2.5. Help
2.6. Common Errors
2.7. Gotchas
+ 2.8. Bugs
3. Basic Modules
4.17. pgm
4.18. pppoe
4.19. tcp
- 4.20. udp
- 4.21. vlan
- 4.22. wlan
-
-5. Data Modules
-6. Inspector Modules
-
- 6.1. arp_spoof
- 6.2. back_orifice
- 6.3. binder
- 6.4. dns
- 6.5. ftp_client
- 6.6. ftp_data
- 6.7. ftp_server
- 6.8. http_global
- 6.9. http_inspect
- 6.10. imap
- 6.11. new_http_inspect
- 6.12. normalizer
- 6.13. perf_monitor
- 6.14. pop
- 6.15. port_scan
- 6.16. port_scan_global
- 6.17. rpc_decode
- 6.18. ssh
- 6.19. stream
- 6.20. stream_icmp
- 6.21. stream_ip
- 6.22. stream_tcp
- 6.23. stream_udp
- 6.24. telnet
- 6.25. wizard
-
-7. IPS Action Modules
-
- 7.1. react
- 7.2. reject
- 7.3. rewrite
-
-8. IPS Option Modules
-
- 8.1. ack
- 8.2. asn1
- 8.3. base64_decode
- 8.4. bufferlen
- 8.5. byte_extract
- 8.6. byte_jump
- 8.7. byte_test
- 8.8. classtype
- 8.9. content
- 8.10. cvs
- 8.11. detection_filter
- 8.12. dsize
- 8.13. file_data
- 8.14. flags
- 8.15. flow
- 8.16. flowbits
- 8.17. fragbits
- 8.18. fragoffset
- 8.19. gid
- 8.20. http_client_body
- 8.21. http_cookie
- 8.22. http_header
- 8.23. http_method
- 8.24. http_raw_cookie
- 8.25. http_raw_header
- 8.26. http_raw_uri
- 8.27. http_stat_code
- 8.28. http_stat_msg
- 8.29. http_uri
- 8.30. icmp_id
- 8.31. icmp_seq
- 8.32. icode
- 8.33. id
- 8.34. ip_proto
- 8.35. ipopts
- 8.36. isdataat
- 8.37. itype
- 8.38. md5
- 8.39. metadata
- 8.40. msg
- 8.41. pcre
- 8.42. pkt_data
- 8.43. priority
- 8.44. raw_data
- 8.45. reference
- 8.46. rem
- 8.47. replace
- 8.48. rev
- 8.49. rpc
- 8.50. seq
- 8.51. session
- 8.52. sha256
- 8.53. sha512
- 8.54. sid
- 8.55. so
- 8.56. soid
- 8.57. stream_reassemble
- 8.58. stream_size
- 8.59. tag
- 8.60. tos
- 8.61. ttl
- 8.62. window
-
-9. Search Engine Modules
-10. SO Rule Modules
-11. Logger Modules
-
- 11.1. alert_csv
- 11.2. alert_fast
- 11.3. alert_full
- 11.4. alert_syslog
- 11.5. alert_test
- 11.6. alert_unixsock
- 11.7. log_codecs
- 11.8. log_pcap
- 11.9. unified2
+ 4.20. token_ring
+ 4.21. udp
+ 4.22. vlan
+ 4.23. wlan
+
+5. Inspector Modules
+
+ 5.1. arp_spoof
+ 5.2. back_orifice
+ 5.3. binder
+ 5.4. data_log
+ 5.5. dns
+ 5.6. dpx
+ 5.7. ftp_client
+ 5.8. ftp_data
+ 5.9. ftp_server
+ 5.10. http_global
+ 5.11. http_inspect
+ 5.12. imap
+ 5.13. new_http_inspect
+ 5.14. normalizer
+ 5.15. perf_monitor
+ 5.16. pop
+ 5.17. port_scan
+ 5.18. port_scan_global
+ 5.19. rpc_decode
+ 5.20. sip
+ 5.21. smtp
+ 5.22. ssh
+ 5.23. ssl
+ 5.24. stream
+ 5.25. stream_file
+ 5.26. stream_icmp
+ 5.27. stream_ip
+ 5.28. stream_tcp
+ 5.29. stream_udp
+ 5.30. stream_user
+ 5.31. telnet
+ 5.32. wizard
+
+6. IPS Action Modules
+
+ 6.1. react
+ 6.2. reject
+ 6.3. rewrite
+
+7. IPS Option Modules
+
+ 7.1. ack
+ 7.2. asn1
+ 7.3. base64_decode
+ 7.4. bufferlen
+ 7.5. byte_extract
+ 7.6. byte_jump
+ 7.7. byte_test
+ 7.8. classtype
+ 7.9. content
+ 7.10. cvs
+ 7.11. detection_filter
+ 7.12. dsize
+ 7.13. file_data
+ 7.14. flags
+ 7.15. flow
+ 7.16. flowbits
+ 7.17. fragbits
+ 7.18. fragoffset
+ 7.19. gid
+ 7.20. http_client_body
+ 7.21. http_cookie
+ 7.22. http_header
+ 7.23. http_method
+ 7.24. http_raw_cookie
+ 7.25. http_raw_header
+ 7.26. http_raw_uri
+ 7.27. http_stat_code
+ 7.28. http_stat_msg
+ 7.29. http_uri
+ 7.30. icmp_id
+ 7.31. icmp_seq
+ 7.32. icode
+ 7.33. id
+ 7.34. ip_proto
+ 7.35. ipopts
+ 7.36. isdataat
+ 7.37. itype
+ 7.38. md5
+ 7.39. metadata
+ 7.40. msg
+ 7.41. pcre
+ 7.42. pkt_data
+ 7.43. priority
+ 7.44. raw_data
+ 7.45. reference
+ 7.46. rem
+ 7.47. replace
+ 7.48. rev
+ 7.49. rpc
+ 7.50. seq
+ 7.51. session
+ 7.52. sha256
+ 7.53. sha512
+ 7.54. sid
+ 7.55. sip_body
+ 7.56. sip_header
+ 7.57. sip_method
+ 7.58. sip_stat_code
+ 7.59. so
+ 7.60. soid
+ 7.61. ssl_state
+ 7.62. ssl_version
+ 7.63. stream_reassemble
+ 7.64. stream_size
+ 7.65. tag
+ 7.66. tos
+ 7.67. ttl
+ 7.68. urg
+ 7.69. window
+
+8. Search Engine Modules
+9. SO Rule Modules
+10. Logger Modules
+
+ 10.1. alert_csv
+ 10.2. alert_ex
+ 10.3. alert_fast
+ 10.4. alert_full
+ 10.5. alert_syslog
+ 10.6. alert_unixsock
+ 10.7. log_codecs
+ 10.8. log_hext
+ 10.9. log_pcap
+ 10.10. unified2
+
+11. DAQ Modules
+
+ 11.1. Building the DAQ Library and DAQ Modules
+ 11.2. PCAP Module
+ 11.3. AFPACKET Module
+ 11.4. NFQ Module
+ 11.5. IPQ Module
+ 11.6. IPFW Module
+ 11.7. Dump Module
+ 11.8. Netmap Module
+ 11.9. Notes on iptables
+ 11.10. Notes on FreeBSD::IPFW
+ 11.11. Notes on OpenBSD::IPFW
+ 11.12. Socket Module
+ 11.13. File Module
+ 11.14. Hext Module
12. Snort++ vs Snort
13.2. Known Problems
13.3. Usage
-14. Reference
-
- 14.1. Terminology
- 14.2. Usage
- 14.3. Plugins
- 14.4. Output Files
- 14.5. Optional Features
- 14.6. Environment Variables
- 14.7. Command Line Options
- 14.8. Parameters
- 14.9. Configuration
- 14.10. Counts
- 14.11. Generators
- 14.12. Builtin Rules
- 14.13. Command Set
- 14.14. Signals
- 14.15. Configuration Changes
- 14.16. Module Listing
- 14.17. Extending Snort++
+14. Extending Snort++
+
+ 14.1. Plugins
+ 14.2. Modules
+ 14.3. Inspectors
+ 14.4. Codecs
+ 14.5. IPS Actions
+
+15. Coding Style
+
+ 15.1. General
+ 15.2. Naming
+ 15.3. Comments
+ 15.4. Logging
+ 15.5. Types
+ 15.6. Macros (aka defines)
+ 15.7. Formatting
+ 15.8. Headers
+ 15.9. Warnings
+ 15.10. Other
+ 15.11. Uncrustify
+
+16. Reference
+
+ 16.1. Terminology
+ 16.2. Usage
+ 16.3. Plugins
+ 16.4. Output Files
+ 16.5. Optional Features
+ 16.6. Environment Variables
+ 16.7. Command Line Options
+ 16.8. Parameters
+ 16.9. Configuration
+ 16.10. Counts
+ 16.11. Generators
+ 16.12. Builtin Rules
+ 16.13. Command Set
+ 16.14. Signals
+ 16.15. Configuration Changes
+ 16.16. Module Listing
Snorty
,,_ -*> Snort++ <*-
-o" )~ Version 3.0.0-a1 (Build 150) from 2.9.7-177
+o" )~ Version 3.0.0-a1 (Build 160) from 2.9.7-177
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved.
remains a peripheral feature and still requires the production of
data that may not be consumed.
-The basic processing steps Snort takes are similar to Snort’s as seen
-in the following diagram. The preprocess step employs specific
+The basic processing steps Snort++ takes are similar to Snort’s as
+seen in the following diagram. The preprocess step employs specific
inspector types instead of a generalized list, but the basic
procedure includes stateless packet decoding, TCP stream reassembly,
-and service specific analysis in both cases. (Snort provides hooks
+and service specific analysis in both cases. (Snort++ provides hooks
for arbitrary inspectors, but they are not central to basic flow
processing and are not shown.)
Inspection events coupled with pluggable inspectors provide a very
flexible framework for implementing new features. And JIT buffer
-stuffers allow Snort to work smarter, not harder. These capabilities
-will be leveraged more and more as Snort development continues.
+stuffers allow Snort++ to work smarter, not harder. These
+capabilities will be leveraged more and more as Snort++ development
+continues.
---------------------------------------------------------------------
* asciidoc from http://www.methods.co.nz/asciidoc/ to build the
HTML manual
+ * check from http://check.sourceforge.net to build unit tests
* dblatex from http://dblatex.sourceforge.net to build the pdf
manual (in addition to asciidoc)
+ * lzma from http://www.7-zip.org/sdk.html for decompression of SWF
+ fles.
+ * openssl from https://www.openssl.org for SHA and MD5 file
+ signatures and the protected_content rule option.
* w3m from http://sourceforge.net/projects/w3m/ to build the plain
text manual
- * check from http://check.sourceforge.net to build unit tests
2.2. Building
ccmake -G "Eclipse CDT4 - Unix Makefiles" /path/to/Snort++/tree
run eclipse and do File > Import > Existing Eclipse Project
+ * To build with clang++ on OS X with gcc installed, do this first:
+
+ export CXX=clang++
+
2.3. Run
EXTERNAL_NET = '!' .. MY_SERVERS
+2.8. Bugs
+
+------------
+
+2.8.1. Build
+
+ * configure bombs on OSX with g++ wrapper to clang because g
+ version < 4.8 (compare g\ -dumpversion and g++ --version)
+
+ workaround: export CXX=clang++
+
+ * export CXX=clang++ to build with clang; coughs up these warnings:
+
+ Wunused-but-set-variable is not understood by clang
+ clang: warning: argument unused during compilation: '-pthread'
+
+ * Cmake doc/ has a problem when SNORT_PLUGIN_PATH is set to get
+ extras included in the manual.
+ * Making in doc/ may fail complaining something about xmllint. Just
+ make again and it will succeed. Appears to be an unknown
+ dependency but it works for me!
+
+2.8.2. Config
+
+ * Parsing issue with IP lists. can’t parse rules with $EXTERNAL_NET
+ defined as below because or the space between ! and 10.
+
+ HOME_NET = [[ 10.0.17.0/24 10.0.14.0/24 10.247.0.0/16 10.246.0.0/16 ]]
+ EXTERNAL_NET = '! ' .. HOME_NET
+
+ * Multiple versions of luajit scripts are not handled correctly.
+ The first loaded version will always be executed even though
+ plugin manager saves the correct version.
+
+2.8.3. Rules
+
+ * metdata:service foo; metadata:service foo; won’t cause a
+ duplicate service warning as does metadata:service foo, service
+ foo;
+ * ip_proto doesn’t work properly with reassembled packets so it
+ can’t be used to restrict the protocol of service rules.
+
+2.8.4. snort2lua
+
+ * uricontent:"foo"; content:"bar"; → http_uri; content:"foo";
+ content:"bar"; (missing pkt_data)
+ * stream_tcp ports and protocols both go into a single binder.when;
+ this is incorrect as the when fields are logically anded together
+ (ie must all be true). should create 2 separate bindings.
+ * There is a bug in pps_stream_tcp.cc.. when stream_tcp: is
+ specified without any arguments, snort2lua doesn’t convert it
+ * Loses the ip list delimiters [ ]; change to ( )
+
+ in snort.conf: var HOME_NET [A,B,C]
+ in snort.lua: HOME_NET = [[A B C]]
+
+ * Won’t convert packet rules (alert tcp etc.) to service rules
+ (alert http etc.).
+
+
---------------------------------------------------------------------
3. Basic Modules
memory for filters { 0: }
* int alerts.event_filter_memcap = 1048576: set available memory
for filters { 0: }
- * int alerts.flowbits_size = 1024: maximum number of allowed unique
- flowbits { 0:2048 }
* string alerts.order = pass drop alert log: change the order of
rule action application
* int alerts.rate_filter_memcap = 1048576: set available memory for
Peg counts:
- * daq.pcaps: total files processed
+ * daq.pcaps: total files and interfaces processed
* daq.received: total packets received from DAQ
* daq.analyzed: total packets analyzed from DAQ
* daq.dropped: packets dropped
Peg counts:
* detection.analyzed: packets sent to detection
+ * detection.slow searches: non-fast pattern rule evaluations
+ * detection.raw searches: fast pattern searches in raw packet data
+ * detection.cooked searches: fast pattern searches in cooked packet
+ data
+ * detection.pkt searches: fast pattern searches in packet data
+ * detection.alt searches: alt fast pattern searches in packet data
+ * detection.key searches: fast pattern searches in key buffer
+ * detection.header searches: fast pattern searches in header buffer
+ * detection.body searches: fast pattern searches in body buffer
+ * detection.file searches: fast pattern searches in file buffer
* detection.alerts: alerts not including IP reputation
* detection.total alerts: alerts including IP reputation
* detection.logged: logged packets
* string file_id.file_rules[].magic[].content: file magic content
* int file_id.file_rules[].magic[].offset = 0: file magic offset {
0: }
+ * bool file_id.trace_type = false: enable runtime dump of type info
+ * bool file_id.trace_signature = false: enable runtime dump of
+ signature info
+ * bool file_id.trace_stream = false: enable runtime dump of file
+ data
3.11. hosts
* bool output.quiet = false: suppress non-fatal information (still
show alerts, same as -q)
* string output.logdir = .: where to put log files (same as -l)
- * bool output.nolog = false: turn off logging (alerts still work,
- same as -N)
* bool output.obfuscate = false: obfuscate the logged IP addresses
(same as -O)
* bool output.show_year = false: include year in timestamp in the
compiling into state machine (0 means no maximum) { 0: }
* int search_engine.max_queue_events = 5: maximum number of
matching fast pattern states to queue per packet
- * bool search_engine.no_stream_inserts = false: don’t inspect
- reassembled payload - good for performance, bad for detection
+ * bool search_engine.inspect_stream_inserts = false: inspect
+ reassembled payload - disabling is good for performance, bad for
+ detection
* string search_engine.search_method = ac_bnfa_q: set fast pattern
algorithm - choose available search engine
* bool search_engine.split_any_any = false: evaluate any-any rules
* implied snort.-H: make hash tables deterministic
* string snort.-i: <iface>… list of interfaces
* port snort.-j: <port> to listen for telnet connections
- * select snort.-K = none: <mode> logging mode { none|text|pcap }
* enum snort.-k = all: <mode> checksum mode
(all,noip,notcp,noudp,noicmp,none) { all|noip|notcp|noudp|noicmp|
none }
+ * string snort.-L: <mode> logging mode (none, dump, pcap, or log_*)
* string snort.-l: <logdir> log to this directory instead of
current directory
* implied snort.-M: log messages to syslog (not alerts)
* int snort.-m: <umask> set umask = <umask> { 0: }
- * implied snort.-N: ignored - for REG_TEST only
* int snort.-n: <count> stop after count packets { 0: }
* implied snort.-O: obfuscate the logged IP addresses
* implied snort.-Q: enable inline mode operation
* string snort.-R: <rules> include this rules file in the default
policy
* string snort.-r: <pcap>… (same as --pcap-list)
- * string snort.-S: <n=v> set rules file variable n equal to value v
+ * string snort.-S: <x=v> set config variable x equal to value v
* int snort.-s = 1514: <snap> (same as --snaplen) { 68:65535 }
* implied snort.-T: test and report on the current Snort
configuration
* implied snort.-y: include year in timestamp in the alert and log
files
* int snort.-z = 1: <count> maximum number of packet threads (same
- as --max-packet-threads) 0 gets the number of CPU cores reported
+ as --max-packet-threads); 0 gets the number of CPU cores reported
by the system { 0: }
* implied snort.--alert-before-pass: process alert, drop, sdrop, or
reject before pass; default is pass before alert, drop,…
for multiple snorts (same as -G) { 0:65535 }
* implied snort.--markup: output help in asciidoc compatible format
* int snort.--max-packet-threads = 1: <count> configure maximum
- number of packet threads (same as -z) 0 gets the number of CPU
- cores reported by the system { 0: }
+ number of packet threads (same as -z) { 0: }
* implied snort.--nostamps: don’t include timestamps in log file
names
* implied snort.--nolock-pidfile: do not try to lock Snort PID file
getting pcaps from file or directory
* implied snort.--pcap-reload: if reading multiple pcaps, reload
snort config between pcaps
- * implied snort.--pcap-reset: ignored - for REG_TEST only
* implied snort.--pcap-show: print a line saying what pcap is
currently being read
* implied snort.--pedantic: warnings are fatal
* implied snort.--warn-flowbits: warn about flowbits that are
checked but not set and vice-versa
* implied snort.--warn-hosts: warn about host table issues
+ * implied snort.--warn-plugins: warn about issues that prevent
+ plugins from loading
* implied snort.--warn-rules: warn about duplicate rules and rule
parsing issues
* implied snort.--warn-scripts: warn about issues discovered while
* tcp.bad checksum (ip6): nonzero tcp over ipv6 checksums
-4.20. udp
+4.20. token_ring
+
+------------
+
+What: support for token ring decoding
+
+Type: codec
+
+Rules:
+
+ * 116:140 (token_ring) (token_ring) Bad Token Ring Header
+ * 116:141 (token_ring) (token_ring) Bad Token Ring ETHLLC Header
+ * 116:142 (token_ring) (token_ring) Bad Token Ring MRLENHeader
+ * 116:143 (token_ring) (token_ring) Bad Token Ring MR Header
+
+
+4.21. udp
------------
* udp.bad checksum (ip6): nonzero udp over ipv6 checksums
-4.21. vlan
+4.22. vlan
------------
* 116:132 (vlan) bad extra LLC info
-4.22. wlan
+4.23. wlan
------------
---------------------------------------------------------------------
-5. Data Modules
-
----------------------------------------------------------------------
-
-Data modules are adjunct configurations for use with certain
-inspectors.
-
-no match no match
-
-
----------------------------------------------------------------------
-
-6. Inspector Modules
+5. Inspector Modules
---------------------------------------------------------------------
protocols beyond basic decoding.
-6.1. arp_spoof
+5.1. arp_spoof
------------
* arp_spoof.packets: total packets
-6.2. back_orifice
+5.2. back_orifice
------------
* back_orifice.packets: total packets
-6.3. binder
+5.3. binder
------------
* bit_list binder[].when.vlans: list of VLAN IDs { 4095 }
* addr_list binder[].when.nets: list of networks
* enum binder[].when.proto: protocol { any | ip | icmp | tcp | udp
- }
+ | user | file }
* bit_list binder[].when.ports: list of ports { 65535 }
* enum binder[].when.role = any: use the given configuration on one
or any end of a session { client | server | any }
* string binder[].when.service: override default configuration
* enum binder[].use.action = inspect: what to do with matching
- traffic { block | allow | inspect }
+ traffic { reset | block | allow | inspect }
* string binder[].use.file: use configuration in given file
* string binder[].use.service: override automatic service
identification
Peg counts:
* binder.packets: initial bindings
+ * binder.resets: reset bindings
* binder.blocks: block bindings
* binder.allows: allow bindings
* binder.inspects: inspect bindings
-6.4. dns
+5.4. data_log
+
+------------
+
+What: log selected published data to data.log
+
+Type: inspector
+
+Configuration:
+
+ * string data_log.key = http_uri: name of data buffer to log
+
+Peg counts:
+
+ * data_log.packets: total packets
+
+
+5.5. dns
------------
* dns.packets: total packets
-6.5. ftp_client
+5.6. dpx
+
+------------
+
+What: dynamic inspector example
+
+Type: inspector
+
+Configuration:
+
+ * port dpx.port: port to check
+ * int dpx.max = 0: maximum payload before alert { 0:65535 }
+
+Rules:
+
+ * 256:1 (dpx) too much data sent to port
+
+Peg counts:
+
+ * dpx.packets: total packets
+
+
+5.7. ftp_client
------------
sequences on ftp control channel
-6.6. ftp_data
+5.8. ftp_data
------------
* ftp_data.packets: total packets
-6.7. ftp_server
+5.9. ftp_server
------------
* ftp_server.packets: total packets
-6.8. http_global
+5.10. http_global
------------
* http_global.decompressed bytes: total bytes decompressed
-6.9. http_inspect
+5.11. http_inspect
------------
* 120:17 (http_inspect) HTTP response PDF file parse failure
-6.10. imap
+5.12. imap
------------
* imap.packets: total packets
-6.11. new_http_inspect
+5.13. new_http_inspect
------------
* 219:50 (new_http_inspect) PDF file cascaded compression
* 219:51 (new_http_inspect) PDF file parse failure
* 219:52 (new_http_inspect) HTTP misformatted or not really HTTP
+ * 219:53 (new_http_inspect) Chunk length has excessive leading
+ zeros
+ * 219:54 (new_http_inspect) White space before or between messages
+ * 219:55 (new_http_inspect) Request message without URI
+ * 219:56 (new_http_inspect) Control character in reason phrase
+ * 219:57 (new_http_inspect) Illegal extra whitespace in start line
+ * 219:58 (new_http_inspect) Corrupted HTTP version
+ * 219:59 (new_http_inspect) Unknown HTTP version
+ * 219:60 (new_http_inspect) Format error in HTTP header
+ * 219:61 (new_http_inspect) Chunk header options present
+ * 219:62 (new_http_inspect) URI badly formatted
+ * 219:63 (new_http_inspect) URI bad port number
+ * 219:64 (new_http_inspect) HTTP chunk misformatted
+ * 219:65 (new_http_inspect) White space following chunk length
-6.12. normalizer
+5.14. normalizer
------------
segments
-6.13. perf_monitor
+5.15. perf_monitor
------------
* perf_monitor.packets: total packets
-6.14. pop
+5.16. pop
------------
* pop.packets: total packets
-6.15. port_scan
+5.17. port_scan
------------
* 122:27 (port_scan) open port
-6.16. port_scan_global
+5.18. port_scan_global
------------
* port_scan_global.packets: total packets
-6.17. rpc_decode
+5.19. rpc_decode
------------
* rpc_decode.packets: total packets
-6.18. ssh
+5.20. sip
+
+------------
+
+What: sip inspection
+
+Type: inspector
+
+Configuration:
+
+ * bool sip.ignore_call_channel = false: enables the support for
+ ignoring audio/video data channel
+ * int sip.max_call_id_len = 256: maximum call id field size {
+ 0:65535 }
+ * int sip.max_contact_len = 256: maximum contact field size {
+ 0:65535 }
+ * int sip.max_content_len = 1024: maximum content length of the
+ message body { 0:65535 }
+ * int sip.max_dialogs = 4: maximum number of dialogs within one
+ stream session { 1:4194303 }
+ * int sip.max_from_len = 256: maximum from field size { 0:65535 }
+ * int sip.max_requestName_len = 20: maximum request name field size
+ { 0:65535 }
+ * int sip.max_sessions = 10000: maximum number of sessions that can
+ be allocated { 1024:4194303 }
+ * int sip.max_to_len = 256: maximum to field size { 0:65535 }
+ * int sip.max_uri_len = 256: maximum request uri field size {
+ 0:65535 }
+ * int sip.max_via_len = 1024: maximum via field size { 0:65535 }
+ * string sip.methods = invite cancel ack bye register options: list
+ of methods to check in sip messages
+
+Rules:
+
+ * 140:1 (sip) Maximum sessions reached
+ * 140:2 (sip) Empty request URI
+ * 140:3 (sip) URI is too long
+ * 140:4 (sip) Empty call-Id
+ * 140:5 (sip) Call-Id is too long
+ * 140:6 (sip) CSeq number is too large or negative
+ * 140:7 (sip) Request name in CSeq is too long
+ * 140:8 (sip) Empty From header
+ * 140:9 (sip) From header is too long
+ * 140:10 (sip) Empty To header
+ * 140:11 (sip) To header is too long
+ * 140:12 (sip) Empty Via header
+ * 140:13 (sip) Via header is too long
+ * 140:14 (sip) Empty Contact
+ * 140:15 (sip) Contact is too long
+ * 140:16 (sip) Content length is too large or negative
+ * 140:17 (sip) Multiple SIP messages in a packet
+ * 140:18 (sip) Content length mismatch
+ * 140:19 (sip) Request name is invalid
+ * 140:20 (sip) Invite replay attack
+ * 140:21 (sip) Illegal session information modification
+ * 140:22 (sip) Response status code is not a 3 digit number
+ * 140:23 (sip) Empty Content-type header
+ * 140:24 (sip) SIP version is invalid
+ * 140:25 (sip) Mismatch in METHOD of request and the CSEQ header
+ * 140:26 (sip) Method is unknown
+ * 140:27 (sip) Maximum dialogs within a session reached
+
+Peg counts:
+
+ * sip.sessions: total sessions
+ * sip.events: events generated
+ * sip.dialogs: total dialogs
+ * sip.ignored channels: total channels ignored
+ * sip.ignored sessions: total sessions ignored
+ * sip.requests: total requests
+ * sip.responses: total responses
+
+
+5.21. smtp
+
+------------
+
+What: smtp inspection
+
+Type: inspector
+
+Configuration:
+
+ * string smtp.alt_max_command_line_len[].command: command string
+ * int smtp.alt_max_command_line_len[].length = 0: specify
+ non-default maximum for command { 0: }
+ * string smtp.auth_cmds: commands that initiate an authentication
+ exchange
+ * string smtp.binary_data_cmds: commands that initiate sending of
+ data and use a length value after the command
+ * int smtp.bitenc_decode_depth = 25: depth used to extract the
+ non-encoded MIME attachments { -1:65535 }
+ * int smtp.b64_decode_depth = 25: depth used to decode the base64
+ encoded MIME attachments { -1:65535 }
+ * string smtp.data_cmds: commands that initiate sending of data
+ with an end of data delimiter
+ * int smtp.email_hdrs_log_depth = 1464: depth for logging email
+ headers { 0:20480 }
+ * bool smtp.ignore_data = false: ignore data section of mail
+ * bool smtp.ignore_tls_data = false: ignore TLS-encrypted data when
+ processing rules
+ * string smtp.invalid_cmds: alert if this command is sent from
+ client side
+ * bool smtp.log_email_hdrs = false: log the SMTP email headers
+ extracted from SMTP data
+ * bool smtp.log_filename = false: log the MIME attachment filenames
+ extracted from the Content-Disposition header within the MIME
+ body
+ * bool smtp.log_mailfrom = false: log the sender’s email address
+ extracted from the MAIL FROM command
+ * bool smtp.log_rcptto = false: log the recipient’s email address
+ extracted from the RCPT TO command
+ * int smtp.max_command_line_len = 0: max Command Line Length {
+ 0:65535 }
+ * int smtp.max_header_line_len = 0: max SMTP DATA header line {
+ 0:65535 }
+ * int smtp.max_response_line_len = 0: max SMTP response line {
+ 0:65535 }
+ * enum smtp.normalize = none: turns on/off normalization { none |
+ cmds | all }
+ * string smtp.normalize_cmds: list of commands to normalize
+ * int smtp.qp_decode_depth = 25: quoted-Printable decoding depth {
+ -1:65535 }
+ * int smtp.uu_decode_depth = 25: unix-to-Unix decoding depth {
+ -1:65535 }
+ * string smtp.valid_cmds: list of valid commands
+ * enum smtp.xlink2state = alert: enable/disable xlink2state alert {
+ disable | alert | drop }
+
+Rules:
+
+ * 124:1 (smtp) Attempted command buffer overflow
+ * 124:2 (smtp) Attempted data header buffer overflow
+ * 124:3 (smtp) Attempted response buffer overflow
+ * 124:4 (smtp) Attempted specific command buffer overflow
+ * 124:5 (smtp) Unknown command
+ * 124:6 (smtp) Illegal command
+ * 124:7 (smtp) Attempted header name buffer overflow
+ * 124:8 (smtp) Attempted X-Link2State command buffer overflow
+ * 124:10 (smtp) Base64 Decoding failed.
+ * 124:11 (smtp) Quoted-Printable Decoding failed.
+ * 124:13 (smtp) Unix-to-Unix Decoding failed.
+ * 124:14 (smtp) Cyrus SASL authentication attack.
