bool daq.no_promisc = false: whether to put DAQ device into pro

  • -116:468 (decode) too many protocols present +116:472 (decode) too many protocols present

@@ -2518,7 +2517,7 @@ int detection.pcre_match_limit_recursion = 1500: limit pcre sta

  • -detection.slow searches: non-fast pattern rule evaluations +detection.hard evals: non-fast pattern rule evaluations

  • @@ -2732,6 +2731,11 @@ int file_id.capture_block_size = 32768: file capture block size

  • +int file_id.max_files_cached = 65536: maximal number of files cached in memory { 8: } +

    +
    • +
  • +

    bool file_id.enable_type = false: enable type ID

    • @@ -3067,7 +3071,7 @@ bool latency.packet.fastpath = false: fastpath expensive packet

  • -enum latency.packet.action = alert_and_log: event action if packet times out and is fastpathed { none | alert | log | alert_and_log } +enum latency.packet.action = none: event action if packet times out and is fastpathed { none | alert | log | alert_and_log }

  • @@ -3092,7 +3096,7 @@ int latency.rule.max_suspend_time = 30000: set max time for sus

  • -enum latency.rule.action = alert_and_log: event action for rule latency enable and suspend events { none | alert | log | alert_and_log } +enum latency.rule.action = none: event action for rule latency enable and suspend events { none | alert | log | alert_and_log }

    • @@ -3118,27 +3122,37 @@ enum latency.rule.action = alert_and_log: event action for rule

    • -latency.total_packets: total packets monitored +latency.total packets: total packets monitored +

      +
      • +
    • +

      +latency.total usecs: total usecs elapsed

    • -latency.packet_timeouts: packets that timed out +latency.max usecs: maximum usecs elapsed

    • -latency.total_rule_evals: total rule evals monitored +latency.packet timeouts: packets that timed out

    • -latency.rule_eval_timeouts: rule evals that timed out +latency.total rule evals: total rule evals monitored

    • -latency.rule_tree_enables: rule tree re-enables +latency.rule eval timeouts: rule evals that timed out +

      +
      • +
    • +

      +latency.rule tree enables: rule tree re-enables

    @@ -3469,7 +3483,7 @@ int rate_filter[].seconds = 1: count interval { 0: }

  • -select rate_filter[].new_action = alert: take this action on future hits until timeout { alert | drop | log | pass | | reject | sdrop } +enum rate_filter[].new_action = alert: take this action on future hits until timeout { log | pass | alert | drop | block | reset }

  • @@ -3573,11 +3587,6 @@ bool search_engine.debug_print_rule_groups_compiled = false: pr

  • -bool search_engine.debug_print_fast_pattern = false: print fast pattern info for each rule -

    -
    • -
  • -

    int search_engine.max_pattern_len = 0: truncate patterns when compiling into state machine (0 means no maximum) { 0: }

    • @@ -3598,12 +3607,17 @@ dynamic search_engine.search_method = ac_bnfa: set fast pattern

  • -bool search_engine.split_any_any = false: evaluate any-any rules separately to save memory +bool search_engine.search_optimize = true: tweak state machine construction for better performance

  • -bool search_engine.search_optimize = true: tweak state machine construction for better performance +bool search_engine.show_fast_patterns = false: print fast pattern info for each rule +

    +
    • +
  • +

    +bool search_engine.split_any_any = false: evaluate any-any rules separately to save memory

    • @@ -3657,6 +3671,11 @@ bit_list side_channel.ports: side channel message port list { 6 string side_channel.connectors[].connector: connector handle

    +
  • +

    +string side_channel.connector: connector handle +

    +

    • Peg counts:

    @@ -3838,11 +3857,6 @@ implied snort.-W: lists available interfaces

  • -implied snort.-w: dump 802.11 management and control frames -

    -
    • -
  • -

    implied snort.-X: dump the raw packet data starting at the link layer

    • @@ -4391,6 +4405,34 @@ protocol decoding, anomaly detection, and construction of active responses.

    <
    +

    ciscometadata

    +

    What: support for cisco metadata

    +

    Type: codec

    +

    Rules:

    +
      +
    • +

      +116:468 (ciscometadata) truncated Cisco Metadata header +

      +
      • +
    • +

      +116:469 (ciscometadata) invalid Cisco Metadata option length +

      +
      • +
    • +

      +116:470 (ciscometadata) invalid Cisco Metadata option type +

      +
      • +
    • +

      +116:471 (ciscometadata) invalid Cisco Metadata SGT +

      +
      • +
    +
    +

    erspan2

    What: support for encapsulated remote switched port analyzer - type 2

    Type: codec

    @@ -5346,7 +5388,7 @@ int appid.memcap = 268435456: time period for collecting and lo

  • -string appid.app_stats_filename: Filename for logging AppId statistics +bool appid.log_stats = false: enable logging of AppId statistics

  • @@ -5389,12 +5431,57 @@ bool appid.dump_ports = false: enable dump of AppId port inform string appid.thirdparty_appid_dir: directory to load thirdparty AppId detectors from

    • +
  • +

    +addr appid.session_log_filter.src_ip = 0.0.0.0/32: source ip address in CIDR format +

    +
    • +
  • +

    +addr appid.session_log_filter.dst_ip = 0.0.0.0/32: destination ip address in CIDR format +

    +
    • +
  • +

    +port appid.session_log_filter.src_port: source port { 1: } +

    +
    • +
  • +

    +port appid.session_log_filter.dst_port: destination port { 1: } +

    +
    • +
  • +

    +string appid.session_log_filter.protocol: ip protocol +

    +
    • +
  • +

    +bool appid.session_log_filter.log_all_sessions = false: enable logging for all appid sessions +

    +

    • Peg counts:

    • -appid.packets: count of packets processed by appid +appid.packets: count of packets received by appid inspector +

      +
      • +
    • +

      +appid.processed packets: count of packets processed by appid inspector +

      +
      • +
    • +

      +appid.ignored packets: count of packets ignored by appid inspector +

      +
      • +
    • +

      +appid.aim_clients: count of aim clients discovered by appid

    • @@ -5424,6 +5511,11 @@ string appid.thirdparty_appid_dir: directory to load thirdparty

    • +appid.bootp_flows: count of bootp flows discovered by appid +

      +
      • +
    • +

      appid.dcerpc_tcp_flows: count of dce rpc flows over tcp discovered by appid

      • @@ -5434,6 +5526,11 @@ string appid.thirdparty_appid_dir: directory to load thirdparty

    • +appid.direct_connect_flows: count of direct connect flows discovered by appid +

      +
      • +
    • +

      appid.dns_tcp_flows: count of dns flows over tcp discovered by appid

      • @@ -5454,6 +5551,11 @@ string appid.thirdparty_appid_dir: directory to load thirdparty

    • +appid.http_flows: count of http flows discovered by appid +

      +
      • +
    • +

      appid.imap_flows: count of imap service flows discovered by appid

      • @@ -5494,12 +5596,37 @@ string appid.thirdparty_appid_dir: directory to load thirdparty

    • +appid.msn_clients: count of msn clients discovered by appid +

      +
      • +
    • +

      appid.mysql_flows: count of mysql service flows discovered by appid

    • -appid.netbios_flows: count of netbios service flows discovered by appid +appid.netbios_dgm_flows: count of netbios-dgm service flows discovered by appid +

      +
      • +
    • +

      +appid.netbios_ns_flows: count of netbios-ns service flows discovered by appid +

      +
      • +
    • +

      +appid.netbios_ssn_flows: count of netbios-ssn service flows discovered by appid +

      +
      • +
    • +

      +appid.nntp_flows: count of nntp flows discovered by appid +

      +
      • +
    • +

      +appid.ntp_flows: count of ntp flows discovered by appid

    • @@ -5509,6 +5636,121 @@ string appid.thirdparty_appid_dir: directory to load thirdparty

    • +appid.radius_flows: count of radius flows discovered by appid +

      +
      • +
    • +

      +appid.rexec_flows: count of rexec flows discovered by appid +

      +
      • +
    • +

      +appid.rfb_flows: count of rfb flows discovered by appid +

      +
      • +
    • +

      +appid.rlogin_flows: count of rlogin flows discovered by appid +

      +
      • +
    • +

      +appid.rpc_flows: count of rpc flows discovered by appid +

      +
      • +
    • +

      +appid.rshell_flows: count of rshell flows discovered by appid +

      +
      • +
    • +

      +appid.rsync_flows: count of rsync service flows discovered by appid +

      +
      • +
    • +

      +appid.rtmp_flows: count of rtmp flows discovered by appid +

      +
      • +
    • +

      +appid.rtp_clients: count of rtp clients discovered by appid +

      +
      • +
    • +

      +appid.sip_clients: count of SIP clients discovered by appid +

      +
      • +
    • +

      +appid.sip_flows: count of SIP flows discovered by appid +

      +
      • +
    • +

      +appid.smtp_aol_clients: count of AOL smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_applemail_clients: count of Apple Mail smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_eudora_clients: count of Eudora smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_eudora_pro_clients: count of Eudora Pro smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_evolution_clients: count of Evolution smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_kmail_clients: count of KMail smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_lotus_notes_clients: count of Lotus Notes smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_microsoft_outlook_clients: count of Microsoft Outlook smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_microsoft_outlook_express_clients: count of Microsoft Outlook Express smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_microsoft_outlook_imo_clients: count of Microsoft Outlook IMO smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_mutt_clients: count of Mutt smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_thunderbird_clients: count of Thunderbird smtp clients discovered by appid +

      +
      • +
    • +

      appid.smtp_flows: count of smtp flows discovered by appid

      • @@ -5519,6 +5761,11 @@ string appid.thirdparty_appid_dir: directory to load thirdparty

    • +appid.snmp_flows: count of snmp flows discovered by appid +

      +
      • +
    • +

      appid.ssh_clients: count of ssh clients discovered by appid

      • @@ -5539,9 +5786,34 @@ string appid.thirdparty_appid_dir: directory to load thirdparty

    • +appid.tftp_flows: count of tftp flows discovered by appid +

      +
      • +
    • +

      appid.timbuktu_flows: count of timbuktu flows discovered by appid

      • +
    • +

      +appid.tns_clients: count of tns clients discovered by appid +

      +
      • +
    • +

      +appid.tns_flows: count of tns flows discovered by appid +

      +
      • +
    • +

      +appid.vnc_clients: count of vnc clients discovered by appid +

      +
      • +
    • +

      +appid.yahoo_messenger_clients: count of Yahoo Messenger clients discovered by appid +

      +
    @@ -5791,6 +6063,11 @@ int dce_smb.smb_file_depth = 16384: SMB file depth for file da string dce_smb.smb_invalid_shares: SMB shares to alert on

    +
  • +

    +bool dce_smb.smb_legacy_mode = false: inspect only SMBv1 +

    +

    • Rules:

      @@ -6039,6 +6316,16 @@ string dce_smb.smb_invalid_shares: SMB shares to alert on 133:57 (dce_smb) SMB - Client attempted to create or set a file’s attributes to readonly/hidden/system.