+
+Peg counts:
+
+ * smtp.packets: total packets
+
+
+5.22. ssh
------------
* ssh.packets: total packets
-6.19. stream
+5.23. ssl
+
+------------
+
+What: ssl inspection
+
+Type: inspector
+
+Configuration:
+
+ * bool ssl.trust_servers = false: disables requirement that
+ application (encrypted) data must be observed on both sides
+ * int ssl.max_heartbeat_length = 0: maximum length of heartbeat
+ record allowed { 0:65535 }
+
+Rules:
+
+ * 137:1 (ssl) Invalid Client HELLO after Server HELLO Detected
+ * 137:2 (ssl) Invalid Server HELLO without Client HELLO Detected
+ * 137:3 (ssl) Heartbeat Read Overrun Attempt Detected
+ * 137:4 (ssl) Large Heartbeat Response Detected
+
+Peg counts:
+
+ * ssl.packets: total packets
+
+
+5.24. stream
------------
Configuration:
- * int stream.icmp_cache.memcap = 0: maximum cache memory { 0: }
- * int stream.icmp_cache.idle_timeout = 60: maximum inactive time
- before retiring session tracker { 1: }
- * int stream.icmp_cache.pruning_timeout = 30: minimum inactive time
+ * int stream.ip_cache.max_sessions = 16384: maximum simultaneous
+ sessions tracked before pruning { 1: }
+ * int stream.ip_cache.memcap = 23920640: maximum cache memory
+ before pruning (0 is unlimited) { 0: }
+ * int stream.ip_cache.pruning_timeout = 30: minimum inactive time
before being eligible for pruning { 1: }
- * int stream.icmp_cache.max_sessions = 262144: maximum simultaneous
- tcp sessions tracked before pruning { 0: }
- * int stream.ip_cache.memcap = 0: maximum cache memory { 0: }
- * int stream.ip_cache.idle_timeout = 60: maximum inactive time
+ * int stream.ip_cache.idle_timeout = 180: maximum inactive time
before retiring session tracker { 1: }
- * int stream.ip_cache.pruning_timeout = 30: minimum inactive time
+ * int stream.icmp_cache.max_sessions = 32768: maximum simultaneous
+ sessions tracked before pruning { 1: }
+ * int stream.icmp_cache.memcap = 1048576: maximum cache memory
+ before pruning (0 is unlimited) { 0: }
+ * int stream.icmp_cache.pruning_timeout = 30: minimum inactive time
before being eligible for pruning { 1: }
- * int stream.ip_cache.max_sessions = 262144: maximum simultaneous
- tcp sessions tracked before pruning { 0: }
- * int stream.tcp_cache.memcap = 0: maximum cache memory { 0: }
- * int stream.tcp_cache.idle_timeout = 60: maximum inactive time
+ * int stream.icmp_cache.idle_timeout = 180: maximum inactive time
before retiring session tracker { 1: }
+ * int stream.tcp_cache.max_sessions = 131072: maximum simultaneous
+ sessions tracked before pruning { 1: }
+ * int stream.tcp_cache.memcap = 268435456: maximum cache memory
+ before pruning (0 is unlimited) { 0: }
* int stream.tcp_cache.pruning_timeout = 30: minimum inactive time
before being eligible for pruning { 1: }
- * int stream.tcp_cache.max_sessions = 262144: maximum simultaneous
- tcp sessions tracked before pruning { 0: }
- * int stream.udp_cache.memcap = 0: maximum cache memory { 0: }
- * int stream.udp_cache.idle_timeout = 60: maximum inactive time
+ * int stream.tcp_cache.idle_timeout = 180: maximum inactive time
before retiring session tracker { 1: }
+ * int stream.udp_cache.max_sessions = 65536: maximum simultaneous
+ sessions tracked before pruning { 1: }
+ * int stream.udp_cache.memcap = 0: maximum cache memory before
+ pruning (0 is unlimited) { 0: }
* int stream.udp_cache.pruning_timeout = 30: minimum inactive time
before being eligible for pruning { 1: }
- * int stream.udp_cache.max_sessions = 262144: maximum simultaneous
- tcp sessions tracked before pruning { 0: }
+ * int stream.udp_cache.idle_timeout = 180: maximum inactive time
+ before retiring session tracker { 1: }
+ * int stream.user_cache.max_sessions = 1024: maximum simultaneous
+ sessions tracked before pruning { 1: }
+ * int stream.user_cache.memcap = 1048576: maximum cache memory
+ before pruning (0 is unlimited) { 0: }
+ * int stream.user_cache.pruning_timeout = 30: minimum inactive time
+ before being eligible for pruning { 1: }
+ * int stream.user_cache.idle_timeout = 180: maximum inactive time
+ before retiring session tracker { 1: }
+ * int stream.file_cache.max_sessions = 128: maximum simultaneous
+ sessions tracked before pruning { 1: }
+ * int stream.file_cache.memcap = 0: maximum cache memory before
+ pruning (0 is unlimited) { 0: }
+ * int stream.file_cache.pruning_timeout = 30: minimum inactive time
+ before being eligible for pruning { 1: }
+ * int stream.file_cache.idle_timeout = 180: maximum inactive time
+ before retiring session tracker { 1: }
Peg counts:
+ * stream.ip flows: total ip sessions
+ * stream.ip prunes: ip sessions pruned
+ * stream.icmp flows: total icmp sessions
+ * stream.icmp prunes: icmp sessions pruned
* stream.tcp flows: total tcp sessions
* stream.tcp prunes: tcp sessions pruned
* stream.udp flows: total udp sessions
* stream.udp prunes: udp sessions pruned
- * stream.icmp flows: total icmp sessions
- * stream.icmp prunes: icmp sessions pruned
- * stream.ip flows: total ip sessions
- * stream.ip prunes: ip sessions pruned
+ * stream.user flows: total user sessions
+ * stream.user prunes: user sessions pruned
+ * stream.file flows: total file sessions
+ * stream.file prunes: file sessions pruned
+
+
+5.25. stream_file
+
+------------
+
+What: stream inspector for file flow tracking and processing
+
+Type: inspector
+Configuration:
+
+ * bool stream_file.upload = false: indicate file transfer direction
-6.20. stream_icmp
+
+5.26. stream_icmp
------------
* stream_icmp.released: icmp session trackers released
-6.21. stream_ip
+5.27. stream_ip
------------
* stream_ip.nodes deleted: fragments deleted from tracker
-6.22. stream_tcp
+5.28. stream_tcp
------------
* int stream_tcp.overlap_limit = 0: maximum number of allowed
overlapping segments per session { 0:255 }
* int stream_tcp.max_pdu = 16384: maximum reassembled PDU size {
- 1460:63780 }
+ 1460:65535 }
* enum stream_tcp.policy = bsd: determines operating system
characteristics like reassembly { first | last | linux |
old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 |
segments queued { 0:2048 }
* int stream_tcp.small_segments.maximum_size = 0: limit number of
small segments queued { 0:2048 }
- * bit_list stream_tcp.small_segments.ignore_ports: limit number of
- small segments queued { 65535 }
* int stream_tcp.session_timeout = 30: session tracking timeout {
1:86400 }
* int stream_tcp.footprint = 0: use zero for production, non-zero
flushed when session released
-6.23. stream_udp
+5.29. stream_udp
------------
* stream_udp.timeouts: udp session timeouts
-6.24. telnet
+5.30. stream_user
+
+------------
+
+What: stream inspector for user flow tracking and reassembly
+
+Type: inspector
+
+Configuration:
+
+ * int stream_user.session_timeout = 30: session tracking timeout {
+ 1:86400 }
+
+
+5.31. telnet
------------
* telnet.packets: total packets
-6.25. wizard
+5.32. wizard
------------
* wizard.tcp hits: tcp identifications
* wizard.udp scans: udp payload scans
* wizard.udp hits: udp identifications
+ * wizard.user scans: user payload scans
+ * wizard.user hits: user identifications
---------------------------------------------------------------------
-7. IPS Action Modules
+6. IPS Action Modules
---------------------------------------------------------------------
rule to parse.
-7.1. react
+6.1. react
------------
body)
-7.2. reject
+6.2. reject
------------
|all }
-7.3. rewrite
+6.3. rewrite
------------
---------------------------------------------------------------------
-8. IPS Option Modules
+7. IPS Option Modules
---------------------------------------------------------------------
IPS options are the building blocks of IPS rules.
-8.1. ack
+7.1. ack
------------
max | <max | >min
-8.2. asn1
+7.2. asn1
------------
* int asn1.relative_offset: relative offset from the cursor.
-8.3. base64_decode
+7.3. base64_decode
------------
start of buffer.
-8.4. bufferlen
+7.4. bufferlen
------------
* string bufferlen.~range: len | min<>max | <max | >min
-8.5. byte_extract
+7.5. byte_extract
------------
* implied byte_extract.dec: convert from decimal string
-8.6. byte_jump
+7.6. byte_jump
------------
* implied byte_jump.dec: convert from decimal string
-8.7. byte_test
+7.7. byte_test
------------
* implied byte_test.dec: convert from decimal string
-8.8. classtype
+7.8. classtype
------------
* string classtype.~: classification for this rule
-8.9. content
+7.9. content
------------
from cursor
-8.10. cvs
+7.10. cvs
------------
* implied cvs.invalid-entry: looks for an invalid Entry string
-8.11. detection_filter
+7.11. detection_filter
------------
1: }
-8.12. dsize
+7.12. dsize
------------
max | <max | >min
-8.13. file_data
+7.13. file_data
------------
Type: ips_option
-8.14. flags
+7.14. flags
------------
* string flags.~mask_flags: these flags are don’t cares
-8.15. flow
+7.15. flow
------------
* implied flow.only_frag: match on defragmented packets only
-8.16. flowbits
+7.16. flowbits
------------
* string flowbits.~arg2: group if arg1 is bits
-8.17. fragbits
+7.17. fragbits
------------
* string fragbits.~flags: these flags are tested
-8.18. fragoffset
+7.18. fragoffset
------------
min<>max | <max | >min
-8.19. gid
+7.19. gid
------------
* int gid.~: generator id { 1: }
-8.20. http_client_body
+7.20. http_client_body
------------
Type: ips_option
-8.21. http_cookie
+7.21. http_cookie
------------
Type: ips_option
-8.22. http_header
+7.22. http_header
------------
* string http_header.~name: restrict to given header
-8.23. http_method
+7.23. http_method
------------
Type: ips_option
-8.24. http_raw_cookie
+7.24. http_raw_cookie
------------
Type: ips_option
-8.25. http_raw_header
+7.25. http_raw_header
------------
Type: ips_option
-8.26. http_raw_uri
+7.26. http_raw_uri
------------
Type: ips_option
-8.27. http_stat_code
+7.27. http_stat_code
------------
Type: ips_option
-8.28. http_stat_msg
+7.28. http_stat_msg
------------
Type: ips_option
-8.29. http_uri
+7.29. http_uri
------------
Type: ips_option
-8.30. icmp_id
+7.30. icmp_id
------------
>min
-8.31. icmp_seq
+7.31. icmp_seq
------------
min<>max | <max | >min
-8.32. icode
+7.32. icode
------------
| >min
-8.33. id
+7.33. id
------------
min
-8.34. ip_proto
+7.34. ip_proto
------------
* string ip_proto.~proto: [!|>|<] name or number
-8.35. ipopts
+7.35. ipopts
------------
lsrre|ssrr|satid|any }
-8.36. isdataat
+7.36. isdataat
------------
buffer
-8.37. itype
+7.37. itype
------------
| >min
-8.38. md5
+7.38. md5
------------
of buffer
-8.39. metadata
+7.39. metadata
------------
* string metadata.*: additional parameters not used by snort
-8.40. msg
+7.40. msg
------------
* string msg.~: message describing rule
-8.41. pcre
+7.41. pcre
------------
* string pcre.~regex: Snort regular expression
-8.42. pkt_data
+7.42. pkt_data
------------
Type: ips_option
-8.43. priority
+7.43. priority
------------
1: }
-8.44. raw_data
+7.44. raw_data
------------
Type: ips_option
-8.45. reference
+7.45. reference
------------
* string reference.~id: reference id
-8.46. rem
+7.46. rem
------------
* string rem.~: comment
-8.47. replace
+7.47. replace
------------
* string replace.~: byte code to replace with
-8.48. rev
+7.48. rev
------------
* int rev.~: revision { 1: }
-8.49. rpc
+7.49. rpc
------------
* string rpc.~proc: procedure number or * for any
-8.50. seq
+7.50. seq
------------
max | <max | >min
-8.51. session
+7.51. session
------------
* enum session.~mode: output format { printable|binary|all }
-8.52. sha256
+7.52. sha256
------------
start of buffer
-8.53. sha512
+7.53. sha512
------------
start of buffer
-8.54. sid
+7.54. sid
------------
* int sid.~: signature id { 1: }
-8.55. so
+7.55. sip_body
+
+------------
+
+What: rule option to set the detection cursor to the request body
+
+Type: ips_option
+
+
+7.56. sip_header
+
+------------
+
+What: rule option to set the detection cursor to the SIP header
+buffer
+
+Type: ips_option
+
+
+7.57. sip_method
+
+------------
+
+What: detection option for sip stat code
+
+Type: ips_option
+
+Configuration:
+
+ * string sip_method.*method: sip method
+
+
+7.58. sip_stat_code
+
+------------
+
+What: detection option for sip stat code
+
+Type: ips_option
+
+Configuration:
+
+ * int sip_stat_code.*code: stat code { 1:999 }
+
+
+7.59. so
------------
* string so.~func: name of eval function
-8.56. soid
+7.60. soid
------------
* string soid.~: SO rule ID has <gid>|<sid> format, like 3|12345
-8.57. stream_reassemble
+7.61. ssl_state
+
+------------
+
+What: detection option for ssl state
+
+Type: ips_option
+
+Configuration:
+
+ * implied ssl_state.client_hello: check for client hello
+ * implied ssl_state.server_hello: check for server hello
+ * implied ssl_state.client_keyx: check for client keyx
+ * implied ssl_state.server_keyx: check for server keyx
+ * implied ssl_state.unknown: check for unknown record
+ * implied ssl_state.!client_hello: check for records that are not
+ client hello
+ * implied ssl_state.!server_hello: check for records that are not
+ server hello
+ * implied ssl_state.!client_keyx: check for records that are not
+ client keyx
+ * implied ssl_state.!server_keyx: check for records that are not
+ server keyx
+ * implied ssl_state.!unknown: check for records that are not
+ unknown
+
+
+7.62. ssl_version
+
+------------
+
+What: detection option for ssl version
+
+Type: ips_option
+
+Configuration:
+
+ * implied ssl_version.sslv2: check for sslv2
+ * implied ssl_version.sslv3: check for sslv3
+ * implied ssl_version.tls1.0: check for tls1.0
+ * implied ssl_version.tls1.1: check for tls1.1
+ * implied ssl_version.tls1.2: check for tls1.2
+ * implied ssl_version.!sslv2: check for records that are not sslv2
+ * implied ssl_version.!sslv3: check for records that are not sslv3
+ * implied ssl_version.!tls1.0: check for records that are not
+ tls1.0
+ * implied ssl_version.!tls1.1: check for records that are not
+ tls1.1
+ * implied ssl_version.!tls1.2: check for records that are not
+ tls1.2
+
+
+7.63. stream_reassemble
------------
remainder of the session
-8.58. stream_size
+7.64. stream_size
------------
direction(s) { either|to_server|to_client|both }
-8.59. tag
+7.65. tag
------------
* int tag.bytes: tag for this many bytes { 1: }
-8.60. tos
+7.66. tos
------------
max | <max | >min
-8.61. ttl
+7.67. ttl
------------
max | <max | >min
-8.62. window
+7.68. urg
+
+------------
+
+What: detection for TCP urgent pointer
+
+Type: ips_option
+
+Configuration:
+
+ * string urg.~range: check if urgent offset is min<>max | <max | >
+ min
+
+
+7.69. window
------------
---------------------------------------------------------------------
-9. Search Engine Modules
+8. Search Engine Modules
---------------------------------------------------------------------
---------------------------------------------------------------------
-10. SO Rule Modules
+9. SO Rule Modules
---------------------------------------------------------------------
---------------------------------------------------------------------
-11. Logger Modules
+10. Logger Modules
---------------------------------------------------------------------
All output of events and packets is done by Loggers.
-11.1. alert_csv
+10.1. alert_csv
------------
* bool alert_csv.file = false: output to alert_csv.txt instead of
stdout
- * multi alert_csv.csv = timestamp gid sid rev src_addr src_port
- dst_addr dst_port: selected fields will be output in given order
- left to right { timestamp | gid | sid | rev | msg | proto |
- src_addr | dst_addr | src_port | dst_port | eth_src | eth_dst |
- eth_type | eth_len | ttl | tos | id | ip_len | dgm_len |
- icmp_type | icmp_code | icmp_id | icmp_seq | tcp_flags | tcp_seq
- | tcp_ack | tcp_len | tcp_win | udp_len }
+ * multi alert_csv.fields = timestamp pkt_num proto pkt_gen dgm_len
+ dir src_ap dst_ap rule action: selected fields will be output in
+ given order left to right { action | dir | dgm_len | dst_addr |
+ dst_ap | dst_port | eth_dst | eth_len | eth_src | eth_type | gid
+ | icmp_code | icmp_id | icmp_seq | icmp_type | ip_id | ip_len |
+ msg | pkt_gen | pkt_num | proto | rev | rule | sid | src_addr |
+ src_ap | src_port | tcp_ack | tcp_flags | tcp_len | tcp_seq |
+ tcp_win | timestamp | tos | ttl | udp_len }
* int alert_csv.limit = 0: set limit (0 is unlimited) { 0: }
+ * string alert_csv.separator = , : separate fields with this
+ character sequence
* enum alert_csv.units = B: bytes | KB | MB | GB { B | K | M | G }
-11.2. alert_fast
+10.2. alert_ex
+
+------------
+
+What: output gid:sid:rev for alerts
+
+Type: logger
+
+Configuration:
+
+ * bool alert_ex.upper = false: true/false → convert to upper/lower
+ case
+
+
+10.3. alert_fast
------------
* enum alert_fast.units = B: bytes | KB | MB | GB { B | K | M | G }
-11.3. alert_full
+10.4. alert_full
------------
K | M | G }
-11.4. alert_syslog
+10.5. alert_syslog
------------
cons | ndelay | perror | pid }
-11.5. alert_test
+10.6. alert_unixsock
------------
-What: output event in custom tsv format
+What: output event over unix socket
Type: logger
-Configuration:
-
- * bool alert_test.file = false: output to alert_test.txt instead of
- stdout
- * bool alert_test.rebuilt = false: include type:count where type is
- S for stream and F for frag
- * bool alert_test.session = false: include src-dst each of form
- -addr:port
- * bool alert_test.msg = false: include alert msg
-
-11.6. alert_unixsock
+10.7. log_codecs
------------
-What: output event over unix socket
+What: log protocols in packet by layer
Type: logger
+Configuration:
+
+ * bool log_codecs.file = false: output to log_codecs.txt instead of
+ stdout
+ * bool log_codecs.msg = false: include alert msg
+
+
+10.8. log_hext
-11.7. log_codecs
-
------------
-What: log protocols in packet by layer
+What: output payload suitable for daq hext
Type: logger
Configuration:
- * bool log_codecs.file = false: output to log_codecs.txt instead of
+ * bool log_hext.file = false: output to log_hext.txt instead of
stdout
- * bool log_codecs.msg = false: include alert msg
+ * bool log_hext.raw = false: output all full packets if true, else
+ just TCP payload
+ * int log_hext.limit = 0: set limit (0 is unlimited) { 0: }
+ * enum log_hext.units = B: bytes | KB | MB | GB { B | K | M | G }
+ * int log_hext.width = 20: set line width (0 is unlimited) { 0: }
-11.8. log_pcap
+10.9. log_pcap
------------
* enum log_pcap.units = B: bytes | KB | MB | GB { B | K | M | G }
-11.9. unified2
+10.10. unified2
------------
events
+---------------------------------------------------------------------
+
+11. DAQ Modules
+
+---------------------------------------------------------------------
+
+The Data AcQuisition library (DAQ), provides pluggable packet I/O.
+The DAQ replaces direct calls to libraries like libpcap with an
+abstraction layer that facilitates operation on a variety of hardware
+and software interfaces without requiring changes to Snort. It is
+possible to select the DAQ type and mode when invoking Snort to
+perform pcap readback or inline operation, etc. The DAQ library may
+be useful for other packet processing applications and the modular
+nature allows you to build new modules for other platforms.
+
+The DAQ library is provided as an external package on snort.org.
+There are a few additional modules provided with Snort++. This
+section summarizes the important things you need to know to use these
+DAQ modules. There are also 3rd DAQ modules available.
+
+
+11.1. Building the DAQ Library and DAQ Modules
+
+------------
+
+The DAQ is bundled with Snort but must be built first using these
+steps:
+
+./configure
+make
+sudo make install
+
+This will build and install both static and dynamic DAQ modules.
+
+Note that pcap >= 1.0.0 is required. pcap 1.1.1 is available at the
+time of this writing and is recommended.
+
+Also, libdnet is required for IPQ and NFQ DAQs. If you get a
+relocation error trying to build those DAQs, you may need to
+reinstall libdnet and configure it with something like this:
+
+./configure "CFLAGS=-fPIC -g -O2"
+
+You may also experience problems trying to find the dynamic dnet
+library because it isn’t always named properly. Try creating a link
+to the shared library (identified by its .x or .x.y etc. extension)
+with the same name but with ".so" inserted as follows:
+
+$ ln -s libdnet.1.1 libdnet.so.1.1
+$ ldconfig -Rv /usr/local/lib 2>&1 | grep dnet
+ Adding /usr/local/lib/libdnet.so.1.1
+
+Alternatively, you should be able to fix both issues as follows:
+
+libtoolize --copy --force
+aclocal -I config
+autoheader
+autoconf
+automake --foreign
+
+When the DAQ library is built, both static and dynamic flavors will
+be generated. The various DAQ modules will be built if the requisite
+headers and libraries are available. You can disable individual
+modules, etc. with options to configure. For the complete list of
+configure options, run:
+
+./configure --help
+
+
+11.2. PCAP Module
+
+------------
+
+pcap is the default DAQ. If snort is run w/o any DAQ arguments, it
+will operate as it always did using this module. These are
+equivalent:
+
+./snort -i <device>
+./snort -r <file>
+
+./snort --daq pcap --daq-mode passive -i <device>
+./snort --daq pcap --daq-mode read-file -r <file>
+
+You can specify the buffer size pcap uses with:
+
+./snort --daq pcap --daq-var buffer_size=<#bytes>
+
+ * The pcap DAQ does not count filtered packets. *
+
+
+11.3. AFPACKET Module
+
+------------
+
+afpacket functions similar to the pcap DAQ but with better
+performance:
+
+./snort --daq afpacket -i <device>
+ [--daq-var buffer_size_mb=<#MB>]
+ [--daq-var debug]
+
+If you want to run afpacket in inline mode, you must craft the device
+string as one or more interface pairs, where each member of a pair is
+separated by a single colon and each pair is separated by a double
+colon like this:
+
+eth0:eth1
+
+or this:
+
+eth0:eth1::eth2:eth3
+
+By default, the afpacket DAQ allocates 128MB for packet memory. You
+can change this with:
+
+--daq-var buffer_size_mb=<#MB>
+
+Note that the total allocated is actually higher, here’s why.
+Assuming the default packet memory with a snaplen of 1518, the
+numbers break down like this:
+
+ * The frame size is 1518 (snaplen) + the size of the AFPacket
+ header (66 bytes) = 1584 bytes.
+ * The number of frames is 128 MB / 1518 = 84733.
+ * The smallest block size that can fit at least one frame is 4 KB =
+ 4096 bytes @ 2 frames per block.
+ * As a result, we need 84733 / 2 = 42366 blocks.
+ * Actual memory allocated is 42366 * 4 KB = 165.5 MB.
+
+Note
+
+Linux kernel version 2.6.31 or higher is required for the AFPacket
+DAQ module due to its dependency on both TPACKET v2 and
+PACKET_TX_RING support.
+
+
+11.4. NFQ Module
+
+------------
+
+NFQ is the new and improved way to process iptables packets:
+
+./snort --daq nfq \
+ [--daq-var device=<dev>] \
+ [--daq-var proto=<proto>] \
+ [--daq-var queue=<qid>]
+
+<dev> ::= ip | eth0, etc; default is IP injection
+<proto> ::= ip4 | ip6 |; default is ip4
+<qid> ::= 0..65535; default is 0
+
+This module can not run unprivileged so ./snort -u -g will produce a
+warning and won’t change user or group.
+
+Notes on iptables are given below.
+
+
+11.5. IPQ Module
+
+------------
+
+IPQ is the old way to process iptables packets. It replaces the
+inline version available in pre-2.9 versions built with this:
+
+./configure --enable-inline
+
+Note that layer 2 resets are not supported with the IPQ DAQ:
+
+config layer2resets[: <mac>]
+
+Start the IPQ DAQ as follows:
+
+./snort --daq ipq \
+ [--daq-var device=<dev>] \
+ [--daq-var proto=<proto>] \
+
+<dev> ::= ip | eth0, etc; default is IP injection
+<proto> ::= ip4 | ip6; default is ip4
+
+This module can not run unprivileged so ./snort -u -g will produce a
+warning and won’t change user or group.
+
+Notes on iptables are given below.
+
+
+11.6. IPFW Module
+
+------------
+
+IPFW is available for BSD systems. It replaces the inline version
+available in pre-2.9 versions built with this:
+
+./configure --enable-ipfw
+
+This command line argument is no longer supported:
+
+./snort -J <port#>
+
+Instead, start Snort like this:
+
+./snort --daq ipfw [--daq-var port=<port>]
+
+<port> ::= 1..65535; default is 8000
+
+ * IPFW only supports ip4 traffic.
+
+Notes on FreeBSD and OpenBSD are given below.
+
+
+11.7. Dump Module
+
+------------
+
+The dump DAQ allows you to test the various inline mode features
+available in 2.9 Snort like injection and normalization.
+
+./snort -i <device> --daq dump
+./snort -r <pcap> --daq dump
+
+By default a file named inline-out.pcap will be created containing
+all packets that passed through or were generated by snort. You can
+optionally specify a different name.
+
+./snort --daq dump --daq-var file=<name>
+
+dump uses the pcap daq for packet acquisition. It therefore does not
+count filtered packets (a pcap limitation).
+
+Note that the dump DAQ inline mode is not an actual inline mode.
+Furthermore, you will probably want to have the pcap DAQ acquire in
+another mode like this:
+
+./snort -r <pcap> -Q --daq dump --daq-var load-mode=read-file
+./snort -i <device> -Q --daq dump --daq-var load-mode=passive
+
+
+11.8. Netmap Module
+
+------------
+
+The netmap project is a framework for very high speed packet I/O. It
+is available on both FreeBSD and Linux with varying amounts of
+preparatory setup required. Specific notes for each follow.
+
+./snort --daq netmap -i <device>
+ [--daq-var debug]
+
+If you want to run netmap in inline mode, you must craft the device
+string as one or more interface pairs, where each member of a pair is
+separated by a single colon and each pair is separated by a double
+colon like this:
+
+em1:em2
+
+or this:
+
+em1:em2::em3:em4
+
+Inline operation performs Layer 2 forwarding with no MAC filtering,
+akin to the AFPacket module’s behavior. All packets received on one
+interface in an inline pair will be forwarded out the other interface
+unless dropped by the reader and vice versa.
+
+Important
+
+The interfaces will need to be up and in promiscuous mode in order to
+function (ifconfig em1 up promisc). The DAQ module does not currently
+do either of these configuration steps for itself.
+
+11.8.1. FreeBSD
+
+In FreeBSD 10.0, netmap has been integrated into the core OS. In
+order to use it, you must recompile your kernel with the line
+
+device netmap
+
+added to your kernel config.
+
+11.8.2. Linux
+
+You will need to download the netmap source code from the project’s
+repository:
+
+https://code.google.com/p/netmap/
+
+Follow the instructions on the project’s homepage for compiling and
+installing the code:
+
+http://info.iet.unipi.it/~luigi/netmap/
+
+It will involve a standalone kernel module (netmap_lin) as well as
+patching and rebuilding the kernel module used to drive your network
+adapters. The following drivers are supported under Linux at the time
+of writing (June 2014):
+
+e1000
+e1000e
+forcedeth
+igb
+ixgbe
+r8169
+virtio
+
+TODO:
+
+ * Support for attaching to only a single ring (queue) on a network
+ adapter.
+ * Support for VALE and netmap pipes.
+
+
+11.9. Notes on iptables
+
+------------
+
+These notes are just a quick reminder that you need to set up
+iptables to use the IPQ or NFQ DAQs. Doing so may cause problems with
+your network so tread carefully. The examples below are intentionally
+incomplete so please read the related documentation first.
+
+Here is a blog post by Marty for historical reference:
+
+http://archives.neohapsis.com/archives/snort/2000-11/0394.html
+
+You can check this out for queue sizing tips:
+
+http://www.inliniac.net/blog/2008/01/23/improving-snort_inlines-nfq-performance.html
+
+You might find useful IPQ info here:
+
+http://snort-inline.sourceforge.net/
+
+Use this to examine your iptables:
+
+sudo /sbin/iptables -L
+
+Use something like this to set up NFQ:
+
+sudo /sbin/iptables
+ -I <table> [<protocol stuff>] [<state stuff>]
+ -j NFQUEUE --queue-num 1
+
+Use something like this to set up IPQ:
+
+sudo iptables -I FORWARD -j QUEUE
+
+Use something like this to "disconnect" snort:
+
+sudo /sbin/iptables -D <table> <rule pos>
+
+Be sure to start Snort prior to routing packets through NFQ with
+iptables. Such packets will be dropped until Snort is started.
+
+The queue-num is the number you must give Snort.
+
+If you are running on a system with both NFQ and IPQ support, you may
+experience some start-up failures of the sort:
+
+The solution seems to be to remove both modules from the kernel like
+this:
+
+modprobe -r nfnetlink_queue
+modprobe -r ip_queue
+
+and then install the module you want:
+
+modprobe ip_queue
+
+or:
+
+modprobe nfnetlink_queue
+
+These DAQs should be run with a snaplen of 65535 since the kernel
+defrags the packets before queuing. Also, no need to configure frag3.