      +
    • +

      +133:58 (dce_smb) SMB - File offset provided is greater than file size specified +

      +
      • +
    • +

      +133:59 (dce_smb) SMB - Next command specified in SMB2 header is beyond payload boundary +

      +

    Peg counts:

      @@ -6204,6 +6491,11 @@ string dce_smb.smb_invalid_shares: SMB shares to alert on

    • +dce_smb.Ignored bytes: total ignored bytes +

      +
      • +
    • +

      dce_smb.Client segs reassembled: total smb client segments reassembled

      • @@ -6222,8 +6514,43 @@ string dce_smb.smb_invalid_shares: SMB shares to alert on dce_smb.Files processed: total smb files processed

      -
    - +
  • +

    +dce_smb.SMBv2 create: total number of SMBv2 create packets seen +

    +
    • +
  • +

    +dce_smb.SMBv2 write: total number of SMBv2 write packets seen +

    +
    • +
  • +

    +dce_smb.SMBv2 read: total number of SMBv2 read packets seen +

    +
    • +
  • +

    +dce_smb.SMBv2 set info: total number of SMBv2 set info packets seen +

    +
    • +
  • +

    +dce_smb.SMBv2 tree connect: total number of SMBv2 tree connect packets seen +

    +
    • +
  • +

    +dce_smb.SMBv2 tree disconnect: total number of SMBv2 tree disconnect packets seen +

    +
    • +
  • +

    +dce_smb.SMBv2 close: total number of SMBv2 close packets seen +

    +
    • + +

    dce_tcp

    What: dce over tcp inspection

    @@ -6479,6 +6806,165 @@ enum dce_tcp.policy = WinXP: Target based policy to use { Win2
    +

    dce_udp

    +

    What: dce over udp inspection

    +

    Type: inspector

    +

    Configuration:

    +
      +
    • +

      +bool dce_udp.disable_defrag = false: Disable DCE/RPC defragmentation +

      +
      • +
    • +

      +int dce_udp.max_frag_len = 65535: Maximum fragment size for defragmentation { 1514:65535 } +

      +
      • +
    +

    Rules:

    +
      +
    • +

      +133:40 (dce_udp) Connection-less DCE/RPC - Invalid major version. +

      +
      • +
    • +

      +133:41 (dce_udp) Connection-less DCE/RPC - Invalid pdu type. +

      +
      • +
    • +

      +133:42 (dce_udp) Connection-less DCE/RPC - Data length less than header size. +

      +
      • +
    • +

      +133:43 (dce_udp) Connection-less DCE/RPC - Bad sequence number. +

      +
      • +
    +

    Peg counts:

    +
      +
    • +

      +dce_udp.events: total events +

      +
      • +
    • +

      +dce_udp.aborted sessions: total aborted sessions +

      +
      • +
    • +

      +dce_udp.bad autodetects: total bad autodetects +

      +
      • +
    • +

      +dce_udp.udp sessions: total udp sessions +

      +
      • +
    • +

      +dce_udp.udp packets: total udp packets +

      +
      • +
    • +

      +dce_udp.Requests: total connection-less requests +

      +
      • +
    • +

      +dce_udp.Acks: total connection-less acks +

      +
      • +
    • +

      +dce_udp.Cancels: total connection-less cancels +

      +
      • +
    • +

      +dce_udp.Client facks: total connection-less client facks +

      +
      • +
    • +

      +dce_udp.Ping: total connection-less ping +

      +
      • +
    • +

      +dce_udp.Responses: total connection-less responses +

      +
      • +
    • +

      +dce_udp.Rejects: total connection-less rejects +

      +
      • +
    • +

      +dce_udp.Cancel acks: total connection-less cancel acks +

      +
      • +
    • +

      +dce_udp.Server facks: total connection-less server facks +

      +
      • +
    • +

      +dce_udp.Faults: total connection-less faults +

      +
      • +
    • +

      +dce_udp.No calls: total connection-less no calls +

      +
      • +
    • +

      +dce_udp.Working: total connection-less working +

      +
      • +
    • +

      +dce_udp.Other requests: total connection-less other requests +

      +
      • +
    • +

      +dce_udp.Other responses: total connection-less other responses +

      +
      • +
    • +

      +dce_udp.Fragments: total connection-less fragments +

      +
      • +
    • +

      +dce_udp.Max fragment size: connection-less maximum fragment size +

      +
      • +
    • +

      +dce_udp.Frags reassembled: total connection-less fragments reassembled +

      +
      • +
    • +

      +dce_udp.Max seqnum: max connection-less seqnum +

      +
      • +
    +
    +

    dnp3

    What: dnp3 inspection

    Type: inspector

    @@ -6693,6 +7179,11 @@ string ftp_server.data_chan_cmds: check the formatting of the g

  • +string ftp_server.data_rest_cmds: check the formatting of the given commands +

    +
    • +
  • +

    string ftp_server.data_xfer_cmds: check the formatting of the given commands

    • @@ -6941,6 +7432,11 @@ bool http_inspect.unzip = true: decompress gzip and deflate mes

  • +bool http_inspect.normalize_utf = true: normalize charset utf encodings +

    +
    • +
  • +

    bit_list http_inspect.bad_characters: alert when any of specified bytes are present in URI after percent decoding { 255 }

    • @@ -7359,6 +7855,11 @@ bool http_inspect.show_pegs = true: display peg counts with tes

  • +119:66 (http_inspect) White space within header name +

    +
    • +
  • +

    119:67 (http_inspect) Excessive gzip compression

    • @@ -7402,6 +7903,21 @@ bool http_inspect.show_pegs = true: display peg counts with tes 119:75 (http_inspect) Misformatted HTTP traffic

    +
  • +

    +119:76 (http_inspect) Unsupported Transfer-Encoding or Content-Encoding used +

    +
    • +
  • +

    +119:77 (http_inspect) Unknown Transfer-Encoding or Content-Encoding used +

    +
    • +
  • +

    +119:78 (http_inspect) Multiple layers of compression encodings applied +

    +

    • Peg counts:

      @@ -9493,27 +10009,27 @@ int ssl.max_heartbeat_length = 0: maximum length of heartbeat r

      • -int stream.ip_cache.max_sessions = 16384: maximum simultaneous sessions tracked before pruning { 2: } +bool stream.ip_frags_only = false: don’t process non-frag flows

      • -int stream.ip_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +int stream.ip_cache.max_sessions = 16384: maximum simultaneous sessions tracked before pruning { 2: }

      • -int stream.ip_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } +int stream.ip_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: }

      • -int stream.ip_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } +int stream.ip_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: }

      • -int stream.icmp_cache.max_sessions = 32768: maximum simultaneous sessions tracked before pruning { 2: } +int stream.icmp_cache.max_sessions = 65536: maximum simultaneous sessions tracked before pruning { 2: }

      • @@ -9528,12 +10044,7 @@ int stream.icmp_cache.idle_timeout = 180: maximum inactive time

      • -int stream.icmp_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } -

        -
        • -
      • -

        -int stream.tcp_cache.max_sessions = 131072: maximum simultaneous sessions tracked before pruning { 2: } +int stream.tcp_cache.max_sessions = 262144: maximum simultaneous sessions tracked before pruning { 2: }

      • @@ -9548,12 +10059,7 @@ int stream.tcp_cache.idle_timeout = 180: maximum inactive time

      • -int stream.tcp_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } -

        -
        • -
      • -

        -int stream.udp_cache.max_sessions = 65536: maximum simultaneous sessions tracked before pruning { 2: } +int stream.udp_cache.max_sessions = 131072: maximum simultaneous sessions tracked before pruning { 2: }

      • @@ -9568,11 +10074,6 @@ int stream.udp_cache.idle_timeout = 180: maximum inactive time

      • -int stream.udp_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } -

        -
        • -
      • -

        int stream.user_cache.max_sessions = 1024: maximum simultaneous sessions tracked before pruning { 2: }

        • @@ -9588,11 +10089,6 @@ int stream.user_cache.idle_timeout = 180: maximum inactive time

      • -int stream.user_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } -

        -
        • -
      • -

        int stream.file_cache.max_sessions = 128: maximum simultaneous sessions tracked before pruning { 2: }

        • @@ -9606,11 +10102,6 @@ int stream.file_cache.pruning_timeout = 30: minimum inactive ti int stream.file_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: }

        -
      • -

        -int stream.file_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } -

        -

      Peg counts:

        @@ -9626,7 +10117,7 @@ int stream.file_cache.cleanup_pct = 5: percent of cache to clea

      • -stream.ip timeout prunes: ip sessions pruned due to timeout +stream.ip idle prunes: ip sessions pruned due to timeout

      • @@ -9651,7 +10142,7 @@ int stream.file_cache.cleanup_pct = 5: percent of cache to clea

      • -stream.ip user prunes: ip sessions pruned for other reasons +stream.ip ha prunes: ip sessions pruned by high availability sync

      • @@ -9666,7 +10157,7 @@ int stream.file_cache.cleanup_pct = 5: percent of cache to clea

      • -stream.icmp timeout prunes: icmp sessions pruned due to timeout +stream.icmp idle prunes: icmp sessions pruned due to timeout

      • @@ -9691,7 +10182,7 @@ int stream.file_cache.cleanup_pct = 5: percent of cache to clea

      • -stream.icmp user prunes: icmp sessions pruned for other reasons +stream.icmp ha prunes: icmp sessions pruned by high availability sync

      • @@ -9706,7 +10197,7 @@ int stream.file_cache.cleanup_pct = 5: percent of cache to clea

      • -stream.tcp timeout prunes: tcp sessions pruned due to timeout +stream.tcp idle prunes: tcp sessions pruned due to timeout

      • @@ -9731,7 +10222,7 @@ int stream.file_cache.cleanup_pct = 5: percent of cache to clea

      • -stream.tcp user prunes: tcp sessions pruned for other reasons +stream.tcp ha prunes: tcp sessions pruned by high availability sync

      • @@ -9746,7 +10237,7 @@ int stream.file_cache.cleanup_pct = 5: percent of cache to clea

      • -stream.udp timeout prunes: udp sessions pruned due to timeout +stream.udp idle prunes: udp sessions pruned due to timeout

      • @@ -9771,7 +10262,7 @@ int stream.file_cache.cleanup_pct = 5: percent of cache to clea

      • -stream.udp user prunes: udp sessions pruned for other reasons +stream.udp ha prunes: udp sessions pruned by high availability sync

      • @@ -9786,7 +10277,7 @@ int stream.file_cache.cleanup_pct = 5: percent of cache to clea

      • -stream.user timeout prunes: user sessions pruned due to timeout +stream.user idle prunes: user sessions pruned due to timeout

      • @@ -9811,7 +10302,7 @@ int stream.file_cache.cleanup_pct = 5: percent of cache to clea

      • -stream.user user prunes: user sessions pruned for other reasons +stream.user ha prunes: user sessions pruned by high availability sync

      • @@ -9826,7 +10317,7 @@ int stream.file_cache.cleanup_pct = 5: percent of cache to clea

      • -stream.file timeout prunes: file sessions pruned due to timeout +stream.file idle prunes: file sessions pruned due to timeout

      • @@ -9851,7 +10342,7 @@ int stream.file_cache.cleanup_pct = 5: percent of cache to clea

      • -stream.file user prunes: file sessions pruned for other reasons +stream.file ha prunes: file sessions pruned by high availability sync

      @@ -9951,6 +10442,11 @@ enum stream_ip.policy = linux: fragment reassembly policy { fir int stream_ip.session_timeout = 30: session tracking timeout { 1:86400 }

      +
    • +

      +int stream_ip.trace: mask for enabling debug traces in module +

      +

    Rules:

      @@ -10044,12 +10540,12 @@ int stream_ip.session_timeout = 30: session tracking timeout {

    • -stream_ip.total: total fragments +stream_ip.total frags: total fragments

    • -stream_ip.current: current fragments +stream_ip.current frags: current fragments

    • @@ -12179,17 +12675,17 @@ int rev.~: revision { 1: }

      • -string rpc.~app: application number +int rpc.~app: application number

      • -string rpc.~ver: version number or * for any +int rpc.ver: version number or * for any

      • -string rpc.~proc: procedure number or * for any +int rpc.proc: procedure number or * for any

      @@ -14208,8 +14704,6 @@ configure can be found by running the following command:

    snort --help-config http_inspect | grep http_inspect.profile
    -

    The new Http Inspect (new_http_inspect) implementation of config options is -still under development.

    @@ -15976,6 +16470,12 @@ The goal is to have highly readable class declarations. The user available to the client.

    +
  • +

    +Any using statements in source files should be added only after all + includes have been declared. +

    +
    • @@ -15994,6 +16494,12 @@ Use lower case identifiers with underscore separators, e.g. some_function()

  • +Do not start or end variable names with an underscore. This has a good + chance of conflicting with macro and/or system definitions. +

    +
    • +
  • +

    Use lower case filenames with underscores.

    • @@ -16050,9 +16556,10 @@ Use FIXIT (not FIXTHIS or TODO or whatever) to mark things left for a

  • -Presently using FIXIT-X where X = P | H | M | L, indicating perf, high, - med, or low priority. For now, H, M, or L can indicate alpha 1, 2, or 3. - Perf changes fall between alpha 1 and 2. +Presently using FIXIT-X where X = A | W | P | H | M | L, indicating analysis, + warning, perf, high, med, or low priority. Place A and W comments on the + exact warning line so we can match up comments and build output. Supporting + comments can be added above.

  • @@ -16080,7 +16587,7 @@ Put author, description, etc. in separate comment(s) following the

  • Each header should have a comment immediately after the header guard to - give an overview of the file so the user knows what’s going on. + give an overview of the file so the reader knows what’s going on.

    • @@ -17597,11 +18104,6 @@ libraries see the Getting Started section of the manual.

  • --w dump 802.11 management and control frames -

    -
    • -
  • -

    -W lists available interfaces

    • @@ -17958,11 +18460,6 @@ string appid.app_detector_dir: directory to load AppId detector

  • -string appid.app_stats_filename: Filename for logging AppId statistics -

    -
    • -
  • -

    int appid.app_stats_period = 300: time period for collecting and logging AppId statistics { 0: }

    • @@ -17998,6 +18495,11 @@ int appid.instance_id = 0: instance id - need more details for

  • +bool appid.log_stats = false: enable logging of AppId statistics +

    +
    • +
  • +

    int appid.memcap = 268435456: time period for collecting and logging AppId statistics { 1048576:3221225472 }

    • @@ -18008,6 +18510,36 @@ string appids.~: appid option

  • +addr appid.session_log_filter.dst_ip = 0.0.0.0/32: destination ip address in CIDR format +

    +
    • +
  • +

    +port appid.session_log_filter.dst_port: destination port { 1: } +

    +
    • +
  • +

    +bool appid.session_log_filter.log_all_sessions = false: enable logging for all appid sessions +

    +
    • +
  • +

    +string appid.session_log_filter.protocol: ip protocol +

    +
    • +
  • +

    +addr appid.session_log_filter.src_ip = 0.0.0.0/32: source ip address in CIDR format +

    +
    • +
  • +

    +port appid.session_log_filter.src_port: source port { 1: } +

    +
    • +
  • +

    string appid.thirdparty_appid_dir: directory to load thirdparty AppId detectors from

    • @@ -18523,6 +19055,11 @@ string dce_smb.smb_invalid_shares: SMB shares to alert on

  • +bool dce_smb.smb_legacy_mode = false: inspect only SMBv1 +

    +
    • +
  • +

    int dce_smb.smb_max_chain = 3: SMB max chain size { 0:255 }

    • @@ -18558,6 +19095,16 @@ int dce_tcp.reassemble_threshold = 0: Minimum bytes received b

  • +bool dce_udp.disable_defrag = false: Disable DCE/RPC defragmentation +

    +
    • +
  • +

    +int dce_udp.max_frag_len = 65535: Maximum fragment size for defragmentation { 1514:65535 } +

    +
    • +
  • +

    int detection.asn1 = 256: maximum decode nodes { 1: }

    • @@ -18823,6 +19370,11 @@ int file_id.lookup_timeout = 2: give up on lookup after this ma

  • +int file_id.max_files_cached = 65536: maximal number of files cached in memory { 8: } +

    +
    • +
  • +

    int file_id.show_data_depth = 100: print this many octets { 0: }

    • @@ -19023,6 +19575,11 @@ string ftp_server.data_chan_cmds: check the formatting of the g

  • +string ftp_server.data_rest_cmds: check the formatting of the given commands +

    +
    • +
  • +

    string ftp_server.data_xfer_cmds: check the formatting of the given commands

    • @@ -19303,6 +19860,11 @@ string http_inspect.iis_unicode_map_file: file containing code

  • +bool http_inspect.normalize_utf = true: normalize charset utf encodings +

    +
    • +
  • +

    int http_inspect.oversize_dir_length = 300: maximum length for URL directory { 1:65535 }

    • @@ -19673,7 +20235,7 @@ string itype.~range: check if icmp type is type | min<&g

  • -enum latency.packet.action = alert_and_log: event action if packet times out and is fastpathed { none | alert | log | alert_and_log } +enum latency.packet.action = none: event action if packet times out and is fastpathed { none | alert | log | alert_and_log }

  • @@ -19688,7 +20250,7 @@ int latency.packet.max_time = 500: set timeout for packet laten

  • -enum latency.rule.action = alert_and_log: event action for rule latency enable and suspend events { none | alert | log | alert_and_log } +enum latency.rule.action = none: event action for rule latency enable and suspend events { none | alert | log | alert_and_log }

  • @@ -20368,7 +20930,7 @@ int rate_filter[].gid = 1: rule generator ID { 0: }

  • -select rate_filter[].new_action = alert: take this action on future hits until timeout { alert | drop | log | pass | | reject | sdrop } +enum rate_filter[].new_action = alert: take this action on future hits until timeout { log | pass | alert | drop | block | reset }

  • @@ -20508,17 +21070,17 @@ int rev.~: revision { 1: }

  • -string rpc.~app: application number +int rpc.~app: application number

  • -string rpc.~proc: procedure number or * for any +int rpc.proc: procedure number or * for any

  • -string rpc.~ver: version number or * for any +int rpc.ver: version number or * for any

  • @@ -20563,11 +21125,6 @@ bool search_engine.debug = false: print verbose fast pattern in

  • -bool search_engine.debug_print_fast_pattern = false: print fast pattern info for each rule -