+
+
+11.10. Notes on FreeBSD::IPFW
+
+------------
+
+Check the online manual at:
+
+http://www.freebsd.org/doc/handbook/firewalls-ipfw.html.
+
+Here is a brief example to divert icmp packets to Snort at port 8000:
+
+To enable support for divert sockets, place the following lines in
+the kernel configuration file:
+
+options IPFIREWALL
+options IPDIVERT
+
+(The file in this case was: /usr/src/sys/i386/conf/GENERIC; which is
+platform dependent.)
+
+You may need to also set these to use the loadable kernel modules:
+
+/etc/rc.conf:
+firewall_enable="YES"
+
+/boot/loader.conf:
+ipfw_load="YES"
+ipdivert_load="YES"
+
+$ dmesg | grep ipfw
+ipfw2 (+ipv6) initialized, divert loadable, nat loadable, rule-based
+forwarding disabled, default to deny, logging disabled
+
+$ kldload -v ipdivert
+Loaded ipdivert, id=4
+
+$ ipfw add 75 divert 8000 icmp from any to any
+00075 divert 8000 icmp from any to any
+
+$ ipfw list
+...
+00075 divert 8000 icmp from any to any
+00080 allow icmp from any to any
+...
+
+ * Note that on FreeBSD, divert sockets don’t work with bridges!
+
+Please refer to the following articles for more information:
+
+ * https://forums.snort.org/forums/support/topics/
+ snort-inline-on-freebsd-ipfw
+ * http://freebsd.rogness.net/snort_inline/
+
+NAT gateway can be used with divert sockets if the network
+environment is conducive to using NAT.
+
+The steps to set up NAT with ipfw are as follows:
+
+ 1. Set up NAT with two interface em0 and em1 by adding the following
+ to /etc/rc.conf. Here em0 is connected to external network and
+ em1 to host-only LAN.
+
+ gateway_enable="YES"
+ natd_program="/sbin/natd" # path to natd
+ natd_enable="YES" # Enable natd (if firewall_enable == YES)
+ natd_interface="em0" # Public interface or IP Address
+ natd_flags="-dynamic" # Additional flags
+ defaultrouter=""
+ ifconfig_em0="DHCP"
+ ifconfig_em1="inet 192.168.1.2 netmask 255.255.255.0"
+ firewall_enable="YES"
+ firewall_script="/etc/rc.firewall"
+ firewall_type="simple"
+
+ 2. Add the following divert rules to divert packets to Snort above
+ and below the NAT rule in the "Simple" section of /etc/
+ rc.firewall.
+
+ ...
+ # Inspect outbound packets (those arriving on "inside" interface)
+ # before NAT translation.
+ ${fwcmd} add divert 8000 all from any to any in via ${iif}
+ case ${natd_enable} in
+ [Yy][Ee][Ss])
+ if [ -n "${natd_interface}" ]; then
+ ${fwcmd} add divert natd all from any to any via ${natd_interface}
+ fi
+ ;;
+ esac
+ ...
+ # Inspect inbound packets (those arriving on "outside" interface)
+ # after NAT translation that aren't blocked for other reasons,
+ # after the TCP "established" rule.
+ ${fwcmd} add divert 8000 all from any to any in via ${oif}
+
+
+11.11. Notes on OpenBSD::IPFW
+
+------------
+
+OpenBSD supports divert sockets as of 4.7, so we use the ipfw DAQ.
+
+Here is one way to set things up:
+
+ 1. Configure the system to forward packets:
+
+ $ sysctl net.inet.ip.forwarding=1
+ $ sysctl net.inet6.ip6.forwarding=1
+
+ (You can also put that in /etc/sysctl.conf to enable on boot.)
+
+ 2. Set up interfaces
+
+ $ dhclient vic1
+ $ dhclient vic2
+
+ 3. Set up packet filter rules:
+
+ $ echo "pass out on vic1 divert-packet port 9000 keep-state" > rules.txt
+ $ echo "pass out on vic2 divert-packet port 9000 keep-state" >> rules.txt
+
+ $ pfctl -v -f rules.txt
+
+ 4. Analyze packets diverted to port 9000:
+
+ $ ./snort --daq ipfw --daq-var port=9000
+
+ + Note that on OpenBSD, divert sockets don’t work with bridges!
+
+
+11.12. Socket Module
+
+------------
+
+The socket module provides provides a stream socket server that will
+accept up to 2 simultaneous connections and bridge them together
+while also passing data to Snort++ for inspection. The first
+connection accepted is considered the client and the second
+connection accepted is considered the server. If there is only one
+connection, stream data can’t be forwarded but it is still inspected.
+
+Each read from a socket of up to snaplen bytes is passed as a packet
+to Snort++ along with a DAQ_SktHdr_t pointer in
+DAQ_PktHdr_t→priv_ptr. DAQ_SktHdr_t conveys IP4 address, ports,
+protocol, and direction. Socket packets can be configured to be TCP
+or UDP. The socket DAQ can be operated in inline mode and is able to
+block packets.
+
+The socket DAQ uses DLT_SOCKET and requires that Snort++ load the
+socket codec which is included in the extra package.
+
+To use the socket DAQ, start Snort++ like this:
+
+./snort --plugin-path /path/to/lib/snort_extra \
+ --daq socket [--daq-var port=<port>] [--daq-var proto=<proto>] [-Q]
+
+<port> ::= 1..65535; default is 8000
+<proto> ::= tcp | udp
+
+ * This module only supports ip4 traffic.
+ * This module is only supported by Snort++. It is not compatible
+ with Snort.
+ * This module is primarily for development and test.
+
+
+11.13. File Module
+
+------------
+
+The file module provides the ability to process files directly w/o
+having to extract them from pcaps. Use the file module with Snort’s
+stream_file to get file type identification and signature services.
+The usual IPS detection and logging etc. is available too.
+
+You can process all the files in a directory recursively using 8
+threads with these Snort options:
+
+--pcap-dir path -z 8
+
+ * This module is only supported by Snort++. It is not compatible
+ with Snort.
+ * This module is primarily for development and test.
+
+
+11.14. Hext Module
+
+------------
+
+The hext module generates packets suitable for processing by Snort
+from hex/plain text. Raw packets include full headers and are
+processed normally. Otherwise the packets contain only payload and
+are accompanied with flow information (4-tuple) suitable for
+processing by stream_user.
+
+The first character of the line determines it’s purpose:
+
+'$' command
+'#' comment
+'"' quoted string packet data
+'x' hex packet data
+' ' empty line separates packets
+
+The available commands are:
+
+$client <ip4> <port>
+$server <ip4> <port>
+
+$packet -> client
+$packet -> server
+
+$packet <addr> <port> -> <addr> <port>
+
+Client and server are determined as follows. $packet → client
+indicates to the client (from server) and $packet → server indicates
+a packet to the server (from client). $packet followed by a 4-tuple
+uses the heuristic that the client is the side with the lower port
+number.
+
+The default client and server are 192.168.1.1 12345 and 10.1.2.3 80
+respectively. $packet commands with a 4-tuple do not change client
+and server set with the other $packet commands.
+
+$packet commands should be followed by packet data, which may contain
+any combination of hex and strings. Data for a packet ends with the
+next command or a blank line. Data after a blank line will start
+another packet with the same tuple as the prior one.
+
+Strings may contain the following escape sequences:
+
+\r = 0x0D = carriage return
+\n = 0x0A = new line
+\t = 0x09 = tab
+\\ = 0x5C = \
+
+Format your input carefully; there is minimal error checking and
+little tolerance for arbitrary whitespace. You can use Snort’s -L
+hext option to generate hext input from a pcap.
+
+ * This module only supports ip4 traffic.
+ * This module is only supported by Snort++. It is not compatible
+ with Snort.
+ * This module is primarily for development and test.
+
+The hext DAQ also supports a raw mode which is activated by setting
+the data link type. For example, you can input full ethernet packets
+with --daq-var dlt=1 (Data link types are defined in the DAQ include
+sfbpf_dlt.h.) Combine that with the hext logger in raw mode for a
+quick (and dirty) way to edit pcaps. With --lua "log_hext = { raw =
+true }", the hext logger will dump the full packet in a way that can
+be read by the hext DAQ in raw mode. Here is an example:
+
+# 3 [96]
+
+x02 09 08 07 06 05 02 01 02 03 04 05 08 00 45 00 00 52 00 03 # ..............E..R..
+x00 00 40 06 5C 90 0A 01 02 03 0A 09 08 07 BD EC 00 50 00 00 # ..@.\............P..
+x00 02 00 00 00 02 50 10 20 00 8A E1 00 00 47 45 54 20 2F 74 # ......P. .....GET /t
+x72 69 67 67 65 72 2F 31 20 48 54 54 50 2F 31 2E 31 0D 0A 48 # rigger/1 HTTP/1.1..H
+x6F 73 74 3A 20 6C 6F 63 61 6C 68 6F 73 74 0D 0A # ost: localhost..
+
+A comment indicating packet number and size precedes each packet
+dump. Note that the commands are not applicable in raw mode and have
+no effect.
+
+
---------------------------------------------------------------------
12. Snort++ vs Snort
2.9.X configuration files into Lua files that Snort 3.0 can
understand.
-Snort2Lua reads your legacy Snort conf file(s) and generates Snort\++
+Snort2Lua reads your legacy Snort conf file(s) and generates Snort++
Lua and rules files. When running this program, the only mandatory
option is to provide Snort2Lua with a Snort configuration file. The
default output file file is snort.lua, the default error file will be
configuration. All errors (aside from Fatal Snort2Lua errors),
differences, and comments will omitted from the final output file.
Default mode will print everything. That mean you will be able to see
-exactly what changes have occurred between Snort and Snort\++ in
+exactly what changes have occurred between Snort and Snort++ in
addition to the new syntax, the original file’s comments, and all
errors that have occurred. Finally, differences mode will not
actually output a valid Snort3.0 configuration. Instead, you can see
---------------------------------------------------------------------
-14. Reference
+14. Extending Snort++
---------------------------------------------------------------------
-14.1. Terminology
+14.1. Plugins
------------
- * basic module: a module integrated into Snort that does not come
- from a plugin.
- * binder: inspector that maps configuration to traffic
- * builtin rules: codec and inspector rules for anomalies detected
- internally.
- * codec: short for coder / decoder. These plugins are used for
- basic protocol decoding, anomaly detection, and construction of
- active responses.
- * data module: an adjunct configuration plugin for use with certain
- inspectors.
- * dynamic rules: plugin rules loaded at runtime. See SO rules.
- * fast pattern: the content in an IPS rule that must be found by
- the search engine in order for a rule to be evaluated.
- * fast pattern matcher: see search engine.
- * hex: a type of protocol magic that the wizard uses to identify
- binary protocols.
- * inspector: plugin that processes packets (similar to the legacy
- Snort preprocessor)
- * IPS: intrusion prevention system, like Snort.
- * IPS action: plugin that allows you to perform custom actions when
- events are generated. Unlike loggers, these are invoked before
- thresholding and can be used to control external agents or send
- active responses.
- * IPS option: this plugin is the building blocks of IPS rules.
- * logger: a plugin that performs output of events and packets.
- Events are thresholded before reaching loggers.
- * module: the user facing portion of a Snort component. Modules
- chiefly provide configuration parameters, but may also provide
- commands, builtin rules, profiling statistics, peg counts, etc.
- Note that not all modules are plugins and not all plugins have
- modules.
- * peg count: the number of times a given event or condition occurs.
- * plugin: one of several types of software components that can be
- loaded from a dynamic library when Snort starts up. Some plugins
- are coupled with the main engine in such a way that they must be
- built statically, but a newer version can be loaded dynamically.
- * search engine: a plugin that performs multipattern searching of
- packets and payload to find rules that should be evaluated. There
- are currently no specific modules, although there are several
- search engine plugins. Related configuration is done with the
- basic detection module. Aka fast pattern matcher.
- * SO rule: a IPS rule plugin that performs custom detection that
- can’t be done by a text rule. These rules typically do not have
- associated modules. SO comes from shared object, meaning dynamic
- library.
- * spell: a type of protocol magic that the wizard uses to identify
- ASCII protocols.
- * text rule: a rule loaded from the configuration that has a header
- and body. The header specifies action, protocol, source and
- destination IP addresses and ports, and direction. The body
- specifies detection and non-detection options.
- * wizard: inspector that applies protocol magic to determine which
- inspectors should be bound to traffic absent a port specific
- binding. See hex and spell.
-
-
-14.2. Usage
-
-------------
+Snort++ uses a variety of plugins to accomplish much of its
+processing objectives, including:
-For the following examples "$my_path" is assumed to be the path to
-the Snort++ install directory. Additionally, it is assumed that
-"$my_path/bin" is in your PATH.
+ * Codec - to decode and encode packets
+ * Inspector - like the prior preprocessors, for normalization, etc.
+ * IpsOption - for detection in Snort++ rules
+ * IpsAction - for custom actions
+ * Logger - for handling events
+ * Mpse - for fast pattern matching
+ * So - for dynamic rules
-14.2.1. Environment
+Plugins have an associated API defined for each type, all of which
+share a common header, called the BaseApi. A dynamic library makes
+its plugins available by exporting the snort_plugins symbol, which is
+a null terminated array of BaseApi pointers.
-LUA_PATH is used directly by Lua to load and run required libraries.
-SNORT_LUA_PATH is used by Snort to load supplemental configuration
-files.
+The BaseApi includes type, name, API version, plugin version, and
+function pointers for constructing and destructing a Module. The
+specific API add various other data and functions for their given
+roles.
-export LUA_PATH=$my_path/include/snort/lua/\?.lua\;\;
-export SNORT_LUA_PATH=$my_path/etc/snort
-14.2.2. Help
+14.2. Modules
-Print the help summary:
+------------
-snort --help
+The Module is pervasive in Snort+. It is how everything, including
+plugins, are configured. It also provides access to builtin rules.
+And as the glue that binds functionality to Snort+, the capabilities
+of a Module are expected to grow to include statistics support, etc.
-Get help on a specific module ("stream", for example):
+Module configuration is handled by a list of Parameters. Most
+parameters can be validated by the framework, which means for example
+that conversion from string to number is done in exactly one place.
+Providing the builtin rules allows the documentation to include them
+automatically and also allows for autogenerating the rules at
+startup.
-snort --help-module stream
+If we are defining a new Inspector called, say, gadget, it might be
+configured in snort.lua like this:
-Get help on the "-A" command line option:
+gadget =
+{
+ brain = true,
+ claw = 3
+}
-snort --help-options A
+When the gadget table is processed, Snort++ will look for a module
+called gadget. If that Module has an associated API, it will be used
+to configure a new instance of the plugin. In this case, a
+GadgetModule would be instantiated, brain and claw would be set, and
+the Module instance would be passed to the GadgetInspector
+constructor.
-Grep for help on threads:
+Module has three key virtual methods:
-snort --help-config | grep thread
+ * begin() - called when Snort++ starts processing the associated
+ Lua table. This is a good place to allocate any required data and
+ set defaults.
+ * set() - called to set each parameter after validation.
+ * end() - called when Snort++ finishes processing the associated
+ Lua table. This is where additional integrity checks of related
+ parameters should be done.
-Output help on "rule" options in AsciiDoc format:
+The configured Module is passed to the plugin constructor which pulls
+the configuration data from the Module. For non-trivial
+configurations, the working paradigm is that Module hands a pointer
+to the configured data to the plugin instance which takes ownership.
-snort --markup --help-options rule
+Note that there is at most one instance of a given Module, even if
+multiple plugin instances are created which use that Module.
+(Multiple instances require Snort++ binding configuration.)
-Note
-Snort++ stops reading command-line options after the "--help-" and
-"--list-" options, so any other options should be placed before them.
+14.3. Inspectors
-14.2.3. Sniffing and Logging
+------------
-Read a pcap:
+There are several types of inspector, which determines which
+inspectors are executed when:
-snort -r /path/to/my.pcap
+ * IT_BINDER - determines which inspectors apply to given flows
+ * IT_WIZARD - determines which service inspector to use if none
+ explicitly bound
+ * IT_PACKET - used to process all packets before session and
+ service processing (e.g. normalize)
+ * IT_NETWORK - processes packets w/o service (e.g. arp_spoof,
+ back_orifice)
+ * IT_STREAM - for flow tracking, ip defrag, and tcp reassembly
+ * IT_SERVICE - for http, ftp, telnet, etc.
+ * IT_PROBE - process all packets after all the above (e.g.
+ perf_monitor, port_scan)
-Dump the packets to stdout:
-snort -r /path/to/my.pcap -K text
+14.4. Codecs
-Dump packets with application data and layer 2 headers
+------------
-snort -r /path/to/my.pcap -K text -d -e
+The Snort3.0 Codecs decipher raw packets. These Codecs are now
+completely pluggable; almost every Snort3.0 Codec can be built
+dynamically and replaced with an alternative, customized Codec. The
+pluggable nature has also made it easier to build new Codecs for
+protocols without having to touch the Snort3.0 code base.
-Note
+The first step in creating a Codec is defining its class and
+protocol. Every Codec must inherit from the Snort3.0 Codec class
+defined in "framework/codec.h". The following is an example Codec
+named "example" and has an associated struct that is 14 bytes long.
-Command line options must be specified separately. "snort -de" won’t
-work. You can still concatenate options and their arguments, however,
-so "snort -Ktext" will work.
+#include <cstdint>
+#include <arpa/inet.h>
+#include “framework/codec.h”
+#include "main/snort_types.h"
-Dump packets from all pcaps in a directory:
+#define EX_NAME “example”
+#define EX_HELP “example codec help string”
-snort --pcap-dir /path/to/pcap/dir --pcap-filter '*.pcap' -K text -d -e
+struct Example
+{
+ uint8_t dst[6];
+ uint8_t src[6];
+ uint16_t ethertype;
-Log packets to a directory:
+ static inline uint8_t size()
+ { return 14; }
+}
-snort --pcap-dir /path/to/pcap/dir --pcap-filter '*.pcap' -K pcap -l /path/to/log/dir
+class ExCodec : public Codec
+{
+public:
+ ExCodec() : Codec(EX_NAME) { }
+ ~ExCodec() { }
-14.2.4. Configuration
+ bool decode(const RawData&, CodecData&, DecodeData&) override;
+ void get_protocol_ids(std::vector<uint16_t>&) override;
+};
-Validate a configuration file:
+After defining ExCodec, the next step is adding the Codec’s decode
+functionality. The function below does this by implementing a valid
+decode function. The first parameter, which is the RawData struct,
+provides both a pointer to the raw data that has come from a wire and
+the length of that raw data. The function takes this information and
+validates that there are enough bytes for this protocol. If the raw
+data’s length is less than 14 bytes, the function returns false and
+Snort3.0 discards the packet; the packet is neither inspected nor
+processed. If the length is greater than 14 bytes, the function
+populates two fields in the CodecData struct, next_prot_id and
+lyr_len. The lyr_len field tells Snort3.0 the number of bytes that
+this layer contains. The next_prot_id field provides Snort3.0 the
+value of the next EtherType or IP protocol number.
-snort -c $my_path/etc/snort/snort.lua
+bool ExCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
+{
+ if ( raw.len < Example::size() )
+ return false;
-Validate a configuration file and a separate rules file:
+ const Example* const ex = reinterpret_cast<const Example*>(raw.data);
+ codec.next_prot_id = ntohs(ex->ethertype);
+ codec.lyr_len = ex->size();
+ return true;
+}
-snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules
+For instance, assume this decode function receives the following raw
+data with a validated length of 32 bytes:
-Read rules from stdin and validate:
+00 11 22 33 44 55 66 77 88 99 aa bb 08 00 45 00
+00 38 00 01 00 00 40 06 5c ac 0a 01 02 03 0a 09
-snort -c $my_path/etc/snort/snort.lua --stdin-rules < $my_path/etc/snort/sample.rules
+The Example struct’s EtherType field is the 13 and 14 bytes.
+Therefore, this function tells Snort that the next protocol has an
+EtherType of 0x0800. Additionally, since the lyr_len is set to 14,
+Snort knows that the next protocol begins 14 bytes after the
+beginning of this protocol. The Codec with EtherType 0x0800, which
+happens to be the IPv4 Codec, will receive the following data with a
+validated length of 18 ( == 32 – 14):
-Enable warnings for Lua configurations and make warnings fatal:
+45 00 00 38 00 01 00 00 40 06 5c ac 0a 01 02 03
+0a 09
-snort -c $my_path/etc/snort/snort.lua --warn-all --pedantic
+How does Snort3.0 know that the IPv4 Codec has an EtherType of
+0x0800? The Codec class has a second virtual function named
+get_protocol_ids(). When implementing the function, a Codec can
+register for any number of values between 0x0000 - 0xFFFF. Then, if
+the next_proto_id is set to a value for which this Codec has
+registered, this Codec’s decode function will be called. As a general
+note, the protocol ids between [0, 0x00FF] are IP protocol numbers,
+[0x0100, 0x05FF] are custom types, and [0x0600, 0xFFFF] are
+EtherTypes.
-Tell Snort++ where to look for additional Lua scripts:
+For example, in the get_protocol_ids function below, the ExCodec
+registers for the protocols numbers 17, 787, and 2054. 17 happens to
+be the protocol number for UDP while 2054 is ARP’s EtherType.
+Therefore, this Codec will now attempt to decode UDP and ARP data.
+Additionally, if any Codec sets the next_protocol_id to 787,
+ExCodec’s decode function will be called. Some custom protocols are
+already defined in the file "protocols/protocol_ids.h"
-snort --script-path /path/to/script/dir
+void ExCodec::get_protocol_ids(std::vector<uint16_t>&v)
+{
+ v.push_back(0x0011); // == 17 == UDP
+ v.push_back(0x1313); // == 787 == custom
+ v.push_back(0x0806); // == 2054 == ARP
+}
-14.2.5. IDS mode
+To register a Codec for Data Link Type’s rather than protocols, the
+function get_data_link_type() can be similarly implemented.
-Run Snort++ in IDS mode, reading packets from a pcap:
+The final step to creating a pluggable Codec is the snort_plugins
+array. This array is important because when Snort3.0 loads a dynamic
+library, the program only find plugins that are inside the
+snort_plugins array. In other words, if a plugin has not been added
+to the snort_plugins array, that plugin will not be loaded into
+Snort3.0.
-snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap
-
-Log any generated alerts to the console using the "-A" option:
+Although the details will not be covered in this post, the following
+code snippet is a basic CodecApi that Snort3.0 can load. This snippet
+can be copied and used with only three minor changes. First, in the
+function ctor, ExCodec should be replaced with the name of the Codec
+that is being built. Second, EX_NAME must match the Codec’s name or
+Snort will be unable to load this Codec. Third, EX_HELP should be
+replaced with the general description of this Codec. Once this code
+snippet has been added, ExCodec is ready to be compiled and plugged
+into Snort3.0.
-snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A alert_full
+static Codec* ctor(Module*)
+{ return new ExCodec; }
-Add or modify a configuration from the command line using the "--lua"
-option:
+static void dtor(Codec *cd)
+{ delete cd; }
-snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A cmg \
- --lua 'ips = { enable_builtin_rules = true }'
+static const CodecApi ex_api =
+{
+ {
+ PT_CODEC,
+ EX_NAME,
+ EX_HELP,
+ CDAPI_PLUGIN_V0,
+ 0,
+ nullptr,
+ nullptr,
+ },
+ nullptr, // pointer to a function called during Snort's startup.
+ nullptr, // pointer to a function called during Snort's exit.
+ nullptr, // pointer to a function called during thread's startup.
+ nullptr, // pointer to a function called during thread's destruction.
+ ctor, // pointer to the codec constructor.
+ dtor, // pointer to the codec destructor.
+};
-Note
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &ex_api.base,
+ nullptr
+};
-The "--lua" option can be specified multiple times.
+Two example Codecs are available in the extra directory on git and
+the extra tarball on the Snort3.0 page. One of those examples is the
+Token Ring Codec while the other example is the PIM Codec.
-Run Snort++ in IDS mode on an entire directory of pcaps, processing
-each input source on a separate thread:
+As a final note, there are four more virtual functions that a Codec
+should implement: encode, format, update, and log. If the functions
+are not implemented Snort will not throw any errors. However, Snort
+may also be unable to accomplish some of its basic functionality.
-snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \
- --pcap-filter '*.pcap' --max-packet-threads 8
+ * encode is called whenever Snort actively responds and needs to
+ builds a packet, i.e. whenever a rule using an IPS ACTION like
+ react, reject, or rewrite is triggered. This function is used to
+ build the response packet protocol by protocol.
+ * format is called when Snort is rebuilding a packet. For instance,
+ every time Snort reassembles a TCP stream or IP fragment, format
+ is called. Generally, this function either swaps any source and
+ destination fields in the protocol or does nothing.
+ * update is similar to format in that it is called when Snort is
+ reassembling a packet. Unlike format, this function only sets
+ length fields.
+ * log is called when either the log_codecs logger or a custom
+ logger that calls PacketManager::log_protocols is used when
+ running Snort3.0.
-14.3. Plugins
+14.5. IPS Actions
------------
-Load external plugins and use the "ex" alert:
-
-snort -c $my_path/etc/snort/snort.lua \
- --plugin-path $my_path/lib/snort_extra \
- -A alert_ex -r /path/to/my.pcap
+Action plugins specify a builtin action in the API which is used to
+determine verdict. (Conversely, builtin actions don’t have an
+associated plugin function.)
-Test the LuaJIT rule option find loaded from stdin:
-snort -c $my_path/etc/snort/snort.lua \
- --script-path $my_path/lib/snort_extra \
- --stdin-rules -A cmg -r /path/to/my.pcap << END
-alert tcp any any -> any 80 (
- sid:3; msg:"found"; content:"GET";
- find:"pat='HTTP/1%.%d'" ; )
-END
+---------------------------------------------------------------------
+15. Coding Style
-14.4. Output Files
+---------------------------------------------------------------------
-------------
+All new code should try to follow these style guidelines. These are
+not yet firm so feedback is welcome to get something we can live
+with.
-To make it simple to configure outputs when you run with multiple
-packet threads, output files are not explicitly configured. Instead,
-you can use the options below to format the paths:
-<logdir>/[<run_prefix>][<id#>][<X>]<name>
+15.1. General
-Log to unified in the current directory:
+------------
-snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2
+ * Generally try to follow http://google-styleguide.googlecode.com/
+ svn/trunk/cppguide.xml, but there are a few differences.
-Log to unified in the current directory with a different prefix:
-snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2 \
- --run-prefix take2
+15.2. Naming
-Log to unified in /tmp:
+------------
-snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2 -l /tmp
+ * Use camel case for namespaces, classes, and types like
+ WhizBangPdfChecker.
+ * Use lower case identifiers with underscore separators, e.g.
+ some_function() and my_var.
+ * Use lower case filenames with underscores.
-Run 4 packet threads and log with thread number prefix (0-3):
-snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \
- --pcap-filter '*.pcap' -z 4 -A unified2
+15.3. Comments
-Run 4 packet threads and log in thread number subdirs (0-3):
+------------
-snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \
- --pcap-filter '*.pcap' -z 4 -A unified2 --id-subdir
+ * Write comments sparingly with a mind towards future proofing.
+ Often the comments can be obviated with better code. Clear code
+ is better than a comment.
+ * Function comment blocks are generally just noise that quickly
+ becomes obsolete. If you absolutely must comment on parameters,
+ put each on a separate line along with the comment. That way
+ changing the signature may prompt a change to the comments too.
+ * Use FIXIT (not FIXTHIS or TODO or whatever) to mark things left
+ for a day or even just a minute. That way we can find them easily
+ and won’t lose track of them.
+ * Presently using FIXIT-X where X = P | H | M | L, indicating perf,
+ high, med, or low priority. For now, H, M, or L can indicate
+ alpha 1, 2, or 3. Perf changes fall between alpha 1 and 2.
+ * Put the copyright(s) and license in a comment block at the top of
+ each source file (.h and .cc). Don’t bother with trivial scripts
+ and make foo. Some interesting Lua code should get a comment
+ block too. Copy and paste exactly from src/main.h (don’t
+ reformat).
+ * Put author, description, etc. in separate comment(s) following
+ the license. Do not put such comments in the middle of the
+ license foo.
-Note
-subdirectories are created automatically if required. Log filename is
-based on module name that writes the file. All text mode outputs
-default to stdout. These options can be combined.
+15.4. Logging
-14.4.1. Shell
+------------
-You must build with --enable-shell to make the command line shell
-available.
+ * Messages intended for the user should not look like debug
+ messages. Eg, the function name should not be included.
+ * Most debug messages should just be deleted.
+ * Don’t bang your error messages (no !). The user feels bad enough
+ about the problem already w/o you shouting at him.
-Enable shell mode:
-snort --shell <args>
+15.5. Types
-You will see the shell mode command prompt, which looks like this:
+------------
-o")~
+ * Use logical types to make the code clearer and to help the
+ compiler catch problems. typedef uint16_t Port; bool foo(Port) is
+ way better than int foo(int port).
+ * Use forward declarations (e.g. struct SnortConfig;) instead of
+ void*.
+ * Try not to use extern data unless absolutely necessary and then
+ put the extern in an appropriate header.
+ * Use const liberally. In most cases, const char* s = "foo" should
+ be const char* const s = "foo". The former goes in the
+ initialized data section and the latter in read only data
+ section.
+ * But use const char s[] = "foo" instead of const char* s = "foo"
+ when possible. The latter form allocates a pointer variable and
+ the data while the former allocates only the data.
+ * Use static wherever possible to minimize public symbols and
+ eliminate unneeded relocations.
+ * Declare functions virtual only in the parent class introducing
+ the function (not in a derived class that is overriding the
+ function). This makes it clear which class introduces the
+ function.
+ * Declare functions as override if they are intended to override a
+ function. This makes it possible to find derived implementations
+ that didn’t get updated and therefore won’t get called due a
+ change in the parent signature.