    -
    • -
  • -

    bool search_engine.debug_print_nocontent_rule_tests = false: print rule group info during packet evaluation

    • @@ -20618,6 +21175,11 @@ bool search_engine.search_optimize = true: tweak state machine

  • +bool search_engine.show_fast_patterns = false: print fast pattern info for each rule +

    +
    • +
  • +

    bool search_engine.split_any_any = false: evaluate any-any rules separately to save memory

    • @@ -20673,6 +21235,11 @@ implied sha512.relative = false: offset from cursor instead of

  • +string side_channel.connector: connector handle +

    +
    • +
  • +

    string side_channel.connectors[].connector: connector handle

    • @@ -21413,11 +21980,6 @@ implied snort.--warn-vars: warn about variable definition and u

  • -implied snort.-w: dump 802.11 management and control frames -

    -
    • -
  • -

    implied snort.-W: lists available interfaces

    • @@ -21588,11 +22150,6 @@ implied ssl_version.tls1.2: check for tls1.2

  • -int stream.file_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } -

    -
    • -
  • -

    int stream.file_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: }

    • @@ -21613,17 +22170,12 @@ bool stream_file.upload = false: indicate file transfer directi

  • -int stream.icmp_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } -

    -
    • -
  • -

    int stream.icmp_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: }

  • -int stream.icmp_cache.max_sessions = 32768: maximum simultaneous sessions tracked before pruning { 2: } +int stream.icmp_cache.max_sessions = 65536: maximum simultaneous sessions tracked before pruning { 2: }

  • @@ -21638,22 +22190,22 @@ int stream_icmp.session_timeout = 30: session tracking timeout

  • -int stream.ip_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } +int stream.ip_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: }

  • -int stream.ip_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } +int stream.ip_cache.max_sessions = 16384: maximum simultaneous sessions tracked before pruning { 2: }

  • -int stream.ip_cache.max_sessions = 16384: maximum simultaneous sessions tracked before pruning { 2: } +int stream.ip_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: }

  • -int stream.ip_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +bool stream.ip_frags_only = false: don’t process non-frag flows

  • @@ -21688,6 +22240,11 @@ int stream_ip.session_timeout = 30: session tracking timeout {

  • +int stream_ip.trace: mask for enabling debug traces in module +

    +
    • +
  • +

    enum stream_reassemble.action: stop or start stream reassembly { disable|enable }

    • @@ -21718,17 +22275,12 @@ string stream_size.~range: size for comparison

  • -int stream.tcp_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } -

    -
    • -
  • -

    int stream.tcp_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: }

  • -int stream.tcp_cache.max_sessions = 131072: maximum simultaneous sessions tracked before pruning { 2: } +int stream.tcp_cache.max_sessions = 262144: maximum simultaneous sessions tracked before pruning { 2: }

  • @@ -21813,17 +22365,12 @@ int stream_tcp.small_segments.maximum_size = 0: limit number of

  • -int stream.udp_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } -

    -
    • -
  • -

    int stream.udp_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: }

  • -int stream.udp_cache.max_sessions = 65536: maximum simultaneous sessions tracked before pruning { 2: } +int stream.udp_cache.max_sessions = 131072: maximum simultaneous sessions tracked before pruning { 2: }

  • @@ -21843,11 +22390,6 @@ int stream_udp.session_timeout = 30: session tracking timeout {

  • -int stream.user_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } -

    -
    • -
  • -

    int stream.user_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: }

    • @@ -21908,6 +22450,26 @@ int tag.seconds: tag for this many seconds { 1: }

  • +string tcp_connector.address: address +

    +
    • +
  • +

    +port tcp_connector.base_port: base port number +

    +
    • +
  • +

    +string tcp_connector.connector: connector name +

    +
    • +
  • +

    +enum tcp_connector.setup: stream establishment { call | answer } +

    +
    • +
  • +

    int telnet.ayt_attack_thresh = -1: alert on this number of consecutive telnet AYT commands { -1: }

    • @@ -22038,6 +22600,11 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • +appid.aim_clients: count of aim clients discovered by appid +

      +
      • +
    • +

      appid.battlefield_flows: count of battle field flows discovered by appid

      • @@ -22063,6 +22630,11 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • +appid.bootp_flows: count of bootp flows discovered by appid +

      +
      • +
    • +

      appid.dcerpc_tcp_flows: count of dce rpc flows over tcp discovered by appid

      • @@ -22073,6 +22645,11 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • +appid.direct_connect_flows: count of direct connect flows discovered by appid +

      +
      • +
    • +

      appid.dns_tcp_flows: count of dns flows over tcp discovered by appid

      • @@ -22093,6 +22670,16 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • +appid.http_flows: count of http flows discovered by appid +

      +
      • +
    • +

      +appid.ignored packets: count of packets ignored by appid inspector +

      +
      • +
    • +

      appid.imap_flows: count of imap service flows discovered by appid

      • @@ -22133,17 +22720,42 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • +appid.msn_clients: count of msn clients discovered by appid +

      +
      • +
    • +

      appid.mysql_flows: count of mysql service flows discovered by appid

    • -appid.netbios_flows: count of netbios service flows discovered by appid +appid.netbios_dgm_flows: count of netbios-dgm service flows discovered by appid

    • -appid.packets: count of packets processed by appid +appid.netbios_ns_flows: count of netbios-ns service flows discovered by appid +

      +
      • +
    • +

      +appid.netbios_ssn_flows: count of netbios-ssn service flows discovered by appid +

      +
      • +
    • +

      +appid.nntp_flows: count of nntp flows discovered by appid +

      +
      • +
    • +

      +appid.ntp_flows: count of ntp flows discovered by appid +

      +
      • +
    • +

      +appid.packets: count of packets received by appid inspector

    • @@ -22153,16 +22765,141 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • +appid.processed packets: count of packets processed by appid inspector +

      +
      • +
    • +

      +appid.radius_flows: count of radius flows discovered by appid +

      +
      • +
    • +

      +appid.rexec_flows: count of rexec flows discovered by appid +

      +
      • +
    • +

      +appid.rfb_flows: count of rfb flows discovered by appid +

      +
      • +
    • +

      +appid.rlogin_flows: count of rlogin flows discovered by appid +

      +
      • +
    • +

      +appid.rpc_flows: count of rpc flows discovered by appid +

      +
      • +
    • +

      +appid.rshell_flows: count of rshell flows discovered by appid +

      +
      • +
    • +

      +appid.rsync_flows: count of rsync service flows discovered by appid +

      +
      • +
    • +

      +appid.rtmp_flows: count of rtmp flows discovered by appid +

      +
      • +
    • +

      +appid.rtp_clients: count of rtp clients discovered by appid +

      +
      • +
    • +

      +appid.sip_clients: count of SIP clients discovered by appid +

      +
      • +
    • +

      +appid.sip_flows: count of SIP flows discovered by appid +

      +
      • +
    • +

      +appid.smtp_aol_clients: count of AOL smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_applemail_clients: count of Apple Mail smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_eudora_clients: count of Eudora smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_eudora_pro_clients: count of Eudora Pro smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_evolution_clients: count of Evolution smtp clients discovered by appid +

      +
      • +
    • +

      appid.smtp_flows: count of smtp flows discovered by appid

    • +appid.smtp_kmail_clients: count of KMail smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_lotus_notes_clients: count of Lotus Notes smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_microsoft_outlook_clients: count of Microsoft Outlook smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_microsoft_outlook_express_clients: count of Microsoft Outlook Express smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_microsoft_outlook_imo_clients: count of Microsoft Outlook IMO smtp clients discovered by appid +

      +
      • +
    • +

      +appid.smtp_mutt_clients: count of Mutt smtp clients discovered by appid +

      +
      • +
    • +

      appid.smtps_flows: count of smtps flows discovered by appid

    • +appid.smtp_thunderbird_clients: count of Thunderbird smtp clients discovered by appid +

      +
      • +
    • +

      +appid.snmp_flows: count of snmp flows discovered by appid +

      +
      • +
    • +

      appid.ssh_clients: count of ssh clients discovered by appid

      • @@ -22183,11 +22920,36 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • +appid.tftp_flows: count of tftp flows discovered by appid +

      +
      • +
    • +

      appid.timbuktu_flows: count of timbuktu flows discovered by appid

    • +appid.tns_clients: count of tns clients discovered by appid +

      +
      • +
    • +

      +appid.tns_flows: count of tns flows discovered by appid +

      +
      • +
    • +

      +appid.vnc_clients: count of vnc clients discovered by appid +

      +
      • +
    • +

      +appid.yahoo_messenger_clients: count of Yahoo Messenger clients discovered by appid +

      +
      • +
    • +

      arp_spoof.packets: total packets

      • @@ -22393,6 +23155,11 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • +dce_smb.Ignored bytes: total ignored bytes +

      +
      • +
    • +

      dce_smb.Max outstanding requests: total smb maximum outstanding requests

      • @@ -22413,237 +23180,387 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • -dce_smb.Other responses: total connection-oriented other responses +dce_smb.Other responses: total connection-oriented other responses +

      +
      • +
    • +

      +dce_smb.Packets: total smb packets +

      +
      • +
    • +

      +dce_smb.PDUs: total connection-oriented PDUs +

      +
      • +
    • +

      +dce_smb.Rejects: total connection-oriented rejects +

      +
      • +
    • +

      +dce_smb.Request fragments: total connection-oriented request fragments +

      +
      • +
    • +

      +dce_smb.Requests: total connection-oriented requests +

      +
      • +
    • +

      +dce_smb.Response fragments: total connection-oriented response fragments +

      +
      • +
    • +

      +dce_smb.Responses: total connection-oriented responses +

      +
      • +
    • +

      +dce_smb.Server frags reassembled: total connection-oriented server fragments reassembled +

      +
      • +
    • +

      +dce_smb.Server max fragment size: connection-oriented server maximum fragment size +

      +
      • +
    • +

      +dce_smb.Server min fragment size: connection-oriented server minimum fragment size +

      +
      • +
    • +

      +dce_smb.Server segs reassembled: total connection-oriented server segments reassembled +

      +
      • +
    • +

      +dce_smb.Server segs reassembled: total smb server segments reassembled +

      +
      • +
    • +

      +dce_smb.Sessions: total smb sessions +

      +
      • +
    • +

      +dce_smb.Shutdowns: total connection-oriented shutdowns +

      +
      • +
    • +

      +dce_smb.SMBv2 close: total number of SMBv2 close packets seen +

      +
      • +
    • +

      +dce_smb.SMBv2 create: total number of SMBv2 create packets seen +

      +
      • +
    • +

      +dce_smb.SMBv2 read: total number of SMBv2 read packets seen +

      +
      • +
    • +

      +dce_smb.SMBv2 set info: total number of SMBv2 set info packets seen +

      +
      • +
    • +

      +dce_smb.SMBv2 tree connect: total number of SMBv2 tree connect packets seen +

      +
      • +
    • +

      +dce_smb.SMBv2 tree disconnect: total number of SMBv2 tree disconnect packets seen +

      +
      • +
    • +

      +dce_smb.SMBv2 write: total number of SMBv2 write packets seen +

      +
      • +
    • +

      +dce_tcp.aborted sessions: total aborted sessions +

      +
      • +
    • +

      +dce_tcp.Alter context responses: total connection-oriented alter context responses +

      +
      • +
    • +

      +dce_tcp.Alter contexts: total connection-oriented alter contexts +

      +
      • +
    • +

      +dce_tcp.Auth3s: total connection-oriented auth3s +

      +
      • +
    • +

      +dce_tcp.bad autodetects: total bad autodetects +

      +
      • +
    • +

      +dce_tcp.Bind acks: total connection-oriented binds acks +

      +
      • +
    • +

      +dce_tcp.Bind naks: total connection-oriented bind naks +

      +
      • +
    • +

      +dce_tcp.Binds: total connection-oriented binds +

      +
      • +
    • +

      +dce_tcp.Cancels: total connection-oriented cancels

    • -dce_smb.Packets: total smb packets +dce_tcp.Client frags reassembled: total connection-oriented client fragments reassembled

    • -dce_smb.PDUs: total connection-oriented PDUs +dce_tcp.Client max fragment size: connection-oriented client maximum fragment size

    • -dce_smb.Rejects: total connection-oriented rejects +dce_tcp.Client min fragment size: connection-oriented client minimum fragment size

    • -dce_smb.Request fragments: total connection-oriented request fragments +dce_tcp.Client segs reassembled: total connection-oriented client segments reassembled

    • -dce_smb.Requests: total connection-oriented requests +dce_tcp.events: total events

    • -dce_smb.Response fragments: total connection-oriented response fragments +dce_tcp.Faults: total connection-oriented faults

    • -dce_smb.Responses: total connection-oriented responses +dce_tcp.MS RPC/HTTP PDUs: total connection-oriented MS requests to send RPC over HTTP

    • -dce_smb.Server frags reassembled: total connection-oriented server fragments reassembled +dce_tcp.Orphaned: total connection-oriented orphaned

    • -dce_smb.Server max fragment size: connection-oriented server maximum fragment size +dce_tcp.Other requests: total connection-oriented other requests

    • -dce_smb.Server min fragment size: connection-oriented server minimum fragment size +dce_tcp.Other responses: total connection-oriented other responses

    • -dce_smb.Server segs reassembled: total connection-oriented server segments reassembled +dce_tcp.PDUs: total connection-oriented PDUs

    • -dce_smb.Server segs reassembled: total smb server segments reassembled +dce_tcp.Rejects: total connection-oriented rejects

    • -dce_smb.Sessions: total smb sessions +dce_tcp.Request fragments: total connection-oriented request fragments

    • -dce_smb.Shutdowns: total connection-oriented shutdowns +dce_tcp.Requests: total connection-oriented requests

    • -dce_tcp.aborted sessions: total aborted sessions +dce_tcp.Response fragments: total connection-oriented response fragments

    • -dce_tcp.Alter context responses: total connection-oriented alter context responses +dce_tcp.Responses: total connection-oriented responses

    • -dce_tcp.Alter contexts: total connection-oriented alter contexts +dce_tcp.Server frags reassembled: total connection-oriented server fragments reassembled

    • -dce_tcp.Auth3s: total connection-oriented auth3s +dce_tcp.Server max fragment size: connection-oriented server maximum fragment size

    • -dce_tcp.bad autodetects: total bad autodetects +dce_tcp.Server min fragment size: connection-oriented server minimum fragment size

    • -dce_tcp.Bind acks: total connection-oriented binds acks +dce_tcp.Server segs reassembled: total connection-oriented server segments reassembled

    • -dce_tcp.Bind naks: total connection-oriented bind naks +dce_tcp.Shutdowns: total connection-oriented shutdowns

    • -dce_tcp.Binds: total connection-oriented binds +dce_tcp.tcp packets: total tcp packets

    • -dce_tcp.Cancels: total connection-oriented cancels +dce_tcp.tcp sessions: total tcp sessions

    • -dce_tcp.Client frags reassembled: total connection-oriented client fragments reassembled +dce_udp.aborted sessions: total aborted sessions

    • -dce_tcp.Client max fragment size: connection-oriented client maximum fragment size +dce_udp.Acks: total connection-less acks

    • -dce_tcp.Client min fragment size: connection-oriented client minimum fragment size +dce_udp.bad autodetects: total bad autodetects

    • -dce_tcp.Client segs reassembled: total connection-oriented client segments reassembled +dce_udp.Cancel acks: total connection-less cancel acks

    • -dce_tcp.events: total events +dce_udp.Cancels: total connection-less cancels

    • -dce_tcp.Faults: total connection-oriented faults +dce_udp.Client facks: total connection-less client facks

    • -dce_tcp.MS RPC/HTTP PDUs: total connection-oriented MS requests to send RPC over HTTP +dce_udp.events: total events

    • -dce_tcp.Orphaned: total connection-oriented orphaned +dce_udp.Faults: total connection-less faults

    • -dce_tcp.Other requests: total connection-oriented other requests +dce_udp.Fragments: total connection-less fragments

    • -dce_tcp.Other responses: total connection-oriented other responses +dce_udp.Frags reassembled: total connection-less fragments reassembled

    • -dce_tcp.PDUs: total connection-oriented PDUs +dce_udp.Max fragment size: connection-less maximum fragment size

    • -dce_tcp.Rejects: total connection-oriented rejects +dce_udp.Max seqnum: max connection-less seqnum

    • -dce_tcp.Request fragments: total connection-oriented request fragments +dce_udp.No calls: total connection-less no calls

    • -dce_tcp.Requests: total connection-oriented requests +dce_udp.Other requests: total connection-less other requests

    • -dce_tcp.Response fragments: total connection-oriented response fragments +dce_udp.Other responses: total connection-less other responses

    • -dce_tcp.Responses: total connection-oriented responses +dce_udp.Ping: total connection-less ping

    • -dce_tcp.Server frags reassembled: total connection-oriented server fragments reassembled +dce_udp.Rejects: total connection-less rejects

    • -dce_tcp.Server max fragment size: connection-oriented server maximum fragment size +dce_udp.Requests: total connection-less requests

    • -dce_tcp.Server min fragment size: connection-oriented server minimum fragment size +dce_udp.Responses: total connection-less responses

    • -dce_tcp.Server segs reassembled: total connection-oriented server segments reassembled +dce_udp.Server facks: total connection-less server facks

    • -dce_tcp.Shutdowns: total connection-oriented shutdowns +dce_udp.udp packets: total udp packets

    • -dce_tcp.tcp packets: total tcp packets +dce_udp.udp sessions: total udp sessions

    • -dce_tcp.tcp sessions: total tcp sessions +dce_udp.Working: total connection-less working

    • @@ -22688,6 +23605,11 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • +detection.hard evals: non-fast pattern rule evaluations +

      +
      • +
    • +

      detection.header searches: fast pattern searches in header buffer

      • @@ -22733,11 +23655,6 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • -detection.slow searches: non-fast pattern rule evaluations -

      -
      • -
    • -

      detection.total alerts: alerts including IP reputation

      • @@ -23043,27 +23960,37 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • -latency.packet_timeouts: packets that timed out +latency.max usecs: maximum usecs elapsed

    • -latency.rule_eval_timeouts: rule evals that timed out +latency.packet timeouts: packets that timed out

    • -latency.rule_tree_enables: rule tree re-enables +latency.rule eval timeouts: rule evals that timed out

    • -latency.total_packets: total packets monitored +latency.rule tree enables: rule tree re-enables

    • -latency.total_rule_evals: total rule evals monitored +latency.total packets: total packets monitored +

      +
      • +
    • +

      +latency.total rule evals: total rule evals monitored +

      +
      • +
    • +

      +latency.total usecs: total usecs elapsed

    • @@ -23873,32 +24800,32 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • -stream.file memcap prunes: file sessions pruned due to memcap +stream.file ha prunes: file sessions pruned by high availability sync

    • -stream.file preemptive prunes: file sessions pruned during preemptive pruning +stream.file idle prunes: file sessions pruned due to timeout

    • -stream.file timeout prunes: file sessions pruned due to timeout +stream.file memcap prunes: file sessions pruned due to memcap

    • -stream.file total prunes: total file sessions pruned +stream.file preemptive prunes: file sessions pruned during preemptive pruning

    • -stream.file uni prunes: file uni sessions pruned +stream.file total prunes: total file sessions pruned

    • -stream.file user prunes: file sessions pruned for other reasons +stream.file uni prunes: file uni sessions pruned

    • @@ -23918,6 +24845,16 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • +stream.icmp ha prunes: icmp sessions pruned by high availability sync +