+ * Use bool functions instead of int unless there is truly a need
+ for multiple error returns. The C-style use of zero for success
+ and -1 for error is less readable and often leads to messy code
+ that either ignores the various errors anyway or needlessly and
+ ineffectively tries to do something aobut them.
-(The prompt can be changed with the SNORT_PROMPT environment
-variable.)
-You can pause immediately after loading the configuration and again
-before exiting with:
+15.6. Macros (aka defines)
-snort --shell --pause <args>
+------------
-In that case you must issue the resume() command to continue. Enter
-quit() to terminate Snort or detach() to exit the shell. You can list
-the available commands with help().
+ * In many cases, even in C++, use #define name "value" instead of a
+ const char* const name = "value" because it will eliminate a
+ symbol from the binary.
+ * Use inline functions instead of macros where possible (pretty
+ much all cases except where stringification is necessary).
+ Functions offer better typing, avoid re-expansions, and a
+ debugger can break there.
+ * All macros except simple const values should be wrapped in () and
+ all args should be wrapped in () too to avoid surprises upon
+ expansion. Example:
-To enable local telnet access on port 12345:
+ #define SEQ_LT(a,b) ((int)((a) - (b)) < 0)
-snort --shell -j 12345 <args>
+ * Multiline macros should be blocked (i.e. inside { }) to avoid
+ if-else type surprises.
-The command line interface is still under development. Suggestions
-are welcome.
-14.4.2. Signals
+15.7. Formatting
-Note
+------------
-The following examples assume that Snort++ is currently running and
-has a process ID of <pid>.
+ * Indent 4 space chars … no tabs!
+ * If you need to indent many times, something could be rewritten or
+ restructured to make it clearer. Fewer indents is generally
+ easier to write, easier to read, and overall better code.
+ * Braces go on the line immediately following a new scope (function
+ signature, if, else, loop, switch, etc.
+ * Use consistent spacing and line breaks. Always indent 4 spaces
+ from the breaking line. Keep lines less than 100 chars; it
+ greatly helps readability.
-Modify and Reload Configuration:
+ No:
+ calling_a_func_with_a_long_name(arg1,
+ arg2,
+ arg3);
-echo 'suppress = { { gid = 1, sid = 2215 } }' >> $my_path/etc/snort/snort.lua
-kill -hup <pid>
+ Yes:
+ calling_a_func_with_a_long_name(
+ arg1, arg2, arg3);
-Dump stats to stdout:
+ * Put function signature on one line, except when breaking for the
+ arg list:
-kill -usr1 <pid>
+ No:
+ inline
+ bool foo()
+ { // ...
-Shutdown normally:
+ Yes:
+ inline bool foo()
+ { // ...
-kill -term <pid>
+ * Put conditional code on the line following the if so it is easy
+ to break on the conditional block:
-Exit without flushing packets:
+ No:
+ if ( test ) foo();
-kill -quit <pid>
+ Yes:
+ if ( test )
+ foo();
-List available signals:
-snort --help-signals
+15.8. Headers
-Note
+------------
-The available signals may vary from platform to platform.
+ * Don’t hesitate to create a new header if it is needed. Don’t lump
+ unrelated stuff into an header because it is convenient.
+ * Write header guards like this (leading underscores are reserved
+ for system stuff). In my_header.h:
+ #ifndef MY_HEADER_H
+ #define MY_HEADER_H
+ // ...
+ #endif
-14.5. Optional Features
+ * Includes from a different directory should specify parent
+ directory. This makes it clear exactly what is included and
+ avoids the primordial soup that results from using -I this -I
+ that -I the_other_thing … .
-------------
+ // given:
+ src/foo/foo.cc
+ src/bar/bar.cc
+ src/bar/baz.cc
-Listed below are the features that must be explicitly enabled so they
-are built into the Snort binary. For a full list of build features,
-run ./configure --help.
+ // in baz.cc
+ #include "bar.h"
- * --enable-ppm: enable packet and rule performance monitoring and
- coarse latency enforcement.
- * --enable-perf-profiling: enable module and rule performance
- profiling.
- * --enable-shell: enable local and remote command line shell
- support.
+ // in foo.cc
+ #include "bar/bar.h"
+
+ * Just because it is a #define doesn’t mean it goes in a header.
+ Everything should be scoped as tightly as possible. Shared
+ implementation declarations should go in a separate header from
+ the interface. And so on.
+ * A .cc should include its own .h before any others (including
+ system headers). This ensures that the header stands on its own
+ and can be used by clients without include prerequisites.
+ * Include required headers, all required headers, and nothing but
+ required headers. Don’t just clone a bunch of headers because it
+ is convenient.
+ * Any file depending of #ifdefs should include config.h as shown
+ below. A .h should include it before any other includes, and a
+ .cc should include it immediately after the include of its own
+ .h.
+
+ #ifdef HAVE_CONFIG_H
+ #include "config.h"
+ #endif
+
+ * Do not put using statements in headers.
-14.6. Environment Variables
+15.9. Warnings
------------
- * HOSTTYPE: optional string that is output with the version at end
- of line.
- * LUA_PATH: you must export as follows so LuaJIT can find required
- files.
+ * With g++, use at least these compiler flags:
- LUA_PATH=$install_dir/include/snort/lua/\?.lua\;\;
+ -Wall -Wextra -pedantic -Wformat -Wformat-security
+ -Wunused-but-set-variable -Wno-deprecated-declarations
- * SNORT_IGNORE: the list of symbols Snort should ignore when
- parsing the Lua conf. Unknown symbols not in SNORT_IGNORE will
- cause warnings with --warn-unknown or fatals with --warn-unknown
- --pedantic.
- * SNORT_LUA_PATH: an optional path where Snort can find
- supplemental conf files such as classification.lua.
- * SNORT_PROMPT: the character sequence that is printed at startup,
- shutdown, and in the shell. The default is the mini-pig: o")~ .
- * SNORT_PLUGIN_PATH: an optional path where Snort can find
- supplemental shared libraries. This is only used when Snort is
- building manuals. Modules in supplemental shared libraries will
- be added to the manuals.
+ * Then Fix All Warnings. None Allowed.
-14.7. Command Line Options
-
-------------
-
- 0 gets the number of CPU cores reported by the system
- 0 gets the number of CPU cores reported by the system
-* *--alert-before-pass* process alert, drop, sdrop, or reject before pass; default is pass before alert, drop,...
-* *--bpf* <filter options> are standard BPF options, as seen in TCPDump
-* *--c2x* output hex for given char (see also --x2c)
-* *--create-pidfile* create PID file, even when not in Daemon mode
-* *--daq* <type> select packet acquisition module (default is pcap)
-* *--daq-dir* <dir> tell snort where to find desired DAQ
-* *--daq-list* list packet acquisition modules available in optional dir, default is static modules only
-* *--daq-mode* <mode> select the DAQ operating mode
-* *--daq-var* <name=value> specify extra DAQ configuration variable
-* *--dirty-pig* don't flush packets on shutdown
-* *--dump-builtin-rules* [<module prefix>] output stub rules for selected modules
-* *--dump-defaults* [<module prefix>] output module defaults in Lua format
-* *--dump-dynamic-rules* output stub rules for all loaded rules libraries
-* *--dump-version* output the version, the whole version, and only the version
-* *--enable-inline-test* enable Inline-Test Mode Operation
-* *--help* list command line options
-* *--help-commands* [<module prefix>] output matching commands
-* *--help-config* [<module prefix>] output matching config options
-* *--help-counts* [<module prefix>] output matching peg counts
-* *--help-module* <module> output description of given module
-* *--help-modules* list all available modules with brief help
-* *--help-options* <option prefix> output matching command line option quick help (same as -?)
-* *--help-plugins* list all available plugins with brief help
-* *--help-signals* dump available control signals
-* *--id-subdir* create/use instance subdirectories in logdir instead of instance filename prefix
-* *--id-zero* use id prefix / subdirectory even with one packet thread
-* *--list-buffers* output available inspection buffers
-* *--list-builtin* <module prefix> output matching builtin rules
-* *--list-gids* [<module prefix>] output matching generators
-* *--list-modules* [<module type>] list all known modules of given type
-* *--list-plugins* list all known plugins
-* *--logid* <0xid> log Identifier to uniquely id events for multiple snorts (same as -G)
-* *--lua* <chunk> extend/override conf with chunk; may be repeated
-* *--markup* output help in asciidoc compatible format
-* *--max-packet-threads* <count> configure maximum number of packet threads (same as -z)
-* *--nolock-pidfile* do not try to lock Snort PID file
-* *--nostamps* don't include timestamps in log file names
-* *--pause* wait for resume/quit command before processing packets/terminating
-* *--pcap-dir* <dir> a directory to recurse to look for pcaps - read mode is implied
-* *--pcap-file* <file> file that contains a list of pcaps to read - read mode is implied
-* *--pcap-filter* <filter> filter to apply when getting pcaps from file or directory
-* *--pcap-list* <list> a space separated list of pcaps to read - read mode is implied
-* *--pcap-loop* <count> read all pcaps <count> times; 0 will read until Snort is terminated
-* *--pcap-no-filter* reset to use no filter when getting pcaps from file or directory
-* *--pcap-reload* if reading multiple pcaps, reload snort config between pcaps
-* *--pcap-reset* ignored - for REG_TEST only
-* *--pcap-show* print a line saying what pcap is currently being read
-* *--pedantic* warnings are fatal
-* *--plugin-path* <path> where to find plugins
-* *--process-all-events* process all action groups
-* *--rule* <rules> to be added to configuration; may be repeated
-* *--rule-to-hex* output so rule header to stdout for text rule on stdin
-* *--rule-to-text* output plain so rule header to stdout for text rule on stdin
-* *--run-prefix* <pfx> prepend this to each output file
-* *--script-path* <path> where to find luajit scripts
-* *--shell* enable the interactive command line
-* *--show-plugins* list module and plugin versions
-* *--skip* <n> skip 1st n packets
-* *--snaplen* <snap> set snaplen of packet (same as -s)
-* *--stdin-rules* read rules from stdin until EOF or a line starting with END is read
-* *--treat-drop-as-alert* converts drop, sdrop, and reject rules into alert rules during startup
-* *--treat-drop-as-ignore* use drop, sdrop, and reject rules to ignore session traffic when not inline
-* *--version* show version number (same as -V)
-* *--warn-all* enable all warnings
-* *--warn-conf* warn about configuration issues
-* *--warn-daq* warn about DAQ issues, usually related to mode
-* *--warn-flowbits* warn about flowbits that are checked but not set and vice-versa
-* *--warn-hosts* warn about host table issues
-* *--warn-rules* warn about duplicate rules and rule parsing issues
-* *--warn-scripts* warn about issues discovered while processing Lua scripts
-* *--warn-symbols* warn about unknown symbols in your Lua config
-* *--warn-vars* warn about variable definition and usage issues
-* *--x2c* output ASCII char for given hex (see also --c2x)
-* *-?* <option prefix> output matching command line option quick help (same as --help-options)
-* *-A* <mode> set alert mode: none, cmg, or alert_*
-* *-B* <mask> obfuscated IP addresses in alerts and packet dumps using CIDR mask
-* *-C* print out payloads with character data only (no hex)
-* *-D* run Snort in background (daemon) mode
-* *-E* enable daemon restart
-* *-G* <0xid> (same as --logid)
-* *-H* make hash tables deterministic
-* *-K* <mode> logging mode
-* *-M* log messages to syslog (not alerts)
-* *-N* ignored - for REG_TEST only
-* *-O* obfuscate the logged IP addresses
-* *-Q* enable inline mode operation
-* *-R* <rules> include this rules file in the default policy
-* *-S* <n=v> set rules file variable n equal to value v
-* *-T* test and report on the current Snort configuration
-* *-U* use UTC for timestamps
-* *-V* (same as --version)
-* *-W* lists available interfaces
-* *-X* dump the raw packet data starting at the link layer
-* *-c* <conf> use this configuration
-* *-d* dump the Application Layer
-* *-e* display the second layer header info
-* *-f* turn off fflush() calls after binary log writes
-* *-g* <gname> run snort gid as <gname> group (or gid) after initialization
-* *-i* <iface>... list of interfaces
-* *-j* <port> to listen for telnet connections
-* *-k* <mode> checksum mode (all,noip,notcp,noudp,noicmp,none)
-* *-l* <logdir> log to this directory instead of current directory
-* *-m* <umask> set umask = <umask>
-* *-n* <count> stop after count packets
-* *-q* quiet mode - Don't show banner and status report
-* *-r* <pcap>... (same as --pcap-list)
-* *-s* <snap> (same as --snaplen)
-* *-t* <dir> chroots process to <dir> after initialization
-* *-u* <uname> run snort as <uname> or <uid> after initialization
-* *-v* be verbose
-* *-w* dump 802.11 management and control frames
-* *-x* same as --pedantic
-* *-y* include year in timestamp in the alert and log files
-* *-z* <count> maximum number of packet threads (same as --max-packet-threads)
-
-
-14.8. Parameters
+15.10. Other
------------
-Parameters are given with this format:
+ * Prefer and over && and or over || for new source files.
-type name = default: help { range }
-The following types are used:
+15.11. Uncrustify
- * addr: any valid IP4 or IP6 address or CIDR
- * addr_list: a space separated list of addr values
- * bit_list: a list of consecutive integer values from 1 to the
- range maximum
- * bool: true or false
- * enum: a string selected from the given range
- * implied: a IPS rule option that takes no value but means true
- * int: a whole number in the given range
- * ip4: an IP4 address or CIDR
- * mac: an ethernet address with the form 01:02:03:04:05:06
- * multi: one or more space separated strings from the given range
- * port: an int in the range 0:65535 indicating a TCP or UDP port
- number
- * real: a real number in the given range
- * select: a string selected from the given range
+------------
-The parameter name may be adorned in various ways to indicate
-additional information about the type and use of the parameter:
+Currently using uncrustify from at https://github.com/bengardner/
+uncrustify to reformat legacy code and anything that happens to need
+a makeover at some point.
- * For Lua configuration (not IPS rules), if the name ends with []
- it is a list item and can be repeated.
- * For IPS rules only, names starting with ~ indicate positional
- parameters. The names of such parameters do not appear in the
- rule.
- * IPS rules may also have a wild card parameter, which is indicated
- by a *. Only used for metadata that Snort ignores.
- * The snort module has command line options starting with a -.
+The working config is crusty.cfg in the top level directory. It does
+well but will munge some things. Specially formatted INDENT-OFF
+comments were added in 2 places to avoid a real mess.
-Some additional details to note:
- * Table and variable names are case sensitive; use lower case only.
- * String values are case sensitive too; use lower case only.
- * Numeric ranges may be of the form low:high where low and high are
- bounds included in the range. If either is omitted, there is no
- hard bound. E.g. 0: means any x where x >= 0.
- * Strings may have a numeric range indicating a length limit;
- otherwise there is no hard limit.
- * bit_list is typically used to store a set of byte, port, or VLAN
- ID values.
+---------------------------------------------------------------------
+
+16. Reference
+
+---------------------------------------------------------------------
-14.9. Configuration
+16.1. Terminology
------------
- * string ack.~range: check if packet payload size is size | min<>
- max | <max | >min
- * int active.attempts = 0: number of TCP packets sent per response
- (with varying sequence numbers) { 0:20 }
- * string active.device: use ip for network layer responses or eth0
- etc for link layer
- * string active.dst_mac: use format 01:23:45:67:89:ab
- * int active.max_responses = 0: maximum number of responses { 0: }
- * int active.min_interval = 255: minimum number of seconds between
- responses { 1: }
- * multi alert_csv.csv = timestamp gid sid rev src_addr src_port
- dst_addr dst_port: selected fields will be output in given order
- left to right { timestamp | gid | sid | rev | msg | proto |
- src_addr | dst_addr | src_port | dst_port | eth_src | eth_dst |
- eth_type | eth_len | ttl | tos | id | ip_len | dgm_len |
- icmp_type | icmp_code | icmp_id | icmp_seq | tcp_flags | tcp_seq
- | tcp_ack | tcp_len | tcp_win | udp_len }
- * bool alert_csv.file = false: output to alert_csv.txt instead of
- stdout
- * int alert_csv.limit = 0: set limit (0 is unlimited) { 0: }
- * enum alert_csv.units = B: bytes | KB | MB | GB { B | K | M | G }
- * bool alert_fast.file = false: output to alert_fast.txt instead of
- stdout
- * int alert_fast.limit = 0: set limit (0 is unlimited) { 0: }
- * bool alert_fast.packet = false: output packet dump with alert
- * enum alert_fast.units = B: bytes | KB | MB | GB { B | K | M | G }
- * bool alert_full.file = false: output to alert_full.txt instead of
- stdout
- * int alert_full.limit = 0: set limit (0 is unlimited) { 0: }
- * enum alert_full.units = B: limit is in bytes | KB | MB | GB { B |
- K | M | G }
- * enum alert_syslog.facility = auth: part of priority applied to
- each message { auth | authpriv | daemon | user | local0 | local1
- | local2 | local3 | local4 | local5 | local6 | local7 }
- * enum alert_syslog.level = info: part of priority applied to each
- message { emerg | alert | crit | err | warning | notice | info |
- debug }
- * multi alert_syslog.options: used to open the syslog connection {
- cons | ndelay | perror | pid }
- * bool alert_test.file = false: output to alert_test.txt instead of
- stdout
- * bool alert_test.msg = false: include alert msg
- * bool alert_test.rebuilt = false: include type:count where type is
- S for stream and F for frag
- * bool alert_test.session = false: include src-dst each of form
- -addr:port
- * bool alerts.alert_with_interface_name = false: include interface
- in alert info (fast, full, or syslog only)
- * bool alerts.default_rule_state = true: enable or disable ips
- rules
- * int alerts.detection_filter_memcap = 1048576: set available
- memory for filters { 0: }
- * int alerts.event_filter_memcap = 1048576: set available memory
- for filters { 0: }
- * int alerts.flowbits_size = 1024: maximum number of allowed unique
- flowbits { 0:2048 }
- * string alerts.order = pass drop alert log: change the order of
- rule action application
- * int alerts.rate_filter_memcap = 1048576: set available memory for
- filters { 0: }
- * string alerts.reference_net: set the CIDR for homenet (for use
- with -l or -B, does NOT change $HOME_NET in IDS mode)
- * bool alerts.stateful = false: don’t alert w/o established session
- (note: rule action still taken)
- * string alerts.tunnel_verdicts: let DAQ handle non-allow verdicts
- for GTP|Teredo|6in4|4in6 traffic
- * ip4 arp_spoof.hosts[].ip: host ip address
- * mac arp_spoof.hosts[].mac: host mac address
- * int asn1.absolute_offset: Absolute offset from the beginning of
- the packet. { 0: }
- * implied asn1.bitstring_overflow: Detects invalid bitstring
- encodings that are known to be remotely exploitable.
- * implied asn1.double_overflow: Detects a double ASCII encoding
- that is larger than a standard buffer.
- * int asn1.oversize_length: Compares ASN.1 type lengths with the
- supplied argument. { 0: }
- * implied asn1.print: <>max | <max | >min
- * int asn1.relative_offset: relative offset from the cursor.
- * int attribute_table.max_hosts = 1024: maximum number of hosts in
- attribute table { 32:207551 }
- * int attribute_table.max_metadata_services = 8: maximum number of
- services in rule metadata { 1:256 }
- * int attribute_table.max_services_per_host = 8: maximum number of
- services per host entry in attribute table { 1:65535 }
- * int base64_decode.bytes: Number of base64 encoded bytes to
- decode. { 1: }
- * int base64_decode.offset = 0: Bytes past start of buffer to start
- decoding. { 0: }
- * implied base64_decode.relative: Apply offset to cursor instead of
- start of buffer.
- * enum binder[].use.action = inspect: what to do with matching
- traffic { block | allow | inspect }
- * string binder[].use.file: use configuration in given file
- * string binder[].use.name: symbol name (defaults to type)
- * string binder[].use.service: override automatic service
- identification
- * string binder[].use.type: select module for binding
- * bit_list binder[].when.ifaces: list of interface indices { 255 }
- * addr_list binder[].when.nets: list of networks
- * int binder[].when.policy_id = 0: unique ID for selection of this
- config by external logic { 0: }
- * bit_list binder[].when.ports: list of ports { 65535 }
- * enum binder[].when.proto: protocol { any | ip | icmp | tcp | udp
- }
- * enum binder[].when.role = any: use the given configuration on one
- or any end of a session { client | server | any }
- * string binder[].when.service: override default configuration
- * bit_list binder[].when.vlans: list of VLAN IDs { 4095 }
- * string bufferlen.~range: len | min<>max | <max | >min
- * int byte_extract.align = 0: round the number of converted bytes
- up to the next 2- or 4-byte boundary { 0:4 }
- * implied byte_extract.big: big endian
- * implied byte_extract.dce: dcerpc2 determines endianness
- * implied byte_extract.dec: convert from decimal string
- * implied byte_extract.hex: convert from hex string
- * implied byte_extract.little: little endian
- * int byte_extract.multiplier = 1: scale extracted value by given
- amount { 1:65535 }
- * implied byte_extract.oct: convert from octal string
- * implied byte_extract.relative: offset from cursor instead of
- start of buffer
- * implied byte_extract.string: convert from string
- * int byte_extract.~count: number of bytes to pick up from the
- buffer { 1:10 }
- * string byte_extract.~name: name of the variable that will be used
- in other rule options
- * int byte_extract.~offset: number of bytes into the buffer to
- start processing { -65535:65535 }
- * int byte_jump.align = 0: round the number of converted bytes up
- to the next 2- or 4-byte boundary { 0:4 }
- * implied byte_jump.big: big endian
- * implied byte_jump.dce: dcerpc2 determines endianness
- * implied byte_jump.dec: convert from decimal string
- * implied byte_jump.from_beginning: jump from start of buffer
- instead of cursor
- * implied byte_jump.hex: convert from hex string
- * implied byte_jump.little: little endian
- * int byte_jump.multiplier = 1: scale extracted value by given
- amount { 1:65535 }
- * implied byte_jump.oct: convert from octal string
- * int byte_jump.post_offset = 0: also skip forward or backwards
- (positive of negative value) this number of bytes { -65535:65535
- }
- * implied byte_jump.relative: offset from cursor instead of start
- of buffer
- * implied byte_jump.string: convert from string
- * int byte_jump.~count: number of bytes to pick up from the buffer
- { 1:10 }
- * string byte_jump.~offset: variable name or number of bytes into
- the buffer to start processing
- * implied byte_test.big: big endian
- * implied byte_test.dce: dcerpc2 determines endianness
- * implied byte_test.dec: convert from decimal string
- * implied byte_test.hex: convert from hex string
- * implied byte_test.little: little endian
- * implied byte_test.oct: convert from octal string
- * implied byte_test.relative: offset from cursor instead of start
- of buffer
- * implied byte_test.string: convert from string
- * string byte_test.~compare: variable name or value to test the
- converted result against
- * int byte_test.~count: number of bytes to pick up from the buffer
- { 1:10 }
- * string byte_test.~offset: variable name or number of bytes into
- the payload to start processing
- * string byte_test.~operator: variable name or number of bytes into
- the buffer to start processing
- * string classifications[].name: name used with classtype rule
- option
- * int classifications[].priority = 1: default priority for class {
- 0: }
- * string classifications[].text: description of class
- * string classtype.~: classification for this rule
- * string content.depth: var or maximum number of bytes to search
- from beginning of buffer
- * string content.distance: var or number of bytes from cursor to
- start search
- * implied content.fast_pattern: use this content in the fast
- pattern matcher instead of the content selected by default
- * int content.fast_pattern_length: maximum number of characters
- from this content the fast pattern matcher should use { 1: }
- * int content.fast_pattern_offset = 0: number of leading characters
- of this content the fast pattern matcher should exclude { 0: }
- * implied content.nocase: case insensitive match
- * string content.offset: var or number of bytes from start of
- buffer to start search
- * string content.within: var or maximum number of bytes to search
- from cursor
- * string content.~data: data to match
- * implied cvs.invalid-entry: looks for an invalid Entry string
- * bool daq.decode_data_link = false: display the second layer
- header info
- * string daq.dir: directory where to search for DAQ plugins
- * select daq.mode: set mode of operation { passive | inline |
- read-file }
- * bool daq.no_promisc = false: whether to put DAQ device into
- promiscuous mode
- * int daq.snaplen = deflt: set snap length (same as -P) { 0:65535 }
- * string daq.type: select type of DAQ
- * string daq.vars: comma separated list of name=value DAQ-specific
- parameters
- * int detection.asn1 = 256: maximum decode nodes { 1: }
- * bool detection.pcre_enable = true: disable pcre pattern matching
- * int detection.pcre_match_limit = 1500: limit pcre backtracking,
- -1 = max, 0 = off { -1:1000000 }
- * int detection.pcre_match_limit_recursion = 1500: limit pcre stack
- consumption, -1 = max, 0 = off { -1:10000 }
- * int detection_filter.count: hits in interval before allowing the
- rule to fire { 1: }
- * int detection_filter.seconds: length of interval to count hits {
- 1: }
- * enum detection_filter.track: track hits by source or destination
- IP address { by_src | by_dst }
- * string dsize.~range: check if packet payload size is size | min<>
- max | <max | >min
- * bool esp.decode_esp = false: enable for inspection of esp traffic
- that has authentication but not encryption
- * int event_filter[].count = 0: number of events in interval before
- tripping; -1 to disable { -1: }
- * int event_filter[].gid = 1: rule generator ID { 0: }
- * string event_filter[].ip: restrict filter to these addresses
- according to track
- * int event_filter[].seconds = 0: count interval { 0: }
- * int event_filter[].sid = 1: rule signature ID { 0: }
- * enum event_filter[].track: filter only matching source or
- destination addresses { by_src | by_dst }
- * enum event_filter[].type: 1st count events | every count events |
- once after count events { limit | threshold | both }
- * int event_queue.log = 3: maximum events to log { 1: }
- * int event_queue.max_queue = 8: maximum events to queue { 1: }
- * enum event_queue.order_events = content_length: criteria for
- ordering incoming events { priority|content_length }
- * bool event_queue.process_all_events = false: process just first
- action group or all action groups
- * int file_id.block_timeout = 86400: stop blocking after this many
- seconds { 0: }
- * bool file_id.block_timeout_lookup = false: block if lookup times
- out
- * bool file_id.enable_signature = false: enable signature
- calculation
- * bool file_id.enable_type = false: enable type ID
- * string file_id.file_rules[].category: file type category
- * int file_id.file_rules[].id = 0: file type id { 0: }
- * string file_id.file_rules[].magic[].content: file magic content
- * int file_id.file_rules[].magic[].offset = 0: file magic offset {
- 0: }
- * string file_id.file_rules[].msg: information about the file type
- * int file_id.file_rules[].rev = 0: rule revision { 0: }
- * string file_id.file_rules[].type: file type name
- * string file_id.file_rules[].version: file type version
- * int file_id.lookup_timeout = 2: give up on lookup after this many
- seconds { 0: }
- * int file_id.show_data_depth = 100: print this many octets { 0: }
- * int file_id.signature_depth = 10485760: stop signature at this
- point { 0: }
- * int file_id.type_depth = 1460: stop type ID at this point { 0: }
- * string flags.~mask_flags: these flags are don’t cares
- * string flags.~test_flags: these flags are tested
- * implied flow.established: match only during data transfer phase
- * implied flow.from_client: same as to_server
- * implied flow.from_server: same as to_client
- * implied flow.no_frag: match on raw packets only
- * implied flow.no_stream: match on raw packets only
- * implied flow.not_established: match only outside data transfer
- phase
- * implied flow.only_frag: match on defragmented packets only
- * implied flow.only_stream: match on reassembled packets only
- * implied flow.stateless: match regardless of stream state
- * implied flow.to_client: match on server responses
- * implied flow.to_server: match on client requests
- * string flowbits.~arg1: bits or group
- * string flowbits.~arg2: group if arg1 is bits
- * string flowbits.~command: set|reset|isset|etc.
- * string fragbits.~flags: these flags are tested
- * string fragoffset.~range: check if packet payload size is size |
- min<>max | <max | >min
- * bool ftp_client.bounce = false: check for bounces
- * addr ftp_client.bounce_to[].address = 1.0.0.0/32: allowed ip
- address in CIDR format
- * port ftp_client.bounce_to[].last_port: optional allowed range
- from port to last_port inclusive { 0: }
- * port ftp_client.bounce_to[].port = 20: allowed port { 1: }
- * bool ftp_client.ignore_telnet_erase_cmds = false: ignore erase
- character and erase line commands when normalizing
- * int ftp_client.max_resp_len = -1: maximum ftp response accepted
- by client { -1: }
- * bool ftp_client.telnet_cmds = false: detect telnet escape
- sequences on ftp control channel
- * bool ftp_server.check_encrypted = false: check for end of
- encryption
- * string ftp_server.chk_str_fmt: check the formatting of the given
- commands
- * string ftp_server.cmd_validity[].command: command string
- * string ftp_server.cmd_validity[].format: format specification
- * int ftp_server.cmd_validity[].length = 0: specify non-default
- maximum for command { 0: }
- * string ftp_server.data_chan_cmds: check the formatting of the
- given commands
- * string ftp_server.data_xfer_cmds: check the formatting of the
- given commands
- * int ftp_server.def_max_param_len = 100: default maximum length of
- commands handled by server; 0 is unlimited { 1: }
- * string ftp_server.directory_cmds[].dir_cmd: directory command
- * int ftp_server.directory_cmds[].rsp_code = 200: expected
- successful response code for command { 200: }
- * string ftp_server.encr_cmds: check the formatting of the given
- commands
- * bool ftp_server.encrypted_traffic = false: check for encrypted
- telnet and ftp
- * string ftp_server.file_get_cmds: check the formatting of the
- given commands
- * string ftp_server.file_put_cmds: check the formatting of the
- given commands
- * string ftp_server.ftp_cmds: specify additional commands supported
- by server beyond RFC 959
- * bool ftp_server.ignore_data_chan = false: do not inspect ftp data
- channels
- * bool ftp_server.ignore_telnet_erase_cmds = false: ignore erase
- character and erase line commands when normalizing
- * string ftp_server.login_cmds: check the formatting of the given
- commands
- * bool ftp_server.print_cmds = false: print command configurations
- on start up
- * bool ftp_server.telnet_cmds = false: detect telnet escape
- sequences of ftp control channel
- * int gid.~: generator id { 1: }
- * enum hosts[].frag_policy: defragmentation policy { first | linux
- | bsd | bsd_right | last | windows | solaris }
- * addr hosts[].ip = 0.0.0.0/32: hosts address / cidr
- * string hosts[].services[].name: service identifier
- * port hosts[].services[].port: port number
- * enum hosts[].services[].proto = tcp: ip protocol { tcp | udp }
- * enum hosts[].tcp_policy: tcp reassembly policy { first | last |
- linux | old_linux | bsd | macos | solaris | irix | hpux11 |
- hpux10 | windows | win_2003 | vista | proxy }
- * int http_global.compress_depth = 65535: maximum amount of packet
- payload to decompress { 1:65535 }
- * int http_global.decode.b64_decode_depth = 0: single packet decode
- depth { -1:65535 }
- * int http_global.decode.bitenc_decode_depth = 0: single packet
- decode depth { -1:65535 }
- * int http_global.decode.max_mime_mem = 838860: single packet
- decode depth { 3276: }
- * int http_global.decode.qp_decode_depth = 0: single packet decode
- depth { -1:65535 }
- * int http_global.decode.uu_decode_depth = 0: single packet decode
- depth { -1:65535 }
- * int http_global.decompress_depth = 65535: maximum amount of
- decompressed data to process { 1:65535 }
- * bool http_global.detect_anomalous_servers = false: inspect
- non-configured ports for HTTP - bad idea
- * int http_global.max_gzip_mem = 838860: total memory used for
- decompression across all active sessions { 3276: }
- * int http_global.memcap = 150994944: limit of memory used for
- logging extra data { 2304: }
- * bool http_global.proxy_alert = false: alert on proxy usage for
- servers without allow_proxy_use
- * int http_global.unicode_map.code_page = 1252: select code page in
- map file { 0: }
- * string http_global.unicode_map.map_file: unicode map file
- * string http_header.~name: restrict to given header
- * bool http_inspect.allow_proxy_use = false: don’t alert on proxy
- use for this server
- * bool http_inspect.decompress_pdf = false: enable decompression of
- the compressed portions of PDF files
- * bool http_inspect.decompress_swf = false: enable decompression of
- SWF (Adobe Flash content)
- * bool http_inspect.enable_cookies = true: extract cookies
- * bool http_inspect.enable_xff = false: log True-Client-IP and
- X-Forwarded-For headers with unified2 alerts as extra data
- * bool http_inspect.extended_ascii_uri = false: allow extended
- ASCII codes in the request URI
- * bool http_inspect.extended_response_inspection = true: extract
- response headers
- * string http_inspect.http_methods = GET POST PUT SEARCH MKCOL COPY
- MOVE LOCK UNLOCK NOTIFY POLL BCOPY BDELETE BMOVE LINK UNLINK
- OPTIONS HEAD DELETE TRACE TRACK CONNECT SOURCE SUBSCRIBE
- UNSUBSCRIBE PROPFIND PROPPATCH BPROPFIND BPROPPATCH RPC_CONNECT
- PROXY_SUCCESS BITS_POST CCM_POST SMS_POST RPC_IN_DATA
- RPC_OUT_DATA RPC_ECHO_DATA: request methods allowed in addition
- to GET and POST
- * bool http_inspect.inspect_gzip = true: enable gzip decompression
- of compressed bodies
- * bool http_inspect.inspect_uri_only = false: disable all detection
- except for uricontent
- * bool http_inspect.log_hostname = false: enable logging of
- Hostname with unified2 alerts as extra data
- * bool http_inspect.log_uri = false: enable logging of URI with
- unified2 alerts as extra data
- * bool http_inspect.no_pipeline_req = false: don’t inspect
- pipelined requests after first (still does general detection)
- * bit_list http_inspect.non_rfc_chars = 0x00 0x01 0x02 0x03 0x04
- 0x05 0x06 0x07: alert on given non-RFC chars being present in the
- URI { 255 }
- * bool http_inspect.normalize_cookies = false: normalize cookies
- similar to URI
- * bool http_inspect.normalize_headers = false: normalize headers
- other than cookie similar to URI
- * int http_inspect.oversize_dir_length = 500: alert if a URL has a
- directory longer than this limit { 0: }
- * bool http_inspect.profile.apache_whitespace = false: don’t alert
- if tab is used in lieu of space characters
- * bool http_inspect.profile.ascii = false: enable decoding ASCII
- like %2f to /
- * bool http_inspect.profile.bare_byte = false: decode non-standard,
- non-ASCII character encodings
- * int http_inspect.profile.chunk_length = 500000: alert on chunk
- lengths greater than specified { 1: }
- * int http_inspect.profile.client_flow_depth = 0: raw request
- payload to inspect { -1:1460 }
- * bool http_inspect.profile.directory = false: normalize . and ..
- sequences out of URI
- * bool http_inspect.profile.double_decode = false: iis specific
- extra decoding
- * bool http_inspect.profile.iis_backslash = false: normalize
- directory slashes
- * bool http_inspect.profile.iis_delimiter = false: allow use of
- non-standard delimiter
- * bool http_inspect.profile.iis_unicode = false: enable unicode
- code point mapping using unicode_map settings
- * int http_inspect.profile.iis_unicode_map.code_page = 1252: select
- code page in map file { 0: }
- * string http_inspect.profile.iis_unicode_map.map_file: unicode map
- file
- * int http_inspect.profile.max_header_length = 750: maximum allowed
- client request header field { 0:65535 }
- * int http_inspect.profile.max_headers = 100: maximum allowed
- client request headers { 0:1024 }
- * int http_inspect.profile.max_javascript_whitespaces = 200:
- maximum number of consecutive whitespaces { 0: }
- * int http_inspect.profile.max_spaces = 200: maximum allowed
- whitespaces when folding { 0:65535 }
- * bool http_inspect.profile.multi_slash = false: normalize out
- consecutive slashes in URI
- * bool http_inspect.profile.non_strict = true: allows HTTP 0.9
- processing
- * bool http_inspect.profile.normalize_javascript = true: normalize
- javascript between <script> tags
- * bool http_inspect.profile.normalize_utf = true: normalize
- response bodies with UTF content-types
- * int http_inspect.profile.post_depth = 65495: amount of POST data
- to inspect { -1:65535 }
- * enum http_inspect.profile.profile_type = default: set defaults
- appropriate for selected server { default | apache | iis | iis_40
- | iis_50 }
- * int http_inspect.profile.server_flow_depth = 0: response payload
- to inspect; includes headers with extended_response_inspection {
- -1:65535 }
- * bool http_inspect.profile.u_encode = true: decode %uXXXX
- character sequences
- * bool http_inspect.profile.utf_8 = false: decode UTF-8 unicode
- sequences in URI
- * bool http_inspect.profile.webroot = false: alert on directory
- traversals past the top level (web server root)
- * bit_list http_inspect.profile.whitespace_chars: allowed white
- space characters { 255 }
- * int http_inspect.small_chunk_count = 5: alert if more than this
- limit of consecutive chunks are below small_chunk_length { 0:255
- }
- * int http_inspect.small_chunk_length = 10: alert if more than
- small_chunk_count consecutive chunks below this limit { 0:255 }
- * bool http_inspect.tab_uri_delimiter = false: whether a tab not
- preceded by a space is considered a delimiter or part of URI
- * bool http_inspect.unlimited_decompress = true: decompress across
- multiple packets
- * bool http_inspect.xff_headers = false: not implemented
- * string icmp_id.~range: check if icmp id is id | min<>max | <max |
- >min
- * string icmp_seq.~range: check if icmp sequence number is seq |
- min<>max | <max | >min
- * string icode.~range: check if ICMP code is code | min<>max | <max
- | >min
- * string id.~range: check if the IP ID is id | min<>max | <max | >
- min
- * int imap.b64_decode_depth = 1460: base64 decoding depth {
- -1:65535 }
- * int imap.bitenc_decode_depth = 1460: Non-Encoded MIME attachment
- extraction depth { -1:65535 }
- * int imap.qp_decode_depth = 1460: Quoted Printable decoding depth
- { -1:65535 }
- * int imap.uu_decode_depth = 1460: Unix-to-Unix decoding depth {
- -1:65535 }
- * string ip_proto.~proto: [!|>|<] name or number
- * select ipopts.~opt: output format { rr|eol|nop|ts|sec|esec|lsrr|
- lsrre|ssrr|satid|any }
- * bool ips.enable_builtin_rules = false: enable events from builtin
- rules w/o stubs
- * int ips.id = 0: correlate unified2 events with configuration {
- 0:65535 }
- * string ips.include: legacy snort rules and includes
- * enum ips.mode: set policy mode { tap | inline | inline-test }
- * string ips.rules: snort rules and includes
- * implied isdataat.relative: offset from cursor instead of start of
- buffer
- * string isdataat.~length: num | !num
- * string itype.~range: check if icmp type is type | min<>max | <max
- | >min
- * bool log_codecs.file = false: output to log_codecs.txt instead of
- stdout
- * bool log_codecs.msg = false: include alert msg
- * int log_pcap.limit = 0: set limit (0 is unlimited) { 0: }
- * enum log_pcap.units = B: bytes | KB | MB | GB { B | K | M | G }
- * int md5.length: number of octets in plain text { 1:65535 }
- * string md5.offset: var or number of bytes from start of buffer to
- start search
- * implied md5.relative = false: offset from cursor instead of start
- of buffer
- * string md5.~hash: data to match
- * string metadata.*: additional parameters not used by snort
- * string metadata.service: service name
- * bool mpls.enable_mpls_multicast = false: enables support for MPLS
- multicast
- * bool mpls.enable_mpls_overlapping_ip = false: enable if private
- network addresses overlap and must be differentiated by MPLS
- label(s)
- * int mpls.max_mpls_stack_depth = -1: set MPLS stack depth { -1: }
- * enum mpls.mpls_payload_type = ip4: set encapsulated payload type
- { eth | ip4 | ip6 }
- * string msg.~: message describing rule
- * multi network.checksum_drop = none: drop if checksum is bad { all
- | ip | noip | tcp | notcp | udp | noudp | icmp | noicmp | none }
- * multi network.checksum_eval = none: checksums to verify { all |
- ip | noip | tcp | notcp | udp | noudp | icmp | noicmp | none }
- * bool network.decode_drops = false: enable dropping of packets by
- the decoder
- * int network.id = 0: correlate unified2 events with configuration
- { 0:65535 }
- * int network.layers = 40: The maximum number of protocols that
- Snort can correctly decode { 3:255 }
- * int network.max_ip6_extensions = 0: The number of IP6 options
- Snort will process for a given IPv6 layer. If this limit is hit,
- rule 116:456 may fire. 0 = unlimited { 0:255 }
- * int network.max_ip_layers = 0: The maximum number of IP layers
- Snort will process for a given packet If this limit is hit, rule
- 116:293 may fire. 0 = unlimited { 0:255 }
- * int network.min_ttl = 1: alert / normalize packets with lower ttl
- / hop limit (you must enable rules and / or normalization also) {
- 1:255 }
- * int network.new_ttl = 1: use this value for responses and when
- normalizing { 1:255 }
- * bool new_http_inspect.test_input = false: read HTTP messages from
- text file
- * bool new_http_inspect.test_output = false: print out HTTP section
- data
- * bool normalizer.icmp4 = false: clear reserved flag
- * bool normalizer.icmp6 = false: clear reserved flag
- * bool normalizer.ip4.base = true: clear options
- * bool normalizer.ip4.df = false: clear don’t frag flag
- * bool normalizer.ip4.rf = false: clear reserved flag
- * bool normalizer.ip4.tos = false: clear tos / differentiated
- services byte
- * bool normalizer.ip4.trim = false: truncate excess payload beyond
- datagram length
- * bool normalizer.ip6 = false: clear reserved flag
- * string normalizer.tcp.allow_codes: don’t clear given option codes
- * multi normalizer.tcp.allow_names: don’t clear given option names
- { sack | echo | partial_order | conn_count | alt_checksum | md5 }
- * bool normalizer.tcp.base = true: clear reserved bits and option
- padding and fix urgent pointer / flags issues
- * bool normalizer.tcp.block = true: allow packet drops during TCP
- normalization
- * select normalizer.tcp.ecn = off: clear ecn for all packets |
- sessions w/o ecn setup { off | packet | stream }
- * bool normalizer.tcp.ips = false: ensure consistency in
- retransmitted data
- * bool normalizer.tcp.opts = true: clear all options except mss,
- wscale, timestamp, and any explicitly allowed
- * bool normalizer.tcp.pad = true: clear any option padding bytes
- * bool normalizer.tcp.req_pay = true: clear the urgent pointer and
- the urgent flag if there is no payload
- * bool normalizer.tcp.req_urg = true: clear the urgent pointer if
- the urgent flag is not set
- * bool normalizer.tcp.req_urp = true: clear the urgent flag if the
- urgent pointer is not set
- * bool normalizer.tcp.rsv = true: clear the reserved bits in the
- TCP header
- * bool normalizer.tcp.trim = false: enable all of the TCP trim
- options
- * bool normalizer.tcp.trim_mss = false: trim data to MSS
- * bool normalizer.tcp.trim_rst = false: remove any data from RST
- packet
- * bool normalizer.tcp.trim_syn = false: remove data on SYN
- * bool normalizer.tcp.trim_win = false: trim data to window
- * bool normalizer.tcp.urp = true: adjust urgent pointer if beyond
- segment length
- * bool output.dump_chars_only = false: turns on character dumps
- (same as -C)
- * bool output.dump_payload = false: dumps application layer (same
- as -d)
- * bool output.dump_payload_verbose = false: dumps raw packet
- starting at link layer (same as -X)
- * int output.event_trace.max_data = 0: maximum amount of packet
- data to capture { 0:65535 }
- * bool output.log_ipv6_extra_data = false: log IPv6 source and
- destination addresses as unified2 extra data records
- * string output.logdir = .: where to put log files (same as -l)
- * bool output.nolog = false: turn off logging (alerts still work,
- same as -N)
- * bool output.obfuscate = false: obfuscate the logged IP addresses
- (same as -O)
- * bool output.quiet = false: suppress non-fatal information (still
- show alerts, same as -q)
- * bool output.show_year = false: include year in timestamp in the
- alert and log files (same as -y)
- * int output.tagged_packet_limit = 256: maximum number of packets
- tagged for non-packet metrics { 0: }
- * bool output.verbose = false: be verbose (same as -v)
- * bool packets.address_space_agnostic = false: determines whether
- DAQ address space info is used to track fragments and connections
- * string packets.bpf_file: file with BPF to select traffic for
- Snort
- * bool packets.enable_inline_init_failopen = true: whether to pass
- traffic during later stage of initialization to avoid drops
- * int packets.limit = 0: maximum number of packets to process
- before stopping (0 is unlimited) { 0: }
- * int packets.skip = 0: number of packets to skip before before
- processing { 0: }
- * bool packets.vlan_agnostic = false: determines whether VLAN info
- is used to track fragments and connections
- * string pcre.~regex: Snort regular expression
- * bool perf_monitor.console = false: output to console
- * bool perf_monitor.events = false: report on qualified vs
- non-qualified events
- * bool perf_monitor.file = false: output base stats to
- perf_monitor.csv instead of stdout
- * bool perf_monitor.flow = false: enable traffic statistics
- * bool perf_monitor.flow_file = false: output traffic statistics to
- a perf_monitor_flow.csv instead of stdout
- * bool perf_monitor.flow_ip = false: enable statistics on host
- pairs
- * bool perf_monitor.flow_ip_file = false: output host pair
- statistics to perf_monitor_flow_ip.csv instead of stdout
- * int perf_monitor.flow_ip_memcap = 52428800: maximum memory for
- flow tracking { 8200: }
- * int perf_monitor.flow_ports = 1023: maximum ports to track { 0: }
- * bool perf_monitor.max = false: calculate theoretical maximum
- performance
- * int perf_monitor.max_file_size = 4096: files will be rolled over
- if they exceed this size { 4096: }
- * int perf_monitor.packets = 10000: minim packets to report { 0: }
- * bool perf_monitor.reset = true: reset (clear) statistics after
- each reporting interval
- * int perf_monitor.seconds = 60: report interval; 0 means report at
- exit only { 0: }
- * int pop.b64_decode_depth = 1460: base64 decoding depth { -1:65535
- }
- * int pop.bitenc_decode_depth = 1460: Non-Encoded MIME attachment
- extraction depth { -1:65535 }
- * int pop.qp_decode_depth = 1460: Quoted Printable decoding depth {
- -1:65535 }
- * int pop.uu_decode_depth = 1460: Unix-to-Unix decoding depth {
- -1:65535 }
- * string port_scan.ignore_scanned: list of CIDRs with optional
- ports to ignore if the destination of scan alerts
- * string port_scan.ignore_scanners: list of CIDRs with optional
- ports to ignore if the source of scan alerts
- * bool port_scan.include_midstream = false: list of CIDRs with
- optional ports
- * bool port_scan.logfile = false: write scan events to file
- * multi port_scan.protos = all: choose the protocols to monitor {
- tcp | udp | icmp | ip | all }
- * multi port_scan.scan_types = all: choose type of scans to look
- for { portscan | portsweep | decoy_portscan |
- distributed_portscan | all }
- * enum port_scan.sense_level = medium: choose the level of
- detection { low | medium | high }
- * string port_scan.watch_ip: list of CIDRs with optional ports to
- watch
- * int port_scan_global.memcap = 1048576: maximum tracker memory {
- 1: }
- * bool ppm.fastpath_expensive_packets = false: stop inspection if
- the max_pkt_time is exceeded
- * int ppm.max_pkt_time = 0: enable packet latency thresholding
- (usec), 0 = off { 0: }
- * int ppm.max_rule_time = 0: enable rule latency thresholding
- (usec), 0 = off { 0: }
- * enum ppm.pkt_log = none: log event if max_pkt_time is exceeded {
- none | log | alert | both }
- * enum ppm.rule_log = none: enable event logging for suspended
- rules { none|log|alert|both }
- * bool ppm.suspend_expensive_rules = false: temporarily disable
- rule if threshold is reached
- * int ppm.suspend_timeout = 60: seconds to suspend rule, 0 =
- permanent { 0: }
- * int ppm.threshold = 5: number of times to exceed limit before
- disabling rule { 1: }
- * int priority.~: relative severity level; 1 is highest priority {
- 1: }
- * string process.chroot: set chroot directory (same as -t)
- * bool process.daemon = false: fork as a daemon (same as -D)
- * bool process.dirty_pig = false: shutdown without internal cleanup
- * string process.set_gid: set group ID (same as -g)
- * string process.set_uid: set user ID (same as -u)
- * int process.threads[].cpu = 0: pin the associated source/thread
- to this cpu { 0:127 }
- * string process.threads[].source: set cpu affinity for this source
- (either pcap or <iface>
- * int process.threads[].thread = 0: set cpu affinity for the
- <cur_thread_num> thread that runs { 0: }
- * string process.umask: set process umask (same as -m)
- * bool process.utc = false: use UTC instead of local time for
- timestamps
- * int profile.modules.count = -1: print results to given level (-1
- = all, 0 = off) { -1: }
- * enum profile.modules.sort = avg_ticks: sort by given field {
- checks | avg_ticks | total_ticks }
- * int profile.rules.count = -1: print results to given level (-1 =
- all, 0 = off) { -1: }
- * enum profile.rules.sort = avg_ticks: sort by given field { checks
- | avg_ticks | total_ticks | matches | no_matches |
- avg_ticks_per_match | avg_ticks_per_no_match }
- * string rate_filter[].apply_to: restrict filter to these addresses
- according to track
- * int rate_filter[].count = 1: number of events in interval before
- tripping { 0: }
- * int rate_filter[].gid = 1: rule generator ID { 0: }
- * select rate_filter[].new_action = alert: take this action on
- future hits until timeout { alert | drop | log | pass | | reject
- | sdrop }
- * int rate_filter[].seconds = 1: count interval { 0: }
- * int rate_filter[].sid = 1: rule signature ID { 0: }
- * int rate_filter[].timeout = 1: count interval { 0: }
- * enum rate_filter[].track = by_src: filter only matching source or
- destination addresses { by_src | by_dst | by_rule }
- * bool react.msg = false: use rule msg in response page instead of
- default message
- * string react.page: file containing HTTP response (headers and
- body)
- * string reference.~id: reference id
- * string reference.~scheme: reference scheme
- * string references[].name: name used with reference rule option
- * string references[].url: where this reference is defined
- * enum reject.control: send icmp unreachable(s) { network|host|port
- |all }
- * enum reject.reset: send tcp reset to one or both ends { source|
- dest|both }
- * string rem.~: comment
- * string replace.~: byte code to replace with
- * int rev.~: revision { 1: }
- * string rpc.~app: application number
- * string rpc.~proc: procedure number or * for any
- * string rpc.~ver: version number or * for any
- * bool rule_state.enable = true: enable or disable rule in all
- policies
- * int rule_state.gid = 0: rule generator ID { 0: }
- * int rule_state.sid = 0: rule signature ID { 0: }
- * int search_engine.bleedover_port_limit = 1024: maximum ports in
- rule before demotion to any-any port group { 1: }
- * bool search_engine.bleedover_warnings_enabled = false: print
- warning if a rule is demoted to any-any port group
- * bool search_engine.debug = false: print verbose fast pattern info
- * bool search_engine.debug_print_fast_pattern = false: print fast
- pattern info for each rule
- * bool search_engine.debug_print_nocontent_rule_tests = false:
- print rule group info during packet evaluation
- * bool search_engine.debug_print_rule_group_build_details = false:
- print rule group info during compilation
- * bool search_engine.debug_print_rule_groups_compiled = false:
- prints compiled rule group information
- * bool search_engine.debug_print_rule_groups_uncompiled = false:
- prints uncompiled rule group information
- * bool search_engine.enable_single_rule_group = false: put all
- rules into one group
- * int search_engine.max_pattern_len = 0: truncate patterns when
- compiling into state machine (0 means no maximum) { 0: }
- * int search_engine.max_queue_events = 5: maximum number of
- matching fast pattern states to queue per packet
- * bool search_engine.no_stream_inserts = false: don’t inspect
- reassembled payload - good for performance, bad for detection
- * string search_engine.search_method = ac_bnfa_q: set fast pattern
- algorithm - choose available search engine
- * bool search_engine.search_optimize = false: tweak state machine
- construction for better performance
- * bool search_engine.split_any_any = false: evaluate any-any rules
- separately to save memory
- * string seq.~range: check if packet payload size is size | min<>
- max | <max | >min
- * enum session.~mode: output format { printable|binary|all }
- * int sha256.length: number of octets in plain text { 1:65535 }
- * string sha256.offset: var or number of bytes from start of buffer
- to start search
- * implied sha256.relative = false: offset from cursor instead of
- start of buffer
- * string sha256.~hash: data to match
- * int sha512.length: number of octets in plain text { 1:65535 }
- * string sha512.offset: var or number of bytes from start of buffer
- to start search
- * implied sha512.relative = false: offset from cursor instead of
- start of buffer
- * string sha512.~hash: data to match
- * int sid.~: signature id { 1: }
- * implied snort.--alert-before-pass: process alert, drop, sdrop, or
- reject before pass; default is pass before alert, drop,…
- * string snort.--bpf: <filter options> are standard BPF options, as
- seen in TCPDump
- * string snort.--c2x: output hex for given char (see also --x2c)
- * implied snort.--create-pidfile: create PID file, even when not in
- Daemon mode
- * string snort.--daq: <type> select packet acquisition module
- (default is pcap)
- * string snort.--daq-dir: <dir> tell snort where to find desired
- DAQ
- * implied snort.--daq-list: list packet acquisition modules
- available in optional dir, default is static modules only
- * string snort.--daq-mode: <mode> select the DAQ operating mode
- * string snort.--daq-var: <name=value> specify extra DAQ
- configuration variable
- * implied snort.--dirty-pig: don’t flush packets on shutdown
- * implied snort.--dump-builtin-rules: [<module prefix>] output stub
- rules for selected modules
- * string snort.--dump-defaults: [<module prefix>] output module
- defaults in Lua format { (optional) }
- * implied snort.--dump-dynamic-rules: output stub rules for all
- loaded rules libraries
- * string snort.--dump-version: output the version, the whole
- version, and only the version { (optional) }
- * implied snort.--enable-inline-test: enable Inline-Test Mode
- Operation
- * implied snort.--help: list command line options
- * string snort.--help-commands: [<module prefix>] output matching
- commands { (optional) }
- * string snort.--help-config: [<module prefix>] output matching
- config options { (optional) }
- * string snort.--help-counts: [<module prefix>] output matching peg
- counts { (optional) }
- * string snort.--help-module: <module> output description of given
- module
- * implied snort.--help-modules: list all available modules with
- brief help
- * string snort.--help-options: <option prefix> output matching
- command line option quick help (same as -?) { (optional) }
- * implied snort.--help-plugins: list all available plugins with
- brief help
- * implied snort.--help-signals: dump available control signals
- * implied snort.--id-subdir: create/use instance subdirectories in
- logdir instead of instance filename prefix
- * implied snort.--id-zero: use id prefix / subdirectory even with
- one packet thread
- * implied snort.--list-buffers: output available inspection buffers
- * string snort.--list-builtin: <module prefix> output matching
- builtin rules { (optional) }
- * string snort.--list-gids: [<module prefix>] output matching
- generators { (optional) }
- * string snort.--list-modules: [<module type>] list all known
- modules of given type { (optional) }
- * implied snort.--list-plugins: list all known plugins
- * int snort.--logid: <0xid> log Identifier to uniquely id events
- for multiple snorts (same as -G) { 0:65535 }
- * string snort.--lua: <chunk> extend/override conf with chunk; may
- be repeated
- * implied snort.--markup: output help in asciidoc compatible format
- * int snort.--max-packet-threads = 1: <count> configure maximum
- number of packet threads (same as -z)
- * implied snort.--nolock-pidfile: do not try to lock Snort PID file
- * implied snort.--nostamps: don’t include timestamps in log file
- names
- * implied snort.--pause: wait for resume/quit command before
- processing packets/terminating
- * string snort.--pcap-dir: <dir> a directory to recurse to look for
- pcaps - read mode is implied
- * string snort.--pcap-file: <file> file that contains a list of
- pcaps to read - read mode is implied
- * string snort.--pcap-filter: <filter> filter to apply when getting
- pcaps from file or directory
- * string snort.--pcap-list: <list> a space separated list of pcaps
- to read - read mode is implied
- * int snort.--pcap-loop: <count> read all pcaps <count> times; 0
- will read until Snort is terminated { -1: }
- * implied snort.--pcap-no-filter: reset to use no filter when
- getting pcaps from file or directory
- * implied snort.--pcap-reload: if reading multiple pcaps, reload
- snort config between pcaps
- * implied snort.--pcap-reset: ignored - for REG_TEST only
- * implied snort.--pcap-show: print a line saying what pcap is
- currently being read
- * implied snort.--pedantic: warnings are fatal
- * string snort.--plugin-path: <path> where to find plugins
- * implied snort.--process-all-events: process all action groups