      +
      • +
    • +

      +stream.icmp idle prunes: icmp sessions pruned due to timeout +

      +
      • +
    • +

      stream_icmp.max: max icmp sessions

      • @@ -23948,11 +24885,6 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • -stream.icmp timeout prunes: icmp sessions pruned due to timeout -

      -
      • -
    • -

      stream_icmp.timeouts: icmp session timeouts

      • @@ -23968,11 +24900,6 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • -stream.icmp user prunes: icmp sessions pruned for other reasons -

      -
      • -
    • -

      stream_ip.alerts: alerts generated

      • @@ -23988,7 +24915,7 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • -stream_ip.current: current fragments +stream_ip.current frags: current fragments

    • @@ -24023,6 +24950,16 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • +stream.ip ha prunes: ip sessions pruned by high availability sync +

      +
      • +
    • +

      +stream.ip idle prunes: ip sessions pruned due to timeout +

      +
      • +
    • +

      stream_ip.max frags: max fragments

      • @@ -24088,22 +25025,17 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • -stream.ip timeout prunes: ip sessions pruned due to timeout -

      -
      • -
    • -

      stream_ip.timeouts: ip session timeouts

    • -stream.ip total prunes: total ip sessions pruned +stream_ip.total frags: total fragments

    • -stream_ip.total: total fragments +stream.ip total prunes: total ip sessions pruned

    • @@ -24133,11 +25065,6 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • -stream.ip user prunes: ip sessions pruned for other reasons -

      -
      • -
    • -

      stream_tcp.3way trackers: tcp session tracking started on ack

      • @@ -24193,6 +25120,16 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • +stream.tcp ha prunes: tcp sessions pruned by high availability sync +

      +
      • +
    • +

      +stream.tcp idle prunes: tcp sessions pruned due to timeout +

      +
      • +
    • +

      stream_tcp.ignored: tcp packets ignored

      • @@ -24313,11 +25250,6 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • -stream.tcp timeout prunes: tcp sessions pruned due to timeout -

      -
      • -
    • -

      stream_tcp.timeouts: tcp session timeouts

      • @@ -24338,22 +25270,27 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • -stream.tcp user prunes: tcp sessions pruned for other reasons +stream_udp.created: udp session trackers created

    • -stream_udp.created: udp session trackers created +stream.udp excess prunes: udp sessions pruned due to excess

    • -stream.udp excess prunes: udp sessions pruned due to excess +stream.udp flows: total udp sessions

    • -stream.udp flows: total udp sessions +stream.udp ha prunes: udp sessions pruned by high availability sync +

      +
      • +
    • +

      +stream.udp idle prunes: udp sessions pruned due to timeout

    • @@ -24388,11 +25325,6 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • -stream.udp timeout prunes: udp sessions pruned due to timeout -

      -
      • -
    • -

      stream_udp.timeouts: udp session timeouts

      • @@ -24408,32 +25340,32 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • -stream.udp user prunes: udp sessions pruned for other reasons +stream.user excess prunes: user sessions pruned due to excess

    • -stream.user excess prunes: user sessions pruned due to excess +stream.user flows: total user sessions

    • -stream.user flows: total user sessions +stream.user ha prunes: user sessions pruned by high availability sync

    • -stream.user memcap prunes: user sessions pruned due to memcap +stream.user idle prunes: user sessions pruned due to timeout

    • -stream.user preemptive prunes: user sessions pruned during preemptive pruning +stream.user memcap prunes: user sessions pruned due to memcap

    • -stream.user timeout prunes: user sessions pruned due to timeout +stream.user preemptive prunes: user sessions pruned during preemptive pruning

    • @@ -24448,17 +25380,17 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • -stream.user user prunes: user sessions pruned for other reasons +tcp.bad checksum (ip4): nonzero tcp over ip checksums

    • -tcp.bad checksum (ip4): nonzero tcp over ip checksums +tcp.bad checksum (ip6): nonzero tcp over ipv6 checksums

    • -tcp.bad checksum (ip6): nonzero tcp over ipv6 checksums +tcp_connector.messages: total messages

    • @@ -24538,6 +25470,11 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • +116: ciscometadata +

      +
      • +
    • +

      116: decode

      • @@ -24688,6 +25625,11 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • +133: dce_udp +

      +
      • +
    • +

      134: latency

      • @@ -25518,7 +26460,27 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • -116:468 (decode) too many protocols present +116:468 (ciscometadata) truncated Cisco Metadata header +

      +
      • +
    • +

      +116:469 (ciscometadata) invalid Cisco Metadata option length +

      +
      • +
    • +

      +116:470 (ciscometadata) invalid Cisco Metadata option type +

      +
      • +
    • +

      +116:471 (ciscometadata) invalid Cisco Metadata SGT +

      +
      • +
    • +

      +116:472 (decode) too many protocols present

    • @@ -25848,6 +26810,11 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • +119:66 (http_inspect) White space within header name +

      +
      • +
    • +

      119:67 (http_inspect) Excessive gzip compression

      • @@ -25893,6 +26860,21 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • +119:76 (http_inspect) Unsupported Transfer-Encoding or Content-Encoding used +

      +
      • +
    • +

      +119:77 (http_inspect) Unknown Transfer-Encoding or Content-Encoding used +

      +
      • +
    • +

      +119:78 (http_inspect) Multiple layers of compression encodings applied +

      +
      • +
    • +

      122:1 (port_scan) TCP portscan

      • @@ -26593,6 +27575,26 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • +133:40 (dce_udp) Connection-less DCE/RPC - Invalid major version. +

      +
      • +
    • +

      +133:41 (dce_udp) Connection-less DCE/RPC - Invalid pdu type. +

      +
      • +
    • +

      +133:42 (dce_udp) Connection-less DCE/RPC - Data length less than header size. +

      +
      • +
    • +

      +133:43 (dce_udp) Connection-less DCE/RPC - Bad sequence number. +

      +
      • +
    • +

      133:44 (dce_smb) SMB - Invalid SMB version 1 seen.

      • @@ -26658,6 +27660,16 @@ string wizard.spells[].to_server[].spell: sequence of data with

    • +133:58 (dce_smb) SMB - File offset provided is greater than file size specified +

      +
      • +
    • +

      +133:59 (dce_smb) SMB - Next command specified in SMB2 header is beyond payload boundary +

      +
      • +
    • +

      134:1 (latency) rule tree suspended due to latency

      • @@ -27489,6 +28501,11 @@ deleted -> unified2: 'filename'

    • +ciscometadata (codec): support for cisco metadata +

      +
      • +
    • +

      classifications (basic): define rule categories with priority

      • @@ -27539,6 +28556,11 @@ deleted -> unified2: 'filename'

    • +dce_udp (inspector): dce over udp inspection +

      +
      • +
    • +

      decode (basic): general decoder rules

      • @@ -28284,6 +29306,11 @@ deleted -> unified2: 'filename'

    • +tcp_connector (connector): implement the tcp stream connector +

      +
      • +
    • +

      telnet (inspector): telnet inspection and normalization

      • @@ -28339,6 +29366,11 @@ deleted -> unified2: 'filename'

    • +codec::ciscometadata: support for cisco metadata +

      +
      • +
    • +

      codec::erspan2: support for encapsulated remote switched port analyzer - type 2

      • @@ -28514,6 +29546,11 @@ deleted -> unified2: 'filename'

    • +connector::tcp_connector: implement the tcp stream connector +

      +
      • +
    • +

      inspector::appid: application and service identification

      • @@ -28544,6 +29581,11 @@ deleted -> unified2: 'filename'