- * string snort.--rule: <rules> to be added to configuration; may be
- repeated
- * implied snort.--rule-to-hex: output so rule header to stdout for
- text rule on stdin
- * implied snort.--rule-to-text: output plain so rule header to
- stdout for text rule on stdin
- * string snort.--run-prefix: <pfx> prepend this to each output file
- * string snort.--script-path: <path> where to find luajit scripts
- * implied snort.--shell: enable the interactive command line
- * implied snort.--show-plugins: list module and plugin versions
- * int snort.--skip: <n> skip 1st n packets { 0: }
- * int snort.--snaplen = 1514: <snap> set snaplen of packet (same as
- -s) { 68:65535 }
- * implied snort.--stdin-rules: read rules from stdin until EOF or a
- line starting with END is read
- * implied snort.--treat-drop-as-alert: converts drop, sdrop, and
- reject rules into alert rules during startup
- * implied snort.--treat-drop-as-ignore: use drop, sdrop, and reject
- rules to ignore session traffic when not inline
- * implied snort.--version: show version number (same as -V)
- * implied snort.--warn-all: enable all warnings
- * implied snort.--warn-conf: warn about configuration issues
- * implied snort.--warn-daq: warn about DAQ issues, usually related
- to mode
- * implied snort.--warn-flowbits: warn about flowbits that are
- checked but not set and vice-versa
- * implied snort.--warn-hosts: warn about host table issues
- * implied snort.--warn-rules: warn about duplicate rules and rule
- parsing issues
- * implied snort.--warn-scripts: warn about issues discovered while
- processing Lua scripts
- * implied snort.--warn-symbols: warn about unknown symbols in your
- Lua config
- * implied snort.--warn-vars: warn about variable definition and
- usage issues
- * int snort.--x2c: output ASCII char for given hex (see also --c2x)
- * string snort.-?: <option prefix> output matching command line
- option quick help (same as --help-options) { (optional) }
- * string snort.-A: <mode> set alert mode: none, cmg, or alert_*
- * implied snort.-B: <mask> obfuscated IP addresses in alerts and
- packet dumps using CIDR mask
- * implied snort.-C: print out payloads with character data only (no
- hex)
- * implied snort.-D: run Snort in background (daemon) mode
- * implied snort.-E: enable daemon restart
- * int snort.-G: <0xid> (same as --logid) { 0:65535 }
- * implied snort.-H: make hash tables deterministic
- * select snort.-K = none: <mode> logging mode { none|text|pcap }
- * implied snort.-M: log messages to syslog (not alerts)
- * implied snort.-N: ignored - for REG_TEST only
- * implied snort.-O: obfuscate the logged IP addresses
- * implied snort.-Q: enable inline mode operation
- * string snort.-R: <rules> include this rules file in the default
- policy
- * string snort.-S: <n=v> set rules file variable n equal to value v
- * implied snort.-T: test and report on the current Snort
- configuration
- * implied snort.-U: use UTC for timestamps
- * implied snort.-V: (same as --version)
- * implied snort.-W: lists available interfaces
- * implied snort.-X: dump the raw packet data starting at the link
- layer
- * string snort.-c: <conf> use this configuration
- * implied snort.-d: dump the Application Layer
- * implied snort.-e: display the second layer header info
- * implied snort.-f: turn off fflush() calls after binary log writes
- * string snort.-g: <gname> run snort gid as <gname> group (or gid)
- after initialization
- * string snort.-i: <iface>… list of interfaces
- * port snort.-j: <port> to listen for telnet connections
- * enum snort.-k = all: <mode> checksum mode
- (all,noip,notcp,noudp,noicmp,none) { all|noip|notcp|noudp|noicmp|
- none }
- * string snort.-l: <logdir> log to this directory instead of
- current directory
- * int snort.-m: <umask> set umask = <umask> { 0: }
- * int snort.-n: <count> stop after count packets { 0: }
- * implied snort.-q: quiet mode - Don’t show banner and status
- report
- * string snort.-r: <pcap>… (same as --pcap-list)
- * int snort.-s = 1514: <snap> (same as --snaplen) { 68:65535 }
- * string snort.-t: <dir> chroots process to <dir> after
- initialization
- * string snort.-u: <uname> run snort as <uname> or <uid> after
- initialization
- * implied snort.-v: be verbose
- * implied snort.-w: dump 802.11 management and control frames
- * implied snort.-x: same as --pedantic
- * implied snort.-y: include year in timestamp in the alert and log
- files
- * int snort.-z = 1: <count> maximum number of packet threads (same
- as --max-packet-threads)
- * string so.~func: name of eval function
- * string soid.~: SO rule ID has <gid>|<sid> format, like 3|12345
- * int ssh.max_client_bytes = 19600: number of unanswered bytes
- before alerting on challenge-response overflow or CRC32 { 0:65535
- }
- * int ssh.max_encrypted_packets = 25: ignore session after this
- many encrypted packets { 0:65535 }
- * int ssh.max_server_version_len = 80: limit before alerting on
- secure CRT server version string overflow { 0:255 }
- * int stream.icmp_cache.idle_timeout = 60: maximum inactive time
- before retiring session tracker { 1: }
- * int stream.icmp_cache.max_sessions = 262144: maximum simultaneous
- tcp sessions tracked before pruning { 0: }
- * int stream.icmp_cache.memcap = 0: maximum cache memory { 0: }
- * int stream.icmp_cache.pruning_timeout = 30: minimum inactive time
- before being eligible for pruning { 1: }
- * int stream.ip_cache.idle_timeout = 60: maximum inactive time
- before retiring session tracker { 1: }
- * int stream.ip_cache.max_sessions = 262144: maximum simultaneous
- tcp sessions tracked before pruning { 0: }
- * int stream.ip_cache.memcap = 0: maximum cache memory { 0: }
- * int stream.ip_cache.pruning_timeout = 30: minimum inactive time
- before being eligible for pruning { 1: }
- * int stream.tcp_cache.idle_timeout = 60: maximum inactive time
- before retiring session tracker { 1: }
- * int stream.tcp_cache.max_sessions = 262144: maximum simultaneous
- tcp sessions tracked before pruning { 0: }
- * int stream.tcp_cache.memcap = 0: maximum cache memory { 0: }
- * int stream.tcp_cache.pruning_timeout = 30: minimum inactive time
- before being eligible for pruning { 1: }
- * int stream.udp_cache.idle_timeout = 60: maximum inactive time
- before retiring session tracker { 1: }
- * int stream.udp_cache.max_sessions = 262144: maximum simultaneous
- tcp sessions tracked before pruning { 0: }
- * int stream.udp_cache.memcap = 0: maximum cache memory { 0: }
- * int stream.udp_cache.pruning_timeout = 30: minimum inactive time
- before being eligible for pruning { 1: }
- * int stream_icmp.session_timeout = 30: session tracking timeout {
- 1:86400 }
- * int stream_ip.max_frags = 8192: maximum number of simultaneous
- fragments being tracked { 1: }
- * int stream_ip.max_overlaps = 0: maximum allowed overlaps per
- datagram; 0 is unlimited { 0: }
- * int stream_ip.min_frag_length = 0: alert if fragment length is
- below this limit before or after trimming { 0: }
- * int stream_ip.min_ttl = 1: discard fragments with ttl below the
- minimum { 1:255 }
- * enum stream_ip.policy = linux: fragment reassembly policy { first
- | linux | bsd | bsd_right | last | windows | solaris }
- * int stream_ip.session_timeout = 30: session tracking timeout {
- 1:86400 }
- * enum stream_reassemble.action: stop or start stream reassembly {
- disable|enable }
- * enum stream_reassemble.direction: action applies to the given
- direction(s) { client|server|both }
- * implied stream_reassemble.fastpath: optionally whitelist the
- remainder of the session
- * implied stream_reassemble.noalert: don’t alert when rule matches
- * enum stream_size.~direction: compare applies to the given
- direction(s) { either|to_server|to_client|both }
- * string stream_size.~range: size for comparison
- * int stream_tcp.flush_factor = 0: flush upon seeing a drop in
- segment size after given number of non-decreasing segments { 0: }
- * int stream_tcp.footprint = 0: use zero for production, non-zero
- for testing at given size { 0: }
- * bool stream_tcp.ignore_any_rules = false: process tcp content
- rules w/o ports only if rules with ports are present
- * int stream_tcp.max_pdu = 16384: maximum reassembled PDU size {
- 1460:63780 }
- * int stream_tcp.max_window = 0: maximum allowed tcp window {
- 0:1073725440 }
- * int stream_tcp.overlap_limit = 0: maximum number of allowed
- overlapping segments per session { 0:255 }
- * enum stream_tcp.policy = bsd: determines operating system
- characteristics like reassembly { first | last | linux |
- old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 |
- windows | win_2003 | vista | proxy }
- * int stream_tcp.queue_limit.max_bytes = 1048576: don’t queue more
- than given bytes per session and direction { 0: }
- * int stream_tcp.queue_limit.max_segments = 2621: don’t queue more
- than given segments per session and direction { 0: }
- * bool stream_tcp.reassemble_async = true: queue data for
- reassembly before traffic is seen in both directions
- * int stream_tcp.require_3whs = -1: don’t track midstream sessions
- after given seconds from start up; -1 tracks all { -1:86400 }
- * int stream_tcp.session_timeout = 30: session tracking timeout {
- 1:86400 }
- * bool stream_tcp.show_rebuilt_packets = false: enable cmg like
- output of reassembled packets
- * int stream_tcp.small_segments.count = 0: limit number of small
- segments queued { 0:2048 }
- * bit_list stream_tcp.small_segments.ignore_ports: limit number of
- small segments queued { 65535 }
- * int stream_tcp.small_segments.maximum_size = 0: limit number of
- small segments queued { 0:2048 }
- * bool stream_udp.ignore_any_rules = false: process udp content
- rules w/o ports only if rules with ports are present
- * int stream_udp.session_timeout = 30: session tracking timeout {
- 1:86400 }
- * int suppress[].gid = 0: rule generator ID { 0: }
- * string suppress[].ip: restrict suppression to these addresses
- according to track
- * int suppress[].sid = 0: rule signature ID { 0: }
- * enum suppress[].track: suppress only matching source or
- destination addresses { by_src | by_dst }
- * int tag.bytes: tag for this many bytes { 1: }
- * int tag.packets: tag this many packets { 1: }
- * int tag.seconds: tag for this many seconds { 1: }
- * enum tag.~: log all packets in session or all packets to or from
- host { session|host_src|host_dst }
- * int telnet.ayt_attack_thresh = -1: alert on this number of
- consecutive telnet AYT commands { -1: }
- * bool telnet.check_encrypted = false: check for end of encryption
- * bool telnet.encrypted_traffic = false: check for encrypted telnet
- and ftp
- * bool telnet.normalize = false: eliminate escape sequences
- * string tos.~range: check if packet payload size is size | min<>
- max | <max | >min
- * string ttl.~range: check if packet payload size is size | min<>
- max | <max | >min
- * bool udp.deep_teredo_inspection = false: look for Teredo on all
- UDP ports (default is only 3544)
- * bool udp.enable_gtp = false: decode GTP encapsulations
- * bit_list udp.gtp_ports = 2152 3386: set GTP ports { 65535 }
- * int unified2.limit = 0: set limit (0 is unlimited) { 0: }
- * bool unified2.mpls_event_types = false: include mpls labels in
- events
- * bool unified2.nostamp = true: append file creation time to name
- (in Unix Epoch format)
- * enum unified2.units = B: limit multiplier { B | K | M | G }
- * bool unified2.vlan_event_types = false: include vlan IDs in
- events
- * string window.~range: check if packet payload size is size | min
- <>max | <max | >min
- * bool wizard.hexes[].client_first = true: which end initiates data
- transfer
- * select wizard.hexes[].proto = tcp: protocol to scan { tcp | udp }
- * string wizard.hexes[].service: name of service
- * string wizard.hexes[].to_client[].hex: sequence of data with wild
- chars (?)
- * string wizard.hexes[].to_server[].hex: sequence of data with wild
- chars (?)
- * bool wizard.spells[].client_first = true: which end initiates
- data transfer
- * select wizard.spells[].proto = tcp: protocol to scan { tcp | udp
- }
- * string wizard.spells[].service: name of service
- * string wizard.spells[].to_client[].spell: sequence of data with
- wild cards (*)
- * string wizard.spells[].to_server[].spell: sequence of data with
- wild cards (*) 0 gets the number of CPU cores reported by the
- system { 0: } 0 gets the number of CPU cores reported by the
- system { 0: }
-
-
-14.10. Counts
-
-------------
-
- * arp_spoof.packets: total packets
- * back_orifice.packets: total packets
- * binder.allows: allow bindings
- * binder.blocks: block bindings
- * binder.inspects: inspect bindings
- * binder.packets: initial bindings
- * daq.allow: total allow verdicts
- * daq.analyzed: total packets analyzed from DAQ
- * daq.blacklist: total blacklist verdicts
- * daq.block: total block verdicts
- * daq.dropped: packets dropped
- * daq.fail open: packets passed during initialization
- * daq.filtered: packets filtered out
- * daq.idle: attempts to acquire from DAQ without available packets
- * daq.ignore: total ignore verdicts
- * daq.injected: active responses or replacements
- * daq.internal blacklist: packets blacklisted internally due to
- lack of DAQ support
- * daq.internal whitelist: packets whitelisted internally due to
- lack of DAQ support
- * daq.outstanding: packets unprocessed
- * daq.pcaps: total files processed
- * daq.received: total packets received from DAQ
- * daq.replace: total replace verdicts
- * daq.skipped: packets skipped at startup
- * daq.whitelist: total whitelist verdicts
- * detection.alert limit: events previously triggered on same PDU
- * detection.alerts: alerts not including IP reputation
- * detection.analyzed: packets sent to detection
- * detection.event limit: events filtered
- * detection.log limit: events queued but not logged
- * detection.logged: logged packets
- * detection.match limit: fast pattern matches not processed
- * detection.passed: passed packets
- * detection.queue limit: events not queued because queue full
- * detection.total alerts: alerts including IP reputation
- * dns.packets: total packets
- * ftp_data.packets: total packets
- * ftp_server.packets: total packets
- * http_global.compressed bytes: total comparessed bytes processed
- * http_global.decompressed bytes: total bytes decompressed
- * http_global.double unicode: double unicode normalizations
- * http_global.gets: GET requests
- * http_global.gzip packets: packets with gzip compression
- * http_global.non-ascii: non-ascii normalizations
- * http_global.packets: total packets processed
- * http_global.paths with ../: directory traversal normalizations
- * http_global.paths with ./: relative directory normalizations
- * http_global.paths with //: double slash normalizations
- * http_global.post params: POST parameters extracted
- * http_global.posts: POST requests
- * http_global.request cookies: requests with Cookie
- * http_global.request headers: total requests
- * http_global.response cookies: responses with Set-Cookie
- * http_global.response headers: total responses
- * http_global.unicode: unicode normalizations
- * icmp4.bad checksum: non-zero icmp checksums
- * icmp6.bad checksum (ip4): nonzero ipcm4 checksums
- * icmp6.bad checksum (ip6): nonzero ipcm6 checksums
- * imap.packets: total packets
- * ipv4.bad checksum: nonzero ip checksums
- * normalizer.icmp4 echo: icmp4 ping normalizations
- * normalizer.icmp6 echo: icmp6 echo normalizations
- * normalizer.ip4 df: don’t frag bit normalizations
- * normalizer.ip4 opts: ip4 options cleared
- * normalizer.ip4 rf: reserved flag bit clears
- * normalizer.ip4 tos: type of service normalizations
- * normalizer.ip4 trim: eth packets trimmed to datagram size
- * normalizer.ip4 ttl: time-to-live normalizations
- * normalizer.ip6 hops: ip6 hop limit normalizations
- * normalizer.ip6 options: ip6 options cleared
- * normalizer.tcp block: blocked segments
- * normalizer.tcp ecn pkt: packets with ECN bits cleared
- * normalizer.tcp ecn session: ECN bits cleared
- * normalizer.tcp ips data: normalized segments
- * normalizer.tcp nonce: packets with nonce bit cleared
- * normalizer.tcp options: packets with options cleared
- * normalizer.tcp paddding: packets with padding cleared
- * normalizer.tcp req pay: cleared urgent pointer and urgent flag
- when there is no payload
- * normalizer.tcp req urg: cleared urgent pointer when urgent flag
- is not set
- * normalizer.tcp req urp: cleared the urgent flag if the urgent
- pointer is not set
- * normalizer.tcp reserved: packets with reserved bits cleared
- * normalizer.tcp syn options: SYN only options cleared from non-SYN
- packets
- * normalizer.tcp trim mss: data trimmed to MSS
- * normalizer.tcp trim rst: RST packets with data trimmed
- * normalizer.tcp trim syn: tcp segments trimmed on SYN
- * normalizer.tcp trim win: data trimed to window
- * normalizer.tcp ts ecr: timestamp cleared on non-ACKs
- * normalizer.tcp ts nop: timestamp options cleared
- * normalizer.tcp urgent ptr: packets without data with urgent
- pointer cleared
- * normalizer.test icmp4 echo: During inline mode, would have icmp4
- ping normalizations
- * normalizer.test icmp6 echo: During inline mode, would have icmp6
- echo normalizations
- * normalizer.test ip4 df: During inline mode, would have don’t frag
- bit normalizations
- * normalizer.test ip4 opts: During inline mode, would have ip4
- options cleared
- * normalizer.test ip4 rf: During inline mode, would have reserved
- flag bit clears
- * normalizer.test ip4 tos: During inline mode, would have type of
- service normalizations
- * normalizer.test ip4 trim: During inline mode, would have eth
- packets trimmed to datagram size
- * normalizer.test ip4 ttl: During inline mode, would have
- time-to-live normalizations
- * normalizer.test ip6 hops: During inline mode, would have ip6 hop
- limit normalizations
- * normalizer.test ip6 options: During inline mode, would have ip6
- options cleared
- * normalizer.test tcp block: During inline mode, would have blocked
- segments
- * normalizer.test tcp ecn pkt: During inline mode, would have
- packets with ECN bits cleared
- * normalizer.test tcp ecn session: During inline mode, would have
- ECN bits cleared
- * normalizer.test tcp ips data: During inline mode, would have
- normalized segments
- * normalizer.test tcp nonce: During inline mode, would have packets
- with nonce bit cleared
- * normalizer.test tcp options: During inline mode, would have
- packets with options cleared
- * normalizer.test tcp paddding: During inline mode, would have
- packets with padding cleared
- * normalizer.test tcp req pay: During inline mode, would have
- cleared urgent pointer and urgent flag when there is no payload
- * normalizer.test tcp req urg: During inline mode, would have
- cleared urgent pointer when urgent flag is not set
- * normalizer.test tcp req urp: During inline mode, would have
- cleared the urgent flag if the urgent pointer is not set
- * normalizer.test tcp reserved: During inline mode, would have
- packets with reserved bits cleared
- * normalizer.test tcp syn options: During inline mode, would have
- SYN only options cleared from non-SYN packets
- * normalizer.test tcp trim mss: During inline mode, would have data
- trimmed to MSS
- * normalizer.test tcp trim rst: During inline mode, would have RST
- packets with data trimmed
- * normalizer.test tcp trim syn: During inline mode, would have tcp
- segments trimmed on SYN
- * normalizer.test tcp trim win: During inline mode, would have data
- trimed to window
- * normalizer.test tcp ts ecr: During inline mode, would have
- timestamp cleared on non-ACKs
- * normalizer.test tcp ts nop: During inline mode, would have
- timestamp options cleared
- * normalizer.test tcp urgent ptr: During inline mode, would have
- packets without data with urgent pointer cleared
- * perf_monitor.packets: total packets
- * pop.packets: total packets
- * port_scan_global.packets: total packets
- * rpc_decode.packets: total packets
- * snort.attribute table hosts: total number of hosts in table
- * snort.attribute table reloads: number of times hosts table was
- reloaded
- * snort.conf reloads: number of times configuration was reloaded
- * snort.local commands: total local commands processed
- * snort.remote commands: total remote commands processed
- * snort.signals: total signals processed
- * ssh.packets: total packets
- * stream.icmp flows: total icmp sessions
- * stream.icmp prunes: icmp sessions pruned
- * stream.ip flows: total ip sessions
- * stream.ip prunes: ip sessions pruned
- * stream.tcp flows: total tcp sessions
- * stream.tcp prunes: tcp sessions pruned
- * stream.udp flows: total udp sessions
- * stream.udp prunes: udp sessions pruned
- * stream_icmp.created: icmp session trackers created
- * stream_icmp.released: icmp session trackers released
- * stream_ip.alerts: alerts generated
- * stream_ip.anomalies: anomalies detected
- * stream_ip.discards: fragments discarded
- * stream_ip.drops: fragments dropped
- * stream_ip.frag timeouts: datagrams abandoned
- * stream_ip.fragments: total fragments
- * stream_ip.memory faults: memory faults
- * stream_ip.nodes deleted: fragments deleted from tracker
- * stream_ip.nodes inserted: fragments added to tracker
- * stream_ip.overlaps: overlapping fragments
- * stream_ip.reassembled: reassembled datagrams
- * stream_ip.trackers added: datagram trackers created
- * stream_ip.trackers freed: datagram trackers released
- * stream_tcp.3way trackers: tcp session tracking started on ack
- * stream_tcp.client cleanups: number of times data from server was
- flushed when session released
- * stream_tcp.data trackers: tcp session tracking started on data
- * stream_tcp.discards: tcp packets discarded
- * stream_tcp.events: events generated
- * stream_tcp.gaps: missing data between PDUs
- * stream_tcp.ignored: tcp packets ignored
- * stream_tcp.internal events: 135:X events generated
- * stream_tcp.max bytes: number of times the maximum queued byte
- limit was reached
- * stream_tcp.max segs: number of times the maximum queued segment
- limit was reached
- * stream_tcp.overlaps: overlapping segments queued
- * stream_tcp.rebuilt buffers: rebuilt PDU sections
- * stream_tcp.rebuilt packets: total reassembled PDUs
- * stream_tcp.resyns: SYN received on established session
- * stream_tcp.segs queued: total segments queued
- * stream_tcp.segs released: total segments released
- * stream_tcp.segs split: tcp segments split when reassembling PDUs
- * stream_tcp.segs used: queued tcp segments applied to reassembled
- PDUs
- * stream_tcp.server cleanups: number of times data from client was
- flushed when session released
- * stream_tcp.sessions: total sessions
- * stream_tcp.syn trackers: tcp session tracking started on syn
- * stream_tcp.syn-ack trackers: tcp session tracking started on
- syn-ack
- * stream_tcp.timeouts: sessions timed out
- * stream_tcp.trackers created: tcp session trackers created
- * stream_tcp.trackers released: tcp session trackers released
- * stream_tcp.untracked: tcp packets not tracked
- * stream_udp.created: udp session trackers created
- * stream_udp.released: udp session trackers released
- * stream_udp.sessions: total udp sessions
- * stream_udp.timeouts: udp session timeouts
- * tcp.bad checksum (ip4): nonzero tcp over ip checksums
- * tcp.bad checksum (ip6): nonzero tcp over ipv6 checksums
- * telnet.packets: total packets
- * udp.bad checksum (ip4): nonzero udp over ipv4 checksums
- * udp.bad checksum (ip6): nonzero udp over ipv6 checksums
- * wizard.tcp hits: tcp identifications
- * wizard.tcp scans: tcp payload scans
- * wizard.udp hits: udp identifications
- * wizard.udp scans: udp payload scans
-
-
-14.11. Generators
-
-------------
-
- * 105: back_orifice
- * 106: rpc_decode
- * 112: arp_spoof
- * 116: arp
- * 116: auth
- * 116: decode
- * 116: eapol
- * 116: erspan2
- * 116: erspan3
- * 116: esp
- * 116: eth
- * 116: fabricpath
- * 116: gre
- * 116: gtp
- * 116: icmp4
- * 116: icmp6
- * 116: igmp
- * 116: ipv4
- * 116: ipv6
- * 116: mpls
- * 116: pgm
- * 116: pppoe
- * 116: tcp
- * 116: udp
- * 116: vlan
- * 116: wlan
- * 119: http_global
- * 120: http_inspect
- * 122: port_scan
- * 123: stream_ip
- * 125: ftp_server
- * 126: telnet
- * 128: ssh
- * 129: stream_tcp
- * 131: dns
- * 134: ppm
- * 141: imap
- * 142: pop
- * 219: new_http_inspect
-
-
-14.12. Builtin Rules
-
-------------
-
- * 105:1 (back_orifice) BO traffic detected
- * 105:2 (back_orifice) BO client traffic detected
- * 105:3 (back_orifice) BO server traffic detected
- * 105:4 (back_orifice) BO Snort buffer attack
- * 106:1 (rpc_decode) fragmented RPC records
- * 106:2 (rpc_decode) multiple RPC records
- * 106:3 (rpc_decode) large RPC record fragment
- * 106:4 (rpc_decode) incomplete RPC segment
- * 106:5 (rpc_decode) zero-length RPC fragment
- * 112:1 (arp_spoof) unicast ARP request
- * 112:2 (arp_spoof) ethernet/ARP mismatch request for source
- * 112:3 (arp_spoof) ethernet/ARP mismatch request for destination
- * 112:4 (arp_spoof) attempted ARP cache overwrite attack
- * 116:1 (ipv4) Not IPv4 datagram
- * 116:2 (ipv4) hlen < minimum
- * 116:3 (ipv4) IP dgm len < IP Hdr len
- * 116:4 (ipv4) Ipv4 Options found with bad lengths
- * 116:5 (ipv4) Truncated Ipv4 Options
- * 116:6 (ipv4) IP dgm len > captured len
- * 116:45 (tcp) TCP packet len is smaller than 20 bytes
- * 116:46 (tcp) TCP data offset is less than 5
- * 116:47 (tcp) TCP header length exceeds packet length
- * 116:54 (tcp) TCP options found with bad lengths
- * 116:55 (tcp) truncated TCP options
- * 116:56 (tcp) T/TCP detected
- * 116:57 (tcp) obsolete TCP options found
- * 116:58 (tcp) experimental TCP options found
- * 116:59 (tcp) TCP window scale option found with length > 14
- * 116:95 (udp) truncated UDP header
- * 116:96 (udp) invalid UDP header, length field < 8
- * 116:97 (udp) short UDP packet, length field > payload length
- * 116:98 (udp) long UDP packet, length field < payload length
- * 116:105 (icmp4) ICMP header truncated
- * 116:106 (icmp4) ICMP timestamp header truncated
- * 116:107 (icmp4) ICMP address header truncated
- * 116:109 (arp) truncated ARP
- * 116:110 (eapol) truncated EAP header
- * 116:111 (eapol) EAP key truncated
- * 116:112 (eapol) EAP header truncated
- * 116:120 (pppoe) bad PPPOE frame detected
- * 116:130 (vlan) bad VLAN frame
- * 116:131 (vlan) bad LLC header
- * 116:132 (vlan) bad extra LLC info
- * 116:133 (wlan) bad 802.11 LLC header
- * 116:134 (wlan) bad 802.11 extra LLC info
- * 116:150 (decode) bad traffic loopback IP
- * 116:151 (decode) bad traffic same src/dst IP
- * 116:160 (gre) GRE header length > payload length
- * 116:161 (gre) multiple encapsulations in packet
- * 116:162 (gre) invalid GRE version
- * 116:163 (gre) invalid GRE header
- * 116:164 (gre) invalid GRE v.1 PPTP header
- * 116:165 (gre) GRE trans header length > payload length
- * 116:170 (mpls) bad MPLS frame
- * 116:171 (mpls) MPLS label 0 appears in non-bottom header
- * 116:172 (mpls) MPLS label 1 appears in bottom header
- * 116:173 (mpls) MPLS label 2 appears in non-bottom header
- * 116:174 (mpls) MPLS label 3 appears in header
- * 116:175 (mpls) MPLS label 4, 5,.. or 15 appears in header
- * 116:176 (mpls) too many MPLS headers
- * 116:250 (icmp4) ICMP original IP header truncated
- * 116:251 (icmp4) ICMP version and original IP header versions
- differ
- * 116:252 (icmp4) ICMP original datagram length < original IP
- header length
- * 116:253 (icmp4) ICMP original IP payload < 64 bits
- * 116:254 (icmp4) ICMP original IP payload > 576 bytes
- * 116:255 (icmp4) ICMP original IP fragmented and offset not 0
- * 116:270 (ipv6) IPv6 packet below TTL limit
- * 116:271 (ipv6) IPv6 header claims to not be IPv6
- * 116:272 (ipv6) IPV6 truncated extension header
- * 116:273 (ipv6) IPV6 truncated header
- * 116:274 (ipv6) IP dgm len < IP Hdr len
- * 116:275 (ipv6) IP dgm len > captured len
- * 116:276 (ipv6) IPv6 packet with destination address ::0
- * 116:277 (ipv6) IPv6 packet with multicast source address
- * 116:278 (ipv6) IPv6 packet with reserved multicast destination
- address
- * 116:279 (ipv6) IPv6 header includes an undefined option type
- * 116:280 (ipv6) IPv6 address includes an unassigned multicast
- scope value
- * 116:281 (ipv6) IPv6 header includes an invalid value for the next
- header field
- * 116:282 (ipv6) IPv6 header includes a routing extension header
- followed by a hop-by-hop header
- * 116:283 (ipv6) IPv6 header includes two routing extension headers
- * 116:285 (icmp6) ICMPv6 packet of type 2 (message too big) with
- MTU field < 1280
- * 116:286 (icmp6) ICMPv6 packet of type 1 (destination unreachable)
- with non-RFC 2463 code
- * 116:287 (icmp6) ICMPv6 router solicitation packet with a code not
- equal to 0
- * 116:288 (icmp6) ICMPv6 router advertisement packet with a code
- not equal to 0
- * 116:289 (icmp6) ICMPv6 router solicitation packet with the
- reserved field not equal to 0
- * 116:290 (icmp6) ICMPv6 router advertisement packet with the
- reachable time field set > 1 hour
- * 116:291 (ipv6) IPV6 tunneled over IPv4, IPv6 header truncated,
- possible Linux kernel attack
- * 116:292 (ipv6) IPv6 header has destination options followed by a
- routing header
- * 116:293 (decode) two or more IP (v4 and/or v6) encapsulation
- layers present
- * 116:294 (esp) truncated encapsulated security payload header
- * 116:295 (ipv6) IPv6 header includes an option which is too big
- for the containing header
- * 116:296 (ipv6) IPv6 packet includes out-of-order extension
- headers
- * 116:297 (gtp) two or more GTP encapsulation layers present
- * 116:298 (gtp) GTP header length is invalid
- * 116:400 (tcp) XMAS attack detected
- * 116:401 (tcp) Nmap XMAS attack detected
- * 116:402 (tcp) DOS NAPTHA vulnerability detected
- * 116:403 (tcp) bad traffic SYN to multicast address
- * 116:404 (ipv4) IPV4 packet with zero TTL
- * 116:405 (ipv4) IPV4 packet with bad frag bits (both MF and DF
- set)
- * 116:406 (udp) invalid IPv6 UDP packet, checksum zero
- * 116:407 (ipv4) IPV4 packet frag offset + length exceed maximum
- * 116:408 (ipv4) IPV4 packet from current net source address
- * 116:409 (ipv4) IPV4 packet to current net dest address
- * 116:410 (ipv4) IPV4 packet from multicast source address
- * 116:411 (ipv4) IPV4 packet from reserved source address
- * 116:412 (ipv4) IPV4 packet to reserved dest address
- * 116:413 (ipv4) IPV4 packet from broadcast source address
- * 116:414 (ipv4) IPV4 packet to broadcast dest address
- * 116:415 (icmp4) ICMP4 packet to multicast dest address
- * 116:416 (icmp4) ICMP4 packet to broadcast dest address
- * 116:418 (icmp4) ICMP4 type other
- * 116:419 (tcp) TCP urgent pointer exceeds payload length or no
- payload
- * 116:420 (tcp) TCP SYN with FIN
- * 116:421 (tcp) TCP SYN with RST
- * 116:422 (tcp) TCP PDU missing ack for established session
- * 116:423 (tcp) TCP has no SYN, ACK, or RST
- * 116:424 (eth) truncated eth header
- * 116:425 (ipv4) truncated IP4 header
- * 116:426 (icmp4) truncated ICMP4 header
- * 116:427 (icmp6) truncated ICMP6 header
- * 116:428 (ipv4) IPV4 packet below TTL limit
- * 116:429 (ipv6) IPV6 packet has zero hop limit
- * 116:430 (ipv4) IPV4 packet both DF and offset set
- * 116:431 (icmp6) ICMP6 type not decoded
- * 116:432 (icmp6) ICMP6 packet to multicast address
- * 116:433 (tcp) DDOS shaft SYN flood
- * 116:434 (icmp4) ICMP ping NMAP
- * 116:435 (icmp4) ICMP icmpenum v1.1.1
- * 116:436 (icmp4) ICMP redirect host
- * 116:437 (icmp4) ICMP redirect net
- * 116:438 (icmp4) ICMP traceroute ipopts
- * 116:439 (icmp4) ICMP source quench
- * 116:440 (icmp4) broadscan smurf scanner
- * 116:441 (icmp4) ICMP destination unreachable communication
- administratively prohibited
- * 116:442 (icmp4) ICMP destination unreachable communication with
- destination host is administratively prohibited
- * 116:443 (icmp4) ICMP destination unreachable communication with
- destination network is administratively prohibited
- * 116:444 (ipv4) MISC IP option set
- * 116:445 (udp) misc large UDP Packet
- * 116:446 (tcp) BAD-TRAFFIC TCP port 0 traffic
- * 116:447 (udp) BAD-TRAFFIC UDP port 0 traffic
- * 116:448 (ipv4) BAD-TRAFFIC IP reserved bit set
- * 116:449 (decode) BAD-TRAFFIC unassigned/reserved IP protocol
- * 116:450 (decode) BAD-TRAFFIC bad IP protocol
- * 116:451 (icmp4) ICMP path MTU denial of service attempt
- * 116:452 (icmp4) BAD-TRAFFIC Linux ICMP header DOS attempt
- * 116:453 (ipv6) BAD-TRAFFIC ISATAP-addressed IPv6 traffic spoofing
- attempt
- * 116:454 (pgm) BAD-TRAFFIC PGM nak list overflow attempt
- * 116:455 (igmp) DOS IGMP IP options validation attempt
- * 116:456 (ipv6) too many IP6 extension headers
- * 116:457 (icmp6) ICMPv6 packet of type 1 (destination unreachable)
- with non-RFC 4443 code
- * 116:458 (ipv6) bogus fragmentation packet, possible BSD attack
- * 116:459 (decode) fragment with zero length
- * 116:460 (icmp6) ICMPv6 node info query/response packet with a
- code greater than 2
- * 116:461 (ipv6) IPV6 routing type 0 extension header
- * 116:462 (erspan2) ERSpan header version mismatch
- * 116:463 (erspan2) captured < ERSpan type2 header length
- * 116:464 (erspan3) captured < ERSpan type3 header length
- * 116:465 (auth) truncated authentication header
- * 116:466 (auth) bad authentication header length
- * 116:467 (fabricpath) truncated FabricPath header
- * 116:468 (decode) too many protocols present
- * 119:1 (http_global) ascii encoding
- * 119:2 (http_global) double decoding attack
- * 119:3 (http_global) u encoding
- * 119:4 (http_global) bare byte unicode encoding
- * 119:5 (http_global) base36 encoding
- * 119:6 (http_global) UTF-8 encoding
- * 119:7 (http_global) IIS unicode codepoint encoding
- * 119:8 (http_global) multi_slash encoding
- * 119:9 (http_global) IIS backslash evasion
- * 119:10 (http_global) self directory traversal
- * 119:11 (http_global) directory traversal
- * 119:12 (http_global) apache whitespace (tab)
- * 119:13 (http_global) non-RFC http delimiter
- * 119:14 (http_global) non-RFC defined char
- * 119:15 (http_global) oversize request-URI directory
- * 119:16 (http_global) oversize chunk encoding
- * 119:17 (http_global) unauthorized proxy use detected
- * 119:18 (http_global) webroot directory traversal
- * 119:19 (http_global) long header
- * 119:20 (http_global) max header fields
- * 119:21 (http_global) multiple content length
- * 119:22 (http_global) chunk size mismatch detected
- * 119:23 (http_global) invalid ip in true-client-IP/XFF header
- * 119:24 (http_global) multiple host hdrs detected
- * 119:25 (http_global) hostname exceeds 255 characters
- * 119:26 (http_global) header parsing space saturation
- * 119:27 (http_global) client consecutive small chunk sizes
- * 119:28 (http_global) post w/o content-length or chunks
- * 119:29 (http_global) multiple true IPs in a session
- * 119:30 (http_global) both true-client-IP and XFF hdrs present
- * 119:31 (http_global) unknown method
- * 119:32 (http_global) simple request
- * 119:33 (http_global) unescaped space in http URI
- * 119:34 (http_global) too many pipelined requests
- * 120:1 (http_inspect) anomalous http server on undefined HTTP port
- * 120:2 (http_inspect) invalid status code in HTTP response
- * 120:3 (http_inspect) no content-length or transfer-encoding in
- HTTP response
- * 120:4 (http_inspect) HTTP response has UTF charset which failed
- to normalize
- * 120:5 (http_inspect) HTTP response has UTF-7 charset
- * 120:6 (http_inspect) HTTP response gzip decompression failed
- * 120:7 (http_inspect) server consecutive small chunk sizes
- * 120:8 (http_inspect) invalid content-length or chunk size
- * 120:9 (http_inspect) javascript obfuscation levels exceeds 1
- * 120:10 (http_inspect) javascript whitespaces exceeds max allowed
- * 120:11 (http_inspect) multiple encodings within javascript
- obfuscated data
- * 120:12 (http_inspect) HTTP response SWF file zlib decompression
- failure
- * 120:13 (http_inspect) HTTP response SWF file LZMA decompression
- failure
- * 120:14 (http_inspect) HTTP response PDF file deflate
- decompression failure
- * 120:15 (http_inspect) HTTP response PDF file unsupported
- compression type
- * 120:16 (http_inspect) HTTP response PDF file cascaded compression
- * 120:17 (http_inspect) HTTP response PDF file parse failure
- * 122:1 (port_scan) TCP portscan
- * 122:2 (port_scan) TCP decoy portscan
- * 122:3 (port_scan) TCP portsweep
- * 122:4 (port_scan) TCP distributed portscan
- * 122:5 (port_scan) TCP filtered portscan
- * 122:6 (port_scan) TCP filtered decoy portscan
- * 122:7 (port_scan) TCP filtered portsweep
- * 122:8 (port_scan) TCP filtered distributed portscan
- * 122:9 (port_scan) IP protocol scan
- * 122:10 (port_scan) IP decoy protocol scan
- * 122:11 (port_scan) IP protocol sweep
- * 122:12 (port_scan) IP distributed protocol scan
- * 122:13 (port_scan) IP filtered protocol scan
- * 122:14 (port_scan) IP filtered decoy protocol scan
- * 122:15 (port_scan) IP filtered protocol sweep
- * 122:16 (port_scan) IP filtered distributed protocol scan
- * 122:17 (port_scan) UDP portscan
- * 122:18 (port_scan) UDP decoy portscan
- * 122:19 (port_scan) UDP portsweep
- * 122:20 (port_scan) UDP distributed portscan
- * 122:21 (port_scan) UDP filtered portscan
- * 122:22 (port_scan) UDP filtered decoy portscan
- * 122:23 (port_scan) UDP filtered portsweep
- * 122:24 (port_scan) UDP filtered distributed portscan
- * 122:25 (port_scan) ICMP sweep
- * 122:26 (port_scan) ICMP filtered sweep
- * 122:27 (port_scan) open port
- * 123:1 (stream_ip) inconsistent IP options on fragmented packets
- * 123:2 (stream_ip) teardrop attack
- * 123:3 (stream_ip) short fragment, possible DOS attempt
- * 123:4 (stream_ip) fragment packet ends after defragmented packet
- * 123:5 (stream_ip) zero-byte fragment packet
- * 123:6 (stream_ip) bad fragment size, packet size is negative
- * 123:7 (stream_ip) bad fragment size, packet size is greater than
- 65536
- * 123:8 (stream_ip) fragmentation overlap
- * 123:11 (stream_ip) TTL value less than configured minimum, not
- using for reassembly
- * 123:12 (stream_ip) excessive fragment overlap
- * 123:13 (stream_ip) tiny fragment
- * 125:1 (ftp_server) TELNET cmd on FTP command channel
- * 125:2 (ftp_server) invalid FTP command
- * 125:3 (ftp_server) FTP command parameters were too long
- * 125:4 (ftp_server) FTP command parameters were malformed
- * 125:5 (ftp_server) FTP command parameters contained potential
- string format
- * 125:6 (ftp_server) FTP response message was too long
- * 125:7 (ftp_server) FTP traffic encrypted
- * 125:8 (ftp_server) FTP bounce attempt
- * 125:9 (ftp_server) evasive (incomplete) TELNET cmd on FTP command
- channel
- * 126:1 (telnet) consecutive telnet AYT commands beyond threshold
- * 126:2 (telnet) telnet traffic encrypted
- * 126:3 (telnet) telnet subnegotiation begin command without
- subnegotiation end
- * 128:1 (ssh) Challenge-Response Overflow exploit
- * 128:2 (ssh) SSH1 CRC32 exploit
- * 128:3 (ssh) Server version string overflow
- * 128:5 (ssh) Bad message direction
- * 128:6 (ssh) Payload size incorrect for the given payload
- * 128:7 (ssh) Failed to detect SSH version string
- * 129:1 (stream_tcp) SYN on established session
- * 129:2 (stream_tcp) data on SYN packet
- * 129:3 (stream_tcp) data sent on stream not accepting data
- * 129:4 (stream_tcp) TCP timestamp is outside of PAWS window
- * 129:5 (stream_tcp) bad segment, adjusted size ⇐ 0
- * 129:6 (stream_tcp) window size (after scaling) larger than policy
- allows
- * 129:7 (stream_tcp) limit on number of overlapping TCP packets
- reached
- * 129:8 (stream_tcp) data sent on stream after TCP Reset sent
- * 129:9 (stream_tcp) TCP client possibly hijacked, different
- ethernet address
- * 129:10 (stream_tcp) TCP Server possibly hijacked, different
- ethernet address
- * 129:11 (stream_tcp) TCP data with no TCP flags set
- * 129:12 (stream_tcp) consecutive TCP small segments exceeding
- threshold
- * 129:13 (stream_tcp) 4-way handshake detected
- * 129:14 (stream_tcp) TCP timestamp is missing
- * 129:15 (stream_tcp) reset outside window
- * 129:16 (stream_tcp) FIN number is greater than prior FIN
- * 129:17 (stream_tcp) ACK number is greater than prior FIN
- * 129:18 (stream_tcp) data sent on stream after TCP Reset received
- * 129:19 (stream_tcp) TCP window closed before receiving data
- * 129:20 (stream_tcp) TCP session without 3-way handshake
- * 131:1 (dns) Obsolete DNS RR Types
- * 131:2 (dns) Experimental DNS RR Types
- * 131:3 (dns) DNS Client rdata txt Overflow
- * 134:1 (ppm) rule options disabled by rule latency
- * 134:2 (ppm) rule options re-enabled by rule latency
- * 134:3 (ppm) packet aborted due to latency
- * 141:1 (imap) Unknown IMAP3 command
- * 141:2 (imap) Unknown IMAP3 response
- * 141:4 (imap) Base64 Decoding failed.
- * 141:5 (imap) Quoted-Printable Decoding failed.
- * 141:7 (imap) Unix-to-Unix Decoding failed.
- * 142:1 (pop) Unknown POP3 command
- * 142:2 (pop) Unknown POP3 response
- * 142:4 (pop) Base64 Decoding failed.
- * 142:5 (pop) Quoted-Printable Decoding failed.
- * 142:7 (pop) Unix-to-Unix Decoding failed.
- * 219:1 (new_http_inspect) ascii encoding
- * 219:2 (new_http_inspect) double decoding attack
- * 219:3 (new_http_inspect) u encoding
- * 219:4 (new_http_inspect) bare byte unicode encoding
- * 219:5 (new_http_inspect) obsolete event—should not appear
- * 219:6 (new_http_inspect) UTF-8 encoding
- * 219:7 (new_http_inspect) IIS unicode codepoint encoding
- * 219:8 (new_http_inspect) multi_slash encoding
- * 219:9 (new_http_inspect) IIS backslash evasion
- * 219:10 (new_http_inspect) self directory traversal
- * 219:11 (new_http_inspect) directory traversal
- * 219:12 (new_http_inspect) apache whitespace (tab)
- * 219:13 (new_http_inspect) non-RFC http delimiter
- * 219:14 (new_http_inspect) non-RFC defined char
- * 219:15 (new_http_inspect) oversize request-uri directory
- * 219:16 (new_http_inspect) oversize chunk encoding
- * 219:17 (new_http_inspect) unauthorized proxy use detected
- * 219:18 (new_http_inspect) webroot directory traversal
- * 219:19 (new_http_inspect) long header
- * 219:20 (new_http_inspect) max header fields
- * 219:21 (new_http_inspect) multiple content length
- * 219:22 (new_http_inspect) chunk size mismatch detected
- * 219:23 (new_http_inspect) invalid IP in true-client-IP/XFF header
- * 219:24 (new_http_inspect) multiple host hdrs detected
- * 219:25 (new_http_inspect) hostname exceeds 255 characters
- * 219:26 (new_http_inspect) header parsing space saturation
- * 219:27 (new_http_inspect) client consecutive small chunk sizes
- * 219:28 (new_http_inspect) post w/o content-length or chunks
- * 219:29 (new_http_inspect) multiple true ips in a session
- * 219:30 (new_http_inspect) both true-client-IP and XFF hdrs
- present
- * 219:31 (new_http_inspect) unknown method
- * 219:32 (new_http_inspect) simple request
- * 219:33 (new_http_inspect) unescaped space in HTTP URI
- * 219:34 (new_http_inspect) too many pipelined requests
- * 219:35 (new_http_inspect) anomalous http server on undefined HTTP
- port
- * 219:36 (new_http_inspect) invalid status code in HTTP response
- * 219:37 (new_http_inspect) no content-length or transfer-encoding
- in HTTP response
- * 219:38 (new_http_inspect) HTTP response has UTF charset which
- failed to normalize
- * 219:39 (new_http_inspect) HTTP response has UTF-7 charset
- * 219:40 (new_http_inspect) HTTP response gzip decompression failed
- * 219:41 (new_http_inspect) server consecutive small chunk sizes
- * 219:42 (new_http_inspect) invalid content-length or chunk size
- * 219:43 (new_http_inspect) javascript obfuscation levels exceeds 1
- * 219:44 (new_http_inspect) javascript whitespaces exceeds max
- allowed
- * 219:45 (new_http_inspect) multiple encodings within javascript
- obfuscated data
- * 219:46 (new_http_inspect) SWF file zlib decompression failure
- * 219:47 (new_http_inspect) SWF file LZMA decompression failure
- * 219:48 (new_http_inspect) PDF file deflate decompression failure
- * 219:49 (new_http_inspect) PDF file unsupported compression type
- * 219:50 (new_http_inspect) PDF file cascaded compression
- * 219:51 (new_http_inspect) PDF file parse failure
- * 219:52 (new_http_inspect) HTTP misformatted or not really HTTP
-
-
-14.13. Command Set
-
-------------
-
- * snort.detach(): exit shell w/o shutdown
- * snort.dump_stats(): show summary statistics
- * snort.help(): this output
- * snort.pause(): suspend packet processing
- * snort.quit(): shutdown and dump-stats
- * snort.reload_config(): load new configuration
- * snort.resume(): continue packet processing
- * snort.rotate_stats(): roll perfmonitor log files
- * snort.show_plugins(): show available plugins
-
-
-14.14. Signals
-
-------------
-
-Important
-
-Signal numbers are for the system that generated this documentation
-and are not applicable elsewhere.
-
- * hosts(16): reload hosts file
- * int(2): shutdown normally
- * quit(3): shutdown as if started with --dirty-pig
- * reload(1): reload config file
- * rotate(31): rotate stats files
- * stats(30): dump stats to stdout
- * term(15): shutdown normally
-
-
-14.15. Configuration Changes
-
-------------
-
-change -> dynamicdetection ==> 'snort.--plugin_path=<path>'
-change -> dynamicengine ==> 'snort.--plugin_path=<path>'
-change -> dynamicpreprocessor ==> 'snort.--plugin_path=<path>'
-change -> dynamicsidechannel ==> 'snort.--plugin_path=<path>'
-change -> alertfile: 'config alertfile:' ==> 'alert_fast.file'
-change -> alertfile: 'config alertfile:' ==> 'alert_full.file'
-change -> attribute_table: 'STREAM_POLICY' ==> 'hosts: tcp_policy'
-change -> attribute_table: 'filename <file_name>' ==> 'hosts[]'
-change -> config ' addressspace_agnostic' ==> ' packets. address_space_agnostic'
-change -> config ' checksum_mode' ==> ' network. checksum_eval'
-change -> config ' daq' ==> ' daq. type'
-change -> config ' daq_dir' ==> ' daq. dir'
-change -> config ' daq_mode' ==> ' daq. mode'
-change -> config ' daq_var' ==> ' daq. var'
-change -> config ' detection_filter' ==> ' alerts. detection_filter_memcap'
-change -> config ' enable_deep_teredo_inspection' ==> ' udp. deep_teredo_inspection'
-change -> config ' event_filter' ==> ' alerts. event_filter_memcap'
-change -> config ' max_attribute_hosts' ==> ' attribute_table. max_hosts'
-change -> config ' max_attribute_services_per_host' ==> ' attribute_table. max_services_per_host'
-change -> config ' nopcre' ==> ' detection. pcre_enable'
-change -> config ' pkt_count' ==> ' packets. limit'
-change -> config ' rate_filter' ==> ' alerts. rate_filter_memcap'
-change -> config ' react' ==> ' react. page'
-change -> config ' threshold' ==> ' alerts. event_filter_memcap'
-change -> csv: 'dgmlen' ==> 'dgm_len'
-change -> csv: 'dst' ==> 'dst_addr'
-change -> csv: 'dstport' ==> 'dst_port'
-change -> csv: 'ethdst' ==> 'eth_dst'
-change -> csv: 'ethlen' ==> 'eth_len'
-change -> csv: 'ethsrc' ==> 'eth_src'
-change -> csv: 'ethtype' ==> 'eth_type'
-change -> csv: 'icmpcode' ==> 'icmp_code'
-change -> csv: 'icmpid' ==> 'icmp_id'
-change -> csv: 'icmpseq' ==> 'icmp_seq'
-change -> csv: 'icmptype' ==> 'icmp_type'
-change -> csv: 'iplen' ==> 'ip_len'
-change -> csv: 'sig_generator' ==> 'gid'
-change -> csv: 'sig_id' ==> 'sid'
-change -> csv: 'sig_rev' ==> 'rev'
-change -> csv: 'src' ==> 'src_addr'
-change -> csv: 'srcport' ==> 'src_port'
-change -> csv: 'tcpack' ==> 'tcp_ack'
-change -> csv: 'tcpflags' ==> 'tcp_flags'
-change -> csv: 'tcplen' ==> 'tcp_len'
-change -> csv: 'tcpseq' ==> 'tcp_seq'
-change -> csv: 'tcpwindow' ==> 'tcp_win'
-change -> csv: 'udplength' ==> 'udp_len'
-change -> detection: 'ac' ==> 'ac_full_q'
-change -> detection: 'ac-banded' ==> 'ac_banded'
-change -> detection: 'ac-bnfa' ==> 'ac_bnfa_q'
-change -> detection: 'ac-bnfa-nq' ==> 'ac_bnfa'
-change -> detection: 'ac-bnfa-q' ==> 'ac_bnfa_q'
-change -> detection: 'ac-nq' ==> 'ac_full'
-change -> detection: 'ac-q' ==> 'ac_full_q'
-change -> detection: 'ac-sparsebands' ==> 'ac_sparse_bands'
-change -> detection: 'ac-split' ==> 'ac_full_q'
-change -> detection: 'ac-split' ==> 'split_any_any'
-change -> detection: 'ac-std' ==> 'ac_std'
-change -> detection: 'acs' ==> 'ac_sparse'
-change -> detection: 'bleedover-port-limit' ==> 'bleedover_port_limit'
-change -> detection: 'intel-cpm' ==> 'intel_cpm'
-change -> detection: 'lowmem' ==> 'lowmem_q'
-change -> detection: 'lowmem-nq' ==> 'lowmem'
-change -> detection: 'lowmem-q' ==> 'lowmem_q'
-change -> detection: 'max-pattern-len' ==> 'max_pattern_len'
-change -> detection: 'search-method' ==> 'search_method'
-change -> detection: 'search-optimize' ==> 'search_optimize'
-change -> detection: 'split-any-any' ==> 'split_any_any'
-change -> dns: 'ports' ==> 'bindings'
-change -> event_filter: 'gen_id' ==> 'gid'
-change -> event_filter: 'sig_id' ==> 'sid'
-change -> event_filter: 'threshold' ==> 'event_filter'
-change -> file: 'config file: file_block_timeout' ==> 'block_timeout'
-change -> file: 'config file: file_type_depth' ==> 'type_depth'
-change -> file: 'config file: signature' ==> 'enable_signature'
-change -> file: 'config file: type_id' ==> 'enable_type'
-change -> frag3_engine: 'min_fragment_length' ==> 'min_frag_length'
-change -> frag3_engine: 'overlap_limit' ==> 'max_overlaps'
-change -> frag3_engine: 'policy bsd-right' ==> 'policy = bsd_right'
-change -> frag3_engine: 'timeout' ==> 'session_timeout'
-change -> ftp_telnet_protocol: 'alt_max_param_len' ==> 'cmd_validity'
-change -> ftp_telnet_protocol: 'data_chan' ==> 'ignore_data_chan'
-change -> ftp_telnet_protocol: 'ports' ==> 'bindings'
-change -> gtp: 'ports' ==> 'gtp_ports'
-change -> http_inspect: 'http_inspect' ==> 'http_global'
-change -> http_inspect_server: 'apache_whitespace' ==> 'profile.apache_whitespace'
-change -> http_inspect_server: 'ascii' ==> 'profile.ascii'
-change -> http_inspect_server: 'bare_byte' ==> 'profile.bare_byte'
-change -> http_inspect_server: 'chunk_length' ==> 'profile.chunk_length'
-change -> http_inspect_server: 'client_flow_depth' ==> 'profile.client_flow_depth'
-change -> http_inspect_server: 'directory' ==> 'profile.directory'
-change -> http_inspect_server: 'double_decode' ==> 'profile.double_decode'
-change -> http_inspect_server: 'enable_cookie' ==> 'enable_cookies'
-change -> http_inspect_server: 'flow_depth' ==> 'server_flow_depth'
-change -> http_inspect_server: 'http_inspect_server' ==> 'http_inspect'
-change -> http_inspect_server: 'iis_backslash' ==> 'profile.iis_backslash'
-change -> http_inspect_server: 'iis_delimiter' ==> 'profile.iis_delimiter'
-change -> http_inspect_server: 'iis_unicode' ==> 'profile.iis_unicode'
-change -> http_inspect_server: 'max_header_length' ==> 'profile.max_header_length'
-change -> http_inspect_server: 'max_headers' ==> 'profile.max_headers'
-change -> http_inspect_server: 'max_spaces' ==> 'profile.max_spaces'
-change -> http_inspect_server: 'multi_slash' ==> 'profile.multi_slash'
-change -> http_inspect_server: 'non_rfc_char' ==> 'non_rfc_chars'
-change -> http_inspect_server: 'non_strict' ==> 'profile.non_strict'
-change -> http_inspect_server: 'normalize_utf' ==> 'profile.normalize_utf'
-change -> http_inspect_server: 'ports' ==> 'bindings'
-change -> http_inspect_server: 'u_encode' ==> 'profile.u_encode'
-change -> http_inspect_server: 'utf_8' ==> 'profile.utf_8'
-change -> http_inspect_server: 'webroot' ==> 'profile.webroot'
-change -> http_inspect_server: 'whitespace_chars' ==> 'profile.whitespace_chars'
-change -> paf_max: 'paf_max [0:63780]' ==> 'max_pdu [1460:63780]'
-change -> perfmonitor: 'accumulate' ==> 'reset = false'
-change -> perfmonitor: 'flow-file' ==> 'flow_file = true'
-change -> perfmonitor: 'flow-ip' ==> 'flow_ip'
-change -> perfmonitor: 'flow-ip-file' ==> 'flow_ip_file = true'
-change -> perfmonitor: 'flow-ip-memcap' ==> 'flow_ip_memcap'
-change -> perfmonitor: 'flow-ports' ==> 'flow_ports'
-change -> perfmonitor: 'pktcnt' ==> 'packets'
-change -> perfmonitor: 'snortfile' ==> 'file = true'
-change -> perfmonitor: 'time' ==> 'seconds'
-change -> policy_mode: 'inline_test' ==> 'inline-test'
-change -> ppm: 'max-pkt-time' ==> 'max_pkt_time'
-change -> ppm: 'max-rule-time' ==> 'max_rule_time'
-change -> ppm: 'pkt-log' ==> 'pkt_log'
-change -> ppm: 'rule-log' ==> 'rule_log'
-change -> ppm: 'suspend-timeout' ==> 'suspend_timeout'
-change -> preprocessor 'normalize_ icmp4' ==> 'normalize. icmp4'
-change -> preprocessor 'normalize_ icmp6' ==> 'normalize. icmp6'
-change -> preprocessor 'normalize_ ip6' ==> 'normalize. ip6'
-change -> profile: 'print' ==> 'count'
-change -> rate_filter: 'gen_id' ==> 'gid'
-change -> rate_filter: 'sig_id' ==> 'sid'
-change -> rule_state: 'disabled' ==> 'enable'
-change -> rule_state: 'enabled' ==> 'enable'
-change -> sfportscan: 'proto' ==> 'protos'
-change -> sfportscan: 'scan_type' ==> 'scan_types'
-change -> ssh: 'server_ports' ==> 'bindings'
-change -> stream5_global: 'max_active_responses' ==> 'max_responses'
-change -> stream5_global: 'max_icmp' ==> 'max_sessions'
-change -> stream5_global: 'max_ip' ==> 'max_sessions'
-change -> stream5_global: 'max_tcp' ==> 'max_sessions'
-change -> stream5_global: 'max_udp' ==> 'max_sessions'
-change -> stream5_global: 'min_response_seconds' ==> 'min_interval'
-change -> stream5_global: 'prune_log_max' ==> 'histogram'
-change -> stream5_global: 'tcp_cache_nominal_timeout' ==> 'pruning_timeout'
-change -> stream5_global: 'tcp_cache_pruning_timeout' ==> 'idle_timeout'
-change -> stream5_global: 'udp_cache_nominal_timeout' ==> 'idle_timeout'
-change -> stream5_global: 'udp_cache_pruning_timeout' ==> 'pruning_timeout'
-change -> stream5_ip: 'timeout' ==> 'session_timeout'
-change -> stream5_tcp: 'bind_to' ==> 'bindings'
-change -> stream5_tcp: 'dont_reassemble_async' ==> 'reassemble_async'
-change -> stream5_tcp: 'max_queued_bytes' ==> 'queue_limit.max_bytes'
-change -> stream5_tcp: 'max_queued_segs' ==> 'queue_limit.max_segments'
-change -> stream5_tcp: 'policy hpux' ==> 'stream_tcp.policy = hpux11'
-change -> stream5_tcp: 'timeout' ==> 'session_timeout'
-change -> stream5_tcp: 'use_static_footprint_sizes' ==> 'footprint'
-change -> stream5_udp: 'timeout' ==> 'session_timeout'
-change -> suppress: 'gen_id' ==> 'gid'
-change -> suppress: 'sig_id' ==> 'sid'
-change -> syslog: 'log_alert' ==> 'level = alert'
-change -> syslog: 'log_auth' ==> 'facility = auth'
-change -> syslog: 'log_authpriv' ==> 'facility = authpriv'
-change -> syslog: 'log_cons' ==> 'options = cons'
-change -> syslog: 'log_crit' ==> 'level = crit'
-change -> syslog: 'log_daemon' ==> 'facility = daemon'
-change -> syslog: 'log_debug' ==> 'level = debug'
-change -> syslog: 'log_emerg' ==> 'level = emerg'
-change -> syslog: 'log_err' ==> 'level = err'
-change -> syslog: 'log_info' ==> 'level = info'
-change -> syslog: 'log_local0' ==> 'facility = local0'
-change -> syslog: 'log_local1' ==> 'facility = local1'
-change -> syslog: 'log_local2' ==> 'facility = local2'
-change -> syslog: 'log_local3' ==> 'facility = local3'
-change -> syslog: 'log_local4' ==> 'facility = local4'
-change -> syslog: 'log_local5' ==> 'facility = local5'
-change -> syslog: 'log_local6' ==> 'facility = local6'
-change -> syslog: 'log_local7' ==> 'facility = local7'
-change -> syslog: 'log_ndelay' ==> 'options = ndelay'
-change -> syslog: 'log_notice' ==> 'level = notice'
-change -> syslog: 'log_perror' ==> 'options = perror'
-change -> syslog: 'log_pid' ==> 'options = pid'
-change -> syslog: 'log_user' ==> 'facility = user'
-change -> syslog: 'log_warning' ==> 'level = warning'
-change -> threshold: 'ips_option: threshold' ==> 'event_filter'
-change -> unified2: ' alert_unified2' ==> 'unified2'
-change -> unified2: ' log_unified2' ==> 'unified2'
-change -> unified2: ' unified2' ==> 'unified2'
-deleted -> arpspoof: 'unicast'
-deleted -> attribute_table: '<FRAG_POLICY>hpux</FRAG_POLICY>'
-deleted -> attribute_table: '<FRAG_POLICY>irix</FRAG_POLICY>'
-deleted -> attribute_table: '<FRAG_POLICY>old-linux</FRAG_POLICY>'
-deleted -> attribute_table: '<FRAG_POLICY>unknown</FRAG_POLICY>'
-deleted -> attribute_table: '<STREAM_POLICY>noack</STREAM_POLICY>'
-deleted -> attribute_table: '<STREAM_POLICY>unknown</STREAM_POLICY>'
-deleted -> config ' cs_dir'
-deleted -> config ' disable_attribute_reload_thread'
-deleted -> config ' disable_decode_alerts'
-deleted -> config ' disable_decode_drops'
-deleted -> config ' disable_ipopt_alerts'
-deleted -> config ' disable_ipopt_drops'
-deleted -> config ' disable_tcpopt_alerts'
-deleted -> config ' disable_tcpopt_drops'
-deleted -> config ' disable_tcpopt_experimental_alerts'
-deleted -> config ' disable_tcpopt_experimental_drops'
-deleted -> config ' disable_tcpopt_obsolete_alerts'
-deleted -> config ' disable_tcpopt_obsolete_drops'
-deleted -> config ' disable_tcpopt_ttcp_alerts'
-deleted -> config ' disable_ttcp_alerts'
-deleted -> config ' disable_ttcp_drops'
-deleted -> config ' dump_dynamic_rules_path'
-deleted -> config ' enable_decode_drops'
-deleted -> config ' enable_decode_oversized_alerts'
-deleted -> config ' enable_decode_oversized_drops'
-deleted -> config ' enable_ipopt_drops'
-deleted -> config ' enable_tcpopt_drops'
-deleted -> config ' enable_tcpopt_experimental_drops'
-deleted -> config ' enable_tcpopt_obsolete_drops'
-deleted -> config ' enable_tcpopt_ttcp_drops'
-deleted -> config ' enable_ttcp_drops'
-deleted -> config ' flexresp2_attempts'
-deleted -> config ' flexresp2_interface'
-deleted -> config ' flexresp2_memcap'
-deleted -> config ' flexresp2_rows'
-deleted -> config ' include_vlan_in_alerts'
-deleted -> config ' interface'
-deleted -> config ' layer2resets'
-deleted -> config ' policy_version'
-deleted -> config ' so_rule_memcap'
-deleted -> csv: '<filename> can no longer be specific'
-deleted -> csv: 'default'
-deleted -> csv: 'trheader'
-deleted -> detection: 'mwm'
-deleted -> dns: 'enable_experimental_types'
-deleted -> dns: 'enable_obsolete_types'
-deleted -> dns: 'enable_rdata_overflow'
-deleted -> fast: '<filename> can no longer be specific'
-deleted -> frag3_engine: 'detect_anomalies'
-deleted -> frag3_global: 'disabled'
-deleted -> ftp_telnet_protocol: 'detect_anomalies'
-deleted -> full: '<filename> can no longer be specific'
-deleted -> http_inspect: 'disabled'
-deleted -> http_inspect_server: 'no_alerts'
-deleted -> perfmonitor: 'atexitonly'
-deleted -> perfmonitor: 'atexitonly: base-stats'
-deleted -> perfmonitor: 'atexitonly: events-stats'
-deleted -> perfmonitor: 'atexitonly: flow-ip-stats'
-deleted -> perfmonitor: 'atexitonly: flow-stats'
-deleted -> ppm: 'debug-pkts'
-deleted -> react: 'block'
-deleted -> react: 'warn'
-deleted -> rpc_decode: 'alert_fragments'
-deleted -> rpc_decode: 'no_alert_incomplete'
-deleted -> rpc_decode: 'no_alert_large_fragments'
-deleted -> rpc_decode: 'no_alert_multiple_requests'
-deleted -> rule_state: 'action'
-deleted -> sfportscan: 'detect_ack_scans'
-deleted -> sfportscan: 'disabled'
-deleted -> sfportscan: 'logfile'
-deleted -> ssh: 'autodetect'
-deleted -> ssh: 'enable_badmsgdir'
-deleted -> ssh: 'enable_paysize'
-deleted -> ssh: 'enable_protomismatch'
-deleted -> ssh: 'enable_recognition'
-deleted -> ssh: 'enable_respoverflow'
-deleted -> ssh: 'enable_srvoverflow'
-deleted -> ssh: 'enable_ssh1crc32'
-deleted -> stream5_global: 'disabled'
-deleted -> stream5_global: 'flush_on_alert'
-deleted -> stream5_global: 'no_midstream_drop_alerts'
-deleted -> stream5_tcp: 'check_session_hijacking'
-deleted -> stream5_tcp: 'detect_anomalies'
-deleted -> stream5_tcp: 'dont_store_large_packets'
-deleted -> stream5_tcp: 'policy noack'
-deleted -> stream5_tcp: 'policy unknown'
-deleted -> tcpdump: '<filename> can no longer be specific'
-deleted -> test: 'file'
-deleted -> test: 'stdout'
-deleted -> unified2: 'filename'
+ * basic module: a module integrated into Snort that does not come
+ from a plugin.