    • +inspector::dce_udp: dce over udp inspection +

      +
      • +
    • +

      inspector::dnp3: dnp3 inspection

      • @@ -29296,7 +30338,7 @@ deleted -> unified2: 'filename'
      diff --git a/doc/snort_manual.pdf b/doc/snort_manual.pdf index 1d96d7232..2270fa130 100644 Binary files a/doc/snort_manual.pdf and b/doc/snort_manual.pdf differ diff --git a/doc/snort_manual.text b/doc/snort_manual.text index c2a88e45f..a062539c6 100644 --- a/doc/snort_manual.text +++ b/doc/snort_manual.text @@ -320,7 +320,7 @@ Table of Contents Snorty ,,_ -*> Snort++ <*- -o" )~ Version 3.0.0-a4 (Build 213) from 2.9.7-262 +o" )~ Version 3.0.0-a4 (Build 217) from 2.9.7-262 '''' By Martin Roesch & The Snort Team http://snort.org/contact#team Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. @@ -1344,7 +1344,7 @@ Configuration: Peg counts: * detection.analyzed: packets sent to detection - * detection.slow searches: non-fast pattern rule evaluations + * detection.hard evals: non-fast pattern rule evaluations * detection.raw searches: fast pattern searches in raw packet data * detection.cooked searches: fast pattern searches in cooked packet data @@ -1598,9 +1598,8 @@ Configuration: thresholding (usec) { 0: } * bool latency.packet.fastpath = false: fastpath expensive packets (max_time exceeded) - * enum latency.packet.action = alert_and_log: event action if - packet times out and is fastpathed { none | alert | log | - alert_and_log } + * enum latency.packet.action = none: event action if packet times + out and is fastpathed { none | alert | log | alert_and_log } * int latency.rule.max_time = 500: set timeout for rule evaluation (usec) { 0: } * bool latency.rule.suspend = false: temporarily suspend expensive @@ -1609,9 +1608,8 @@ Configuration: of timeouts before suspending a rule { 1: } * int latency.rule.max_suspend_time = 30000: set max time for suspending a rule (ms, 0 means permanently disable rule) { 0: } - * enum latency.rule.action = alert_and_log: event action for rule - latency enable and suspend events { none | alert | log | - alert_and_log } + * enum latency.rule.action = none: event action for rule latency + enable and suspend events { none | alert | log | alert_and_log } Rules: @@ -1811,9 +1809,8 @@ Configuration: * int rate_filter[].count = 1: number of events in interval before tripping { 0: } * int rate_filter[].seconds = 1: count interval { 0: } - * select rate_filter[].new_action = alert: take this action on - future hits until timeout { alert | drop | log | pass | | reject - | sdrop } + * enum rate_filter[].new_action = alert: take this action on future + hits until timeout { log | pass | alert | drop | block | reset } * int rate_filter[].timeout = 1: count interval { 0: } * string rate_filter[].apply_to: restrict filter to these addresses according to track @@ -1874,8 +1871,6 @@ Configuration: prints uncompiled rule group information * bool search_engine.debug_print_rule_groups_compiled = false: prints compiled rule group information - * bool search_engine.debug_print_fast_pattern = false: print fast - pattern info for each rule * int search_engine.max_pattern_len = 0: truncate patterns when compiling into state machine (0 means no maximum) { 0: } * int search_engine.max_queue_events = 5: maximum number of @@ -1886,10 +1881,12 @@ Configuration: * dynamic search_engine.search_method = ac_bnfa: set fast pattern algorithm - choose available search engine { ac_banded | ac_bnfa | ac_full | ac_sparse | ac_sparse_bands | ac_std | hyperscan } - * bool search_engine.split_any_any = false: evaluate any-any rules - separately to save memory * bool search_engine.search_optimize = true: tweak state machine construction for better performance + * bool search_engine.show_fast_patterns = false: print fast pattern + info for each rule + * bool search_engine.split_any_any = false: evaluate any-any rules + separately to save memory Peg counts: @@ -2659,8 +2656,7 @@ Configuration: * string appid.conf: RNA configuration file * int appid.memcap = 268435456: time period for collecting and logging AppId statistics { 1048576:3221225472 } - * string appid.app_stats_filename: Filename for logging AppId - statistics + * bool appid.log_stats = false: enable logging of AppId statistics * int appid.app_stats_period = 300: time period for collecting and logging AppId statistics { 0: } * int appid.app_stats_rollover_size = 20971520: max file size for @@ -2676,6 +2672,15 @@ Configuration: information * string appid.thirdparty_appid_dir: directory to load thirdparty AppId detectors from + * addr appid.session_log_filter.src_ip = 0.0.0.0/32: source ip + address in CIDR format + * addr appid.session_log_filter.dst_ip = 0.0.0.0/32: destination ip + address in CIDR format + * port appid.session_log_filter.src_port: source port { 1: } + * port appid.session_log_filter.dst_port: destination port { 1: } + * string appid.session_log_filter.protocol: ip protocol + * bool appid.session_log_filter.log_all_sessions = false: enable + logging for all appid sessions Peg counts: @@ -2684,6 +2689,7 @@ Peg counts: inspector * appid.ignored packets: count of packets ignored by appid inspector + * appid.aim_clients: count of aim clients discovered by appid * appid.battlefield_flows: count of battle field flows discovered by appid * appid.bgp_flows: count of bgp flows discovered by appid @@ -2692,16 +2698,20 @@ Peg counts: * appid.bit_flows: count of bittorrent flows discovered by appid * appid.bittracker_clients: count of bittorrent tracker clients discovered by appid + * appid.bootp_flows: count of bootp flows discovered by appid * appid.dcerpc_tcp_flows: count of dce rpc flows over tcp discovered by appid * appid.dcerpc_udp_flows: count of dce rpc flows over udp discovered by appid + * appid.direct_connect_flows: count of direct connect flows + discovered by appid * appid.dns_tcp_flows: count of dns flows over tcp discovered by appid * appid.dns_udp_flows: count of dns flows over udp discovered by appid * appid.ftp_flows: count of ftp flows discovered by appid * appid.ftps_flows: count of ftps flows discovered by appid + * appid.http_flows: count of http flows discovered by appid * appid.imap_flows: count of imap service flows discovered by appid * appid.imaps_flows: count of imap TLS service flows discovered by appid @@ -2713,13 +2723,30 @@ Peg counts: * appid.kerberos_users: count of kerberos users discovered by appid * appid.lpr_flows: count of lpr service flows discovered by appid * appid.mdns_flows: count of mdns service flows discovered by appid + * appid.msn_clients: count of msn clients discovered by appid * appid.mysql_flows: count of mysql service flows discovered by appid - * appid.netbios_flows: count of netbios service flows discovered by - appid + * appid.netbios_dgm_flows: count of netbios-dgm service flows + discovered by appid + * appid.netbios_ns_flows: count of netbios-ns service flows + discovered by appid + * appid.netbios_ssn_flows: count of netbios-ssn service flows + discovered by appid + * appid.nntp_flows: count of nntp flows discovered by appid + * appid.ntp_flows: count of ntp flows discovered by appid * appid.pop_flows: count of pop service flows discovered by appid + * appid.radius_flows: count of radius flows discovered by appid + * appid.rexec_flows: count of rexec flows discovered by appid + * appid.rfb_flows: count of rfb flows discovered by appid + * appid.rlogin_flows: count of rlogin flows discovered by appid + * appid.rpc_flows: count of rpc flows discovered by appid + * appid.rshell_flows: count of rshell flows discovered by appid * appid.rsync_flows: count of rsync service flows discovered by appid + * appid.rtmp_flows: count of rtmp flows discovered by appid + * appid.rtp_clients: count of rtp clients discovered by appid + * appid.sip_clients: count of SIP clients discovered by appid + * appid.sip_flows: count of SIP flows discovered by appid * appid.smtp_aol_clients: count of AOL smtp clients discovered by appid * appid.smtp_applemail_clients: count of Apple Mail smtp clients @@ -2746,11 +2773,18 @@ Peg counts: discovered by appid * appid.smtp_flows: count of smtp flows discovered by appid * appid.smtps_flows: count of smtps flows discovered by appid + * appid.snmp_flows: count of snmp flows discovered by appid * appid.ssh_clients: count of ssh clients discovered by appid * appid.ssh_flows: count of ssh flows discovered by appid * appid.ssl_flows: count of ssl flows discovered by appid * appid.telnet_flows: count of telnet flows discovered by appid + * appid.tftp_flows: count of tftp flows discovered by appid * appid.timbuktu_flows: count of timbuktu flows discovered by appid + * appid.tns_clients: count of tns clients discovered by appid + * appid.tns_flows: count of tns flows discovered by appid + * appid.vnc_clients: count of vnc clients discovered by appid + * appid.yahoo_messenger_clients: count of Yahoo Messenger clients + discovered by appid 5.2. arp_spoof @@ -3297,6 +3331,8 @@ Configuration: commands * string ftp_server.data_chan_cmds: check the formatting of the given commands + * string ftp_server.data_rest_cmds: check the formatting of the + given commands * string ftp_server.data_xfer_cmds: check the formatting of the given commands * string ftp_server.directory_cmds[].dir_cmd: directory command @@ -3514,6 +3550,7 @@ Rules: URI * 119:64 (http_inspect) HTTP chunk misformatted * 119:65 (http_inspect) White space following chunk length + * 119:66 (http_inspect) White space within header name * 119:67 (http_inspect) Excessive gzip compression * 119:68 (http_inspect) Gzip decompression failed * 119:69 (http_inspect) HTTP 0.9 requested followed by another @@ -4423,6 +4460,7 @@ Configuration: | linux | bsd | bsd_right | last | windows | solaris } * int stream_ip.session_timeout = 30: session tracking timeout { 1:86400 } + * int stream_ip.trace: mask for enabling debug traces in module Rules: @@ -8266,9 +8304,11 @@ with. * Use FIXIT (not FIXTHIS or TODO or whatever) to mark things left for a day or even just a minute. That way we can find them easily and won’t lose track of them. - * Presently using FIXIT-X where X = P | H | M | L, indicating perf, - high, med, or low priority. For now, H, M, or L can indicate - alpha 1, 2, or 3. Perf changes fall between alpha 1 and 2. + * Presently using FIXIT-X where X = A | W | P | H | M | L, + indicating analysis, warning, perf, high, med, or low priority. + Place A and W comments on the exact warning line so we can match + up comments and build output. Supporting comments can be added + above. * Put the copyright(s) and license in a comment block at the top of each source file (.h and .cc). Don’t bother with trivial scripts and make foo. Some interesting Lua code should get a comment @@ -8285,7 +8325,7 @@ with. // based on work by Ryan Jordan * Each header should have a comment immediately after the header - guard to give an overview of the file so the user knows what’s + guard to give an overview of the file so the reader knows what’s going on. @@ -9211,8 +9251,6 @@ Some additional details to note: cons | ndelay | perror | pid } * string appid.app_detector_dir: directory to load AppId detectors from - * string appid.app_stats_filename: Filename for logging AppId - statistics * int appid.app_stats_period = 300: time period for collecting and logging AppId statistics { 0: } * int appid.app_stats_rollover_size = 20971520: max file size for @@ -9225,9 +9263,19 @@ Some additional details to note: information * int appid.instance_id = 0: instance id - need more details for what this is { 0: } + * bool appid.log_stats = false: enable logging of AppId statistics * int appid.memcap = 268435456: time period for collecting and logging AppId statistics { 1048576:3221225472 } * string appids.~: appid option + * addr appid.session_log_filter.dst_ip = 0.0.0.0/32: destination ip + address in CIDR format + * port appid.session_log_filter.dst_port: destination port { 1: } + * bool appid.session_log_filter.log_all_sessions = false: enable + logging for all appid sessions + * string appid.session_log_filter.protocol: ip protocol + * addr appid.session_log_filter.src_ip = 0.0.0.0/32: source ip + address in CIDR format + * port appid.session_log_filter.src_port: source port { 1: } * string appid.thirdparty_appid_dir: directory to load thirdparty AppId detectors from * ip4 arp_spoof.hosts[].ip: host ip address @@ -9545,6 +9593,8 @@ Some additional details to note: maximum for command { 0: } * string ftp_server.data_chan_cmds: check the formatting of the given commands + * string ftp_server.data_rest_cmds: check the formatting of the + given commands * string ftp_server.data_xfer_cmds: check the formatting of the given commands * int ftp_server.def_max_param_len = 100: default maximum length of @@ -9781,16 +9831,14 @@ Some additional details to note: buffer * string itype.~range: check if icmp type is type | min<>max | min - * enum latency.packet.action = alert_and_log: event action if - packet times out and is fastpathed { none | alert | log | - alert_and_log } + * enum latency.packet.action = none: event action if packet times + out and is fastpathed { none | alert | log | alert_and_log } * bool latency.packet.fastpath = false: fastpath expensive packets (max_time exceeded) * int latency.packet.max_time = 500: set timeout for packet latency thresholding (usec) { 0: } - * enum latency.rule.action = alert_and_log: event action for rule - latency enable and suspend events { none | alert | log | - alert_and_log } + * enum latency.rule.action = none: event action for rule latency + enable and suspend events { none | alert | log | alert_and_log } * int latency.rule.max_suspend_time = 30000: set max time for suspending a rule (ms, 0 means permanently disable rule) { 0: } * int latency.rule.max_time = 500: set timeout for rule evaluation @@ -10022,9 +10070,8 @@ Some additional details to note: * int rate_filter[].count = 1: number of events in interval before tripping { 0: } * int rate_filter[].gid = 1: rule generator ID { 0: } - * select rate_filter[].new_action = alert: take this action on - future hits until timeout { alert | drop | log | pass | | reject - | sdrop } + * enum rate_filter[].new_action = alert: take this action on future + hits until timeout { log | pass | alert | drop | block | reset } * int rate_filter[].seconds = 1: count interval { 0: } * int rate_filter[].sid = 1: rule signature ID { 0: } * int rate_filter[].timeout = 1: count interval { 0: } @@ -10078,8 +10125,6 @@ Some additional details to note: * bool search_engine.bleedover_warnings_enabled = false: print warning if a rule is demoted to any-any port group * bool search_engine.debug = false: print verbose fast pattern info - * bool search_engine.debug_print_fast_pattern = false: print fast - pattern info for each rule * bool search_engine.debug_print_nocontent_rule_tests = false: print rule group info during packet evaluation * bool search_engine.debug_print_rule_group_build_details = false: @@ -10102,6 +10147,8 @@ Some additional details to note: | ac_full | ac_sparse | ac_sparse_bands | ac_std | hyperscan } * bool search_engine.search_optimize = true: tweak state machine construction for better performance + * bool search_engine.show_fast_patterns = false: print fast pattern + info for each rule * bool search_engine.split_any_any = false: evaluate any-any rules separately to save memory * string seq.~range: check if tcp sequence number value is value | @@ -10452,6 +10499,7 @@ Some additional details to note: | linux | bsd | bsd_right | last | windows | solaris } * int stream_ip.session_timeout = 30: session tracking timeout { 1:86400 } + * int stream_ip.trace: mask for enabling debug traces in module * enum stream_reassemble.action: stop or start stream reassembly { disable|enable } * enum stream_reassemble.direction: action applies to the given @@ -10580,6 +10628,7 @@ Some additional details to note: -------------- + * appid.aim_clients: count of aim clients discovered by appid * appid.battlefield_flows: count of battle field flows discovered by appid * appid.bgp_flows: count of bgp flows discovered by appid @@ -10588,16 +10637,20 @@ Some additional details to note: * appid.bit_flows: count of bittorrent flows discovered by appid * appid.bittracker_clients: count of bittorrent tracker clients discovered by appid + * appid.bootp_flows: count of bootp flows discovered by appid * appid.dcerpc_tcp_flows: count of dce rpc flows over tcp discovered by appid * appid.dcerpc_udp_flows: count of dce rpc flows over udp discovered by appid + * appid.direct_connect_flows: count of direct connect flows + discovered by appid * appid.dns_tcp_flows: count of dns flows over tcp discovered by appid * appid.dns_udp_flows: count of dns flows over udp discovered by appid * appid.ftp_flows: count of ftp flows discovered by appid * appid.ftps_flows: count of ftps flows discovered by appid + * appid.http_flows: count of http flows discovered by appid * appid.ignored packets: count of packets ignored by appid inspector * appid.imap_flows: count of imap service flows discovered by appid @@ -10611,16 +10664,33 @@ Some additional details to note: * appid.kerberos_users: count of kerberos users discovered by appid * appid.lpr_flows: count of lpr service flows discovered by appid * appid.mdns_flows: count of mdns service flows discovered by appid + * appid.msn_clients: count of msn clients discovered by appid * appid.mysql_flows: count of mysql service flows discovered by appid - * appid.netbios_flows: count of netbios service flows discovered by - appid + * appid.netbios_dgm_flows: count of netbios-dgm service flows + discovered by appid + * appid.netbios_ns_flows: count of netbios-ns service flows + discovered by appid + * appid.netbios_ssn_flows: count of netbios-ssn service flows + discovered by appid + * appid.nntp_flows: count of nntp flows discovered by appid + * appid.ntp_flows: count of ntp flows discovered by appid * appid.packets: count of packets received by appid inspector * appid.pop_flows: count of pop service flows discovered by appid * appid.processed packets: count of packets processed by appid inspector + * appid.radius_flows: count of radius flows discovered by appid + * appid.rexec_flows: count of rexec flows discovered by appid + * appid.rfb_flows: count of rfb flows discovered by appid + * appid.rlogin_flows: count of rlogin flows discovered by appid + * appid.rpc_flows: count of rpc flows discovered by appid + * appid.rshell_flows: count of rshell flows discovered by appid * appid.rsync_flows: count of rsync service flows discovered by appid + * appid.rtmp_flows: count of rtmp flows discovered by appid + * appid.rtp_clients: count of rtp clients discovered by appid + * appid.sip_clients: count of SIP clients discovered by appid + * appid.sip_flows: count of SIP flows discovered by appid * appid.smtp_aol_clients: count of AOL smtp clients discovered by appid * appid.smtp_applemail_clients: count of Apple Mail smtp clients @@ -10647,11 +10717,18 @@ Some additional details to note: * appid.smtps_flows: count of smtps flows discovered by appid * appid.smtp_thunderbird_clients: count of Thunderbird smtp clients discovered by appid + * appid.snmp_flows: count of snmp flows discovered by appid * appid.ssh_clients: count of ssh clients discovered by appid * appid.ssh_flows: count of ssh flows discovered by appid * appid.ssl_flows: count of ssl flows discovered by appid * appid.telnet_flows: count of telnet flows discovered by appid + * appid.tftp_flows: count of tftp flows discovered by appid * appid.timbuktu_flows: count of timbuktu flows discovered by appid + * appid.tns_clients: count of tns clients discovered by appid + * appid.tns_flows: count of tns flows discovered by appid + * appid.vnc_clients: count of vnc clients discovered by appid + * appid.yahoo_messenger_clients: count of Yahoo Messenger clients + discovered by appid * arp_spoof.packets: total packets * back_orifice.packets: total packets * binder.allows: allow bindings @@ -10819,6 +10896,7 @@ Some additional details to note: data * detection.event limit: events filtered * detection.file searches: fast pattern searches in file buffer + * detection.hard evals: non-fast pattern rule evaluations * detection.header searches: fast pattern searches in header buffer * detection.key searches: fast pattern searches in key buffer * detection.logged: logged packets @@ -10828,7 +10906,6 @@ Some additional details to note: * detection.pkt searches: fast pattern searches in packet data * detection.queue limit: events not queued because queue full * detection.raw searches: fast pattern searches in raw packet data - * detection.slow searches: non-fast pattern rule evaluations * detection.total alerts: alerts including IP reputation * dnp3.dnp3 application pdus: total dnp3 application pdus * dnp3.dnp3 link layer frames: total dnp3 link layer frames @@ -11544,6 +11621,7 @@ Some additional details to note: URI * 119:64 (http_inspect) HTTP chunk misformatted * 119:65 (http_inspect) White space following chunk length + * 119:66 (http_inspect) White space within header name * 119:67 (http_inspect) Excessive gzip compression * 119:68 (http_inspect) Gzip decompression failed * 119:69 (http_inspect) HTTP 0.9 requested followed by another diff --git a/src/main/build.h b/src/main/build.h index b7e9e6259..58dcdf52c 100644 --- a/src/main/build.h +++ b/src/main/build.h @@ -10,7 +10,7 @@ // // //-----------------------------------------------// -#define BUILD "217" +#define BUILD "218" #endif diff --git a/src/network_inspectors/appid/lua_detector_module.cc b/src/network_inspectors/appid/lua_detector_module.cc index 75e51795b..c2ec8af3f 100644 --- a/src/network_inspectors/appid/lua_detector_module.cc +++ b/src/network_inspectors/appid/lua_detector_module.cc @@ -25,6 +25,7 @@ #include #include +#include #include #include "appid_config.h" @@ -400,7 +401,7 @@ static Detector* create_lua_detector(lua_State* L, const char* detectorName, App return detector; } -void LuaDetectorManager::load_detector( const char* detector_filename, bool isCustom) +void LuaDetectorManager::load_detector(char* detector_filename, bool isCustom) { char detectorName[MAX_LUA_DETECTOR_FILENAME_LEN]; diff --git a/src/network_inspectors/appid/lua_detector_module.h b/src/network_inspectors/appid/lua_detector_module.h index 4bb72a531..02c1c4f07 100644 --- a/src/network_inspectors/appid/lua_detector_module.h +++ b/src/network_inspectors/appid/lua_detector_module.h @@ -47,7 +47,7 @@ private: void list_lua_detectors(); void init_lua_service_detectors(); void init_lua_client_detectors(); - void load_detector(const char* detectorName, bool isCustom); + void load_detector(char* detectorName, bool isCustom); void load_lua_detectors(const char* path, bool isCustom); AppIdConfig& config;