+ * binder: inspector that maps configuration to traffic
+ * builtin rules: codec and inspector rules for anomalies detected
+ internally.
+ * codec: short for coder / decoder. These plugins are used for
+ basic protocol decoding, anomaly detection, and construction of
+ active responses.
+ * data module: an adjunct configuration plugin for use with certain
+ inspectors.
+ * dynamic rules: plugin rules loaded at runtime. See SO rules.
+ * fast pattern: the content in an IPS rule that must be found by
+ the search engine in order for a rule to be evaluated.
+ * fast pattern matcher: see search engine.
+ * hex: a type of protocol magic that the wizard uses to identify
+ binary protocols.
+ * inspector: plugin that processes packets (similar to the legacy
+ Snort preprocessor)
+ * IPS: intrusion prevention system, like Snort.
+ * IPS action: plugin that allows you to perform custom actions when
+ events are generated. Unlike loggers, these are invoked before
+ thresholding and can be used to control external agents or send
+ active responses.
+ * IPS option: this plugin is the building blocks of IPS rules.
+ * logger: a plugin that performs output of events and packets.
+ Events are thresholded before reaching loggers.
+ * module: the user facing portion of a Snort component. Modules
+ chiefly provide configuration parameters, but may also provide
+ commands, builtin rules, profiling statistics, peg counts, etc.
+ Note that not all modules are plugins and not all plugins have
+ modules.
+ * peg count: the number of times a given event or condition occurs.
+ * plugin: one of several types of software components that can be
+ loaded from a dynamic library when Snort starts up. Some plugins
+ are coupled with the main engine in such a way that they must be
+ built statically, but a newer version can be loaded dynamically.
+ * search engine: a plugin that performs multipattern searching of
+ packets and payload to find rules that should be evaluated. There
+ are currently no specific modules, although there are several
+ search engine plugins. Related configuration is done with the
+ basic detection module. Aka fast pattern matcher.
+ * SO rule: a IPS rule plugin that performs custom detection that
+ can’t be done by a text rule. These rules typically do not have
+ associated modules. SO comes from shared object, meaning dynamic
+ library.
+ * spell: a type of protocol magic that the wizard uses to identify
+ ASCII protocols.
+ * text rule: a rule loaded from the configuration that has a header
+ and body. The header specifies action, protocol, source and
+ destination IP addresses and ports, and direction. The body
+ specifies detection and non-detection options.
+ * wizard: inspector that applies protocol magic to determine which
+ inspectors should be bound to traffic absent a port specific
+ binding. See hex and spell.
-14.16. Module Listing
+16.2. Usage
------------
- * ack (ips_option): rule option to match on TCP ack numbers
- * active (basic): configure responses
- * alert_csv (logger): output event in csv format
- * alert_fast (logger): output event with brief text format
- * alert_full (logger): output event with full packet dump
- * alert_syslog (logger): output event to syslog
- * alert_test (logger): output event in custom tsv format
- * alert_unixsock (logger): output event over unix socket
- * alerts (basic): configure alerts
- * arp (codec): support for address resolution protocol
- * arp_spoof (inspector): detect ARP attacks and anomalies
- * asn1 (ips_option): rule option for asn1 detection
- * attribute_table (basic): configure hosts loading
- * auth (codec): support for IP authentication header
- * back_orifice (inspector): back orifice detection
- * base64_decode (ips_option): rule option to decode base64 data -
- must be used with base64_data option
- * binder (inspector): configure processing based on CIDRs, ports,
- services, etc.
- * bufferlen (ips_option): rule option to check length of current
- buffer
- * byte_extract (ips_option): rule option to convert data to an
- integer variable
- * byte_jump (ips_option): rule option to move the detection cursor
- * byte_test (ips_option): rule option to convert data to integer
- and compare
- * classifications (basic): define rule categories with priority
- * classtype (ips_option): general rule option for rule
- classification
- * content (ips_option): payload rule option for basic pattern
- matching
- * cvs (ips_option): payload rule option for detecting specific
- attacks
- * daq (basic): configure packet acquisition interface
- * decode (basic): general decoder rules
- * detection (basic): configure general IPS rule processing
- parameters
- * detection_filter (ips_option): rule option to require multiple
- hits before a rule generates an event
- * dns (inspector): dns inspection
- * dsize (ips_option): rule option to test payload size
- * eapol (codec): support for extensible authentication protocol
- over LAN
- * erspan2 (codec): support for encapsulated remote switched port
- analyzer - type 2
- * erspan3 (codec): support for encapsulated remote switched port
- analyzer - type 3
- * esp (codec): support for encapsulating security payload
- * eth (codec): support for ethernet protocol (DLT 1) (DLT 51)
- * event_filter (basic): configure thresholding of events
- * event_queue (basic): configure event queue parameters
- * fabricpath (codec): support for fabricpath
- * file_data (ips_option): rule option to set detection cursor to
- file data
- * file_id (basic): configure file identification
- * flags (ips_option): rule option to test TCP control flags
- * flow (ips_option): rule option to check session properties
- * flowbits (ips_option): rule option to set and test arbitrary
- boolean flags
- * fragbits (ips_option): rule option to test IP frag flags
- * fragoffset (ips_option): rule option to test IP frag offset
- * ftp_client (inspector): FTP client configuration module for use
- with ftp_server
- * ftp_data (inspector): FTP data channel handler
- * ftp_server (inspector): main FTP module; ftp_client should also
- be configured
- * gid (ips_option): rule option specifying rule generator
- * gre (codec): support for generic routing encapsulation
- * gtp (codec): support for general-packet-radio-service tunnelling
- protocol
- * hosts (basic): configure hosts
- * http_client_body (ips_option): rule option to set the detection
- cursor to the request body
- * http_cookie (ips_option): rule option to set the detection cursor
- to the HTTP cookie
- * http_global (inspector): http inspector global configuration and
- client rules for use with http_server
- * http_header (ips_option): rule option to set the detection cursor
- to the normalized header(s)
- * http_inspect (inspector): http inspection and server rules; also
- configure http_inspect
- * http_method (ips_option): rule option to set the detection cursor
- to the HTTP request method
- * http_raw_cookie (ips_option): rule option to set the detection
- cursor to the unnormalized cookie
- * http_raw_header (ips_option): rule option to set the detection
- cursor to the unnormalized headers
- * http_raw_uri (ips_option): rule option to set the detection
- cursor to the unnormalized URI
- * http_stat_code (ips_option): rule option to set the detection
- cursor to the HTTP status code
- * http_stat_msg (ips_option): rule option to set the detection
- cursor to the HTTP status message
- * http_uri (ips_option): rule option to set the detection cursor to
- the normalized URI buffer
- * icmp4 (codec): support for Internet control message protocol v4
- * icmp6 (codec): support for Internet control message protocol v6
- * icmp_id (ips_option): rule option to check ICMP ID
- * icmp_seq (ips_option): rule option to check ICMP sequence number
- * icode (ips_option): rule option to check ICMP code
- * id (ips_option): rule option to check the IP ID field
- * igmp (codec): support for Internet group management protocol
- * imap (inspector): imap inspection
- * ip_proto (ips_option): rule option to check the IP protocol
- number
- * ipopts (ips_option): rule option to check for IP options
- * ips (basic): configure IPS rule processing
- * ipv4 (codec): support for Internet protocol v4
- * ipv6 (codec): support for Internet protocol v6
- * isdataat (ips_option): rule option to check for the presence of
- payload data
- * itype (ips_option): rule option to check ICMP type
- * log_codecs (logger): log protocols in packet by layer
- * log_pcap (logger): log packet in pcap format
- * md5 (ips_option): payload rule option for hash matching
- * metadata (ips_option): rule option for conveying arbitrary name,
- value data within the rule text
- * mpls (codec): support for multiprotocol label switching
- * msg (ips_option): rule option summarizing rule purpose output
- with events
- * network (basic): configure basic network parameters
- * new_http_inspect (inspector): new HTTP inspector
- * normalizer (inspector): packet scrubbing for inline mode
- * output (basic): configure general output parameters
- * packets (basic): configure basic packet handling
- * pcre (ips_option): rule option for matching payload data with
- regex
- * perf_monitor (inspector): performance monitoring and flow
- statistics collection
- * pgm (codec): support for pragmatic general multicast
- * pkt_data (ips_option): rule option to set the detection cursor to
- the normalized packet data
- * pop (inspector): pop inspection
- * port_scan (inspector): port scan inspector; also configure
- port_scan_global
- * port_scan_global (inspector): shared settings for port_scan
- inspectors for use with port_scan
- * ppm (basic): packet and rule latency monitoring and control
- (requires --enable-ppm)
- * pppoe (codec): support for point-to-point protocol over ethernet
- * priority (ips_option): rule option for prioritizing events
- * process (basic): configure basic process setup
- * profile (basic): configure profiling of rules and/or modules
- (requires --enable-perf-profiling)
- * rate_filter (basic): configure rate filters (which change rule
- actions)
- * raw_data (ips_option): rule option to set the detection cursor to
- the raw packet data
- * react (ips_action): send response to client and terminate session
- * reference (ips_option): rule option to indicate relevant attack
- identification system
- * references (basic): define reference systems used in rules
- * reject (ips_action): terminate session with TCP reset or ICMP
- unreachable
- * rem (ips_option): rule option to convey an arbitrary comment in
- the rule body
- * replace (ips_option): rule option to overwrite payload data; use
- with rewrite action
- * rev (ips_option): rule option to indicate current revision of
- signature
- * rewrite (ips_action): overwrite packet contents
- * rpc (ips_option): rule option to check SUNRPC CALL parameters
- * rpc_decode (inspector): RPC inspector
- * rule_state (basic): enable/disable specific IPS rules
- * search_engine (basic): configure fast pattern matcher
- * seq (ips_option): rule option to check TCP sequence number
- * session (ips_option): rule option to check user data from TCP
- sessions
- * sha256 (ips_option): payload rule option for hash matching
- * sha512 (ips_option): payload rule option for hash matching
- * sid (ips_option): rule option to indicate signature number
- * snort (basic): command line configuration and shell commands
- * so (ips_option): rule option to call custom eval function
- * soid (ips_option): rule option to specify a shared object rule ID
- * ssh (inspector): ssh inspection
- * stream (inspector): common flow tracking
- * stream_icmp (inspector): stream inspector for ICMP flow tracking
- * stream_ip (inspector): stream inspector for IP flow tracking and
- defragmentation
- * stream_reassemble (ips_option): detection option for stream
- reassembly control
- * stream_size (ips_option): detection option for stream size
- checking
- * stream_tcp (inspector): stream inspector for TCP flow tracking
- and stream normalization and reassembly
- * stream_udp (inspector): stream inspector for UDP flow tracking
- * suppress (basic): configure event suppressions
- * tag (ips_option): rule option to log additional packets
- * tcp (codec): support for transmission control protocol
- * telnet (inspector): telnet inspection and normalization
- * tos (ips_option): rule option to check type of service field
- * ttl (ips_option): rule option to check time to live field
- * udp (codec): support for user datagram protocol
- * unified2 (logger): output event and packet in unified2 format
- file
- * vlan (codec): support for local area network
- * window (ips_option): rule option to check TCP window field
- * wizard (inspector): inspector that implements port-independent
- protocol identification
- * wlan (codec): support for wireless local area network protocol
- (DLT 105) :leveloffset: 0
+For the following examples "$my_path" is assumed to be the path to
+the Snort++ install directory. Additionally, it is assumed that
+"$my_path/bin" is in your PATH.
+
+16.2.1. Environment
+
+LUA_PATH is used directly by Lua to load and run required libraries.
+SNORT_LUA_PATH is used by Snort to load supplemental configuration
+files.
+
+export LUA_PATH=$my_path/include/snort/lua/\?.lua\;\;
+export SNORT_LUA_PATH=$my_path/etc/snort
+
+16.2.2. Help
+
+Print the help summary:
+
+snort --help
+
+Get help on a specific module ("stream", for example):
-14.16.1. Plugin Listing
+snort --help-module stream
- * codec::arp: support for address resolution protocol
- * codec::auth: support for IP authentication header
- * codec::eapol: support for extensible authentication protocol over
- LAN
- * codec::erspan2: support for encapsulated remote switched port
- analyzer - type 2
- * codec::erspan3: support for encapsulated remote switched port
- analyzer - type 3
- * codec::esp: support for encapsulating security payload
- * codec::eth: support for ethernet protocol (DLT 1) (DLT 51)
- * codec::fabricpath: support for fabricpath
- * codec::gre: support for generic routing encapsulation
- * codec::gtp: support for general-packet-radio-service tunnelling
- protocol
- * codec::i4l_rawip: support for I4L IP
- * codec::icmp4: support for Internet control message protocol v4
- * codec::icmp4_ip: support for IP in ICMPv4
- * codec::icmp6: support for Internet control message protocol v6
- * codec::icmp6_ip: support for IP in ICMPv6
- * codec::igmp: support for Internet group management protocol
- * codec::ipv4: support for Internet protocol v4
- * codec::ipv6: support for Internet protocol v6
- * codec::ipv6_dst_opts: support for ipv6 destination options
- * codec::ipv6_frag: support for IPv6 fragment decoding
- * codec::ipv6_hop_opts: support for IPv6 hop options
- * codec::ipv6_mobility: support for mobility
- * codec::ipv6_no_next: sentinel codec
- * codec::ipv6_routing: support for IPv6 routing extension
- * codec::linux_sll: support for Linux SLL (DLT 113)
- * codec::llc: support for logical link control
- * codec::mpls: support for multiprotocol label switching
- * codec::null: support for null encapsulation (DLT 0)
- * codec::pflog: support for OpenBSD PF log (DLT 117)
- * codec::pgm: support for pragmatic general multicast
- * codec::ppp: support for point-to-point encapsulation (DLT
- DLT_PPP)
- * codec::ppp_encap: support for point-to-point encapsulation
- * codec::pppoe_disc: support for point-to-point discovery
- * codec::pppoe_sess: support for point-to-point session
- * codec::raw4: support for unencapsulated IPv4 (DLT 12) (DLT 228)
- * codec::raw6: support for unencapsulated IPv6 (DLT 229)
- * codec::sun_nd: support for Sun ND
- * codec::swipe: support for Swipe
- * codec::tcp: support for transmission control protocol
- * codec::teredo: support for teredo
- * codec::trans_bridge: support for trans-bridging
- * codec::udp: support for user datagram protocol
- * codec::vlan: support for local area network
- * codec::wlan: support for wireless local area network protocol
- (DLT 105)
- * inspector::arp_spoof: detect ARP attacks and anomalies
- * inspector::back_orifice: back orifice detection
- * inspector::binder: configure processing based on CIDRs, ports,
- services, etc.
- * inspector::dns: dns inspection
- * inspector::ftp_client: FTP inspector client module
- * inspector::ftp_data: FTP data channel handler
- * inspector::ftp_server: FTP inspector server module
- * inspector::http_global: shared HTTP inspector settings
- * inspector::http_inspect: main HTTP inspector module
- * inspector::imap: imap inspection
- * inspector::new_http_inspect: the new HTTP inspector!
- * inspector::normalizer: packet scrubbing for inline mode
- * inspector::perf_monitor: performance monitoring and flow
- statistics collection
- * inspector::pop: pop inspection
- * inspector::port_scan: port scan inspector; also configure
- port_scan_global
- * inspector::port_scan_global: shared settings for port_scan
- inspectors for use with port_scan
- * inspector::rpc_decode: RPC inspector
- * inspector::ssh: ssh inspection
- * inspector::stream: common flow tracking
- * inspector::stream_icmp: stream inspector for ICMP flow tracking
- * inspector::stream_ip: stream inspector for IP flow tracking and
- defragmentation
- * inspector::stream_tcp: stream inspector for TCP flow tracking and
- stream normalization and reassembly
- * inspector::stream_udp: stream inspector for UDP flow tracking
- * inspector::telnet: telnet inspection and normalization
- * inspector::wizard: inspector that implements port-independent
- protocol identification
- * ips_action::react: send response to client and terminate session
- * ips_action::reject: terminate session with TCP reset or ICMP
- unreachable
- * ips_action::rewrite: overwrite packet contents
- * ips_option::ack: rule option to match on TCP ack numbers
- * ips_option::asn1: rule option for asn1 detection
- * ips_option::base64_data: set detection cursor to decoded Base64
- data
- * ips_option::base64_decode: rule option to decode base64 data -
- must be used with base64_data option
- * ips_option::bufferlen: rule option to check length of current
- buffer
- * ips_option::byte_extract: rule option to convert data to an
- integer variable
- * ips_option::byte_jump: rule option to move the detection cursor
- * ips_option::byte_test: rule option to convert data to integer and
- compare
- * ips_option::classtype: general rule option for rule
- classification
- * ips_option::content: payload rule option for basic pattern
- matching
- * ips_option::cvs: payload rule option for detecting specific
- attacks
- * ips_option::detection_filter: rule option to require multiple
- hits before a rule generates an event
- * ips_option::dsize: rule option to test payload size
- * ips_option::file_data: rule option to set detection cursor to
- file data
- * ips_option::flags: rule option to test TCP control flags
- * ips_option::flow: rule option to check session properties
- * ips_option::flowbits: rule option to set and test arbitrary
- boolean flags
- * ips_option::fragbits: rule option to test IP frag flags
- * ips_option::fragoffset: rule option to test IP frag offset
- * ips_option::gid: rule option specifying rule generator
- * ips_option::http_client_body: rule option to set the detection
- cursor to the request body
- * ips_option::http_cookie: rule option to set the detection cursor
- to the HTTP cookie
- * ips_option::http_header: rule option to set the detection cursor
- to the normalized header(s)
- * ips_option::http_method: rule option to set the detection cursor
- to the HTTP request method
- * ips_option::http_raw_cookie: rule option to set the detection
- cursor to the unnormalized cookie
- * ips_option::http_raw_header: rule option to set the detection
- cursor to the unnormalized headers
- * ips_option::http_raw_uri: rule option to set the detection cursor
- to the unnormalized URI
- * ips_option::http_stat_code: rule option to set the detection
- cursor to the HTTP status code
- * ips_option::http_stat_msg: rule option to set the detection
- cursor to the HTTP status message
- * ips_option::http_uri: rule option to set the detection cursor to
- the normalized URI buffer
- * ips_option::icmp_id: rule option to check ICMP ID
- * ips_option::icmp_seq: rule option to check ICMP sequence number
- * ips_option::icode: rule option to check ICMP code
- * ips_option::id: rule option to check the IP ID field
- * ips_option::ip_proto: rule option to check the IP protocol number
- * ips_option::ipopts: rule option to check for IP options
- * ips_option::isdataat: rule option to check for the presence of
- payload data
- * ips_option::itype: rule option to check ICMP type
- * ips_option::md5: payload rule option for hash matching
- * ips_option::metadata: rule option for conveying arbitrary name,
- value data within the rule text
- * ips_option::msg: rule option summarizing rule purpose output with
- events
- * ips_option::pcre: rule option for matching payload data with
- regex
- * ips_option::pkt_data: rule option to set the detection cursor to
- the normalized packet data
- * ips_option::priority: rule option for prioritizing events
- * ips_option::raw_data: rule option to set the detection cursor to
- the raw packet data
- * ips_option::reference: rule option to indicate relevant attack
- identification system
- * ips_option::rem: rule option to convey an arbitrary comment in
- the rule body
- * ips_option::replace: rule option to overwrite payload data; use
- with rewrite action
- * ips_option::rev: rule option to indicate current revision of
- signature
- * ips_option::rpc: rule option to check SUNRPC CALL parameters
- * ips_option::seq: rule option to check TCP sequence number
- * ips_option::session: rule option to check user data from TCP
- sessions
- * ips_option::sha256: payload rule option for hash matching
- * ips_option::sha512: payload rule option for hash matching
- * ips_option::sid: rule option to indicate signature number
- * ips_option::so: rule option to call custom eval function
- * ips_option::soid: rule option to specify a shared object rule ID
- * ips_option::stream_reassemble: detection option for stream
- reassembly control
- * ips_option::stream_size: detection option for stream size
- checking
- * ips_option::tag: rule option to log additional packets
- * ips_option::tos: rule option to check type of service field
- * ips_option::ttl: rule option to check time to live field
- * ips_option::window: rule option to check TCP window field
- * logger::alert_csv: output event in csv format
- * logger::alert_fast: output event with brief text format
- * logger::alert_full: output event with full packet dump
- * logger::alert_syslog: output event to syslog
- * logger::alert_test: output event in custom tsv format
- * logger::alert_unixsock: output event over unix socket
- * logger::log_codecs: log protocols in packet by layer
- * logger::log_null: support for null encapsulation
- * logger::log_pcap: log packet in pcap format
- * logger::unified2: output event and packet in unified2 format file
- * search_engine::ac_banded: Aho-Corasick Banded (high memory,
- moderate performance)
- * search_engine::ac_bnfa: Aho-Corasick Binary NFA (low memory, high
- performance) MPSE
- * search_engine::ac_bnfa_q: Aho-Corasick Binary NFA (low memory,
- high performance) with queued events
- * search_engine::ac_full: Aho-Corasick Full (high memory, best
- performance), implements search_all()
- * search_engine::ac_full_q: Aho-Corasick Full (high memory, best
- performance) with queued events, implements search_all()
- * search_engine::ac_sparse: Aho-Corasick Sparse (high memory,
- moderate performance) MPSE
- * search_engine::ac_sparse_bands: Aho-Corasick Sparse-Banded (high
- memory, moderate performance) MPSE
- * search_engine::ac_std: Aho-Corasick Full (high memory, best
- performance) MPSE
+Get help on the "-A" command line option:
+
+snort --help-options A
+
+Grep for help on threads:
+
+snort --help-config | grep thread
+
+Output help on "rule" options in AsciiDoc format:
+
+snort --markup --help-options rule
+
+Note
+
+Snort++ stops reading command-line options after the "--help-" and
+"--list-" options, so any other options should be placed before them.
+
+16.2.3. Sniffing and Logging
+
+Read a pcap:
+
+snort -r /path/to/my.pcap
+
+Dump the packets to stdout:
+
+snort -r /path/to/my.pcap -L dump
+
+Dump packets with application data and layer 2 headers
+
+snort -r /path/to/my.pcap -L dump -d -e
+
+Note
+
+Command line options must be specified separately. "snort -de" won’t
+work. You can still concatenate options and their arguments, however,
+so "snort -Ldump" will work.
+
+Dump packets from all pcaps in a directory:
+
+snort --pcap-dir /path/to/pcap/dir --pcap-filter '*.pcap' -L dump -d -e
+
+Log packets to a directory:
+
+snort --pcap-dir /path/to/pcap/dir --pcap-filter '*.pcap' -L dump -l /path/to/log/dir
+
+16.2.4. Configuration
+
+Validate a configuration file:
+
+snort -c $my_path/etc/snort/snort.lua
+
+Validate a configuration file and a separate rules file:
+
+snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules
+
+Read rules from stdin and validate:
+
+snort -c $my_path/etc/snort/snort.lua --stdin-rules < $my_path/etc/snort/sample.rules
+
+Enable warnings for Lua configurations and make warnings fatal:
+
+snort -c $my_path/etc/snort/snort.lua --warn-all --pedantic
+
+Tell Snort++ where to look for additional Lua scripts:
+
+snort --script-path /path/to/script/dir
+
+16.2.5. IDS mode
+
+Run Snort++ in IDS mode, reading packets from a pcap:
+
+snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap
+
+Log any generated alerts to the console using the "-A" option:
+
+snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A alert_full
+
+Add or modify a configuration from the command line using the "--lua"
+option:
+
+snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A cmg \
+ --lua 'ips = { enable_builtin_rules = true }'
+
+Note
+
+The "--lua" option can be specified multiple times.
+
+Run Snort++ in IDS mode on an entire directory of pcaps, processing
+each input source on a separate thread:
+
+snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \
+ --pcap-filter '*.pcap' --max-packet-threads 8
-14.17. Extending Snort++
+16.3. Plugins
------------
-14.17.1. Plugins
+Load external plugins and use the "ex" alert:
-Snort++ uses a variety of plugins to accomplish much of its
-processing objectives, including:
+snort -c $my_path/etc/snort/snort.lua \
+ --plugin-path $my_path/lib/snort_extra \
+ -A alert_ex -r /path/to/my.pcap
- * Codec - to decode and encode packets
- * Inspector - like the prior preprocessors, for normalization, etc.
- * IpsOption - for detection in Snort++ rules
- * IpsAction - for custom actions
- * Logger - for handling events
- * Mpse - for fast pattern matching
- * So - for dynamic rules
+Test the LuaJIT rule option find loaded from stdin:
-Plugins have an associated API defined for each type, all of which
-share a common header, called the BaseApi. A dynamic library makes
-its plugins available by exporting the snort_plugins symbol, which is
-a null terminated array of BaseApi pointers.
+snort -c $my_path/etc/snort/snort.lua \
+ --script-path $my_path/lib/snort_extra \
+ --stdin-rules -A cmg -r /path/to/my.pcap << END
+alert tcp any any -> any 80 (
+ sid:3; msg:"found"; content:"GET";
+ find:"pat='HTTP/1%.%d'" ; )
+END
-The BaseApi includes type, name, API version, plugin version, and
-function pointers for constructing and destructing a Module. The
-specific API add various other data and functions for their given
-roles.
-14.17.2. Modules
+16.4. Output Files
-The Module is pervasive in Snort. It is how everything, including
-plugins, are configured. It also provides access to builtin rules.
-And as the glue that binds functionality to Snort, the capabilities
-of a Module are expected to grow to include statistics support, etc.
+------------
-Module configuration is handled by a list of Parameters. Most
-parameters can be validated by the framework, which means for example
-that conversion from string to number is done in exactly one place.
-Providing the builtin rules allows the documentation to include them
-automatically and also allows for autogenerating the rules at
-startup.
+To make it simple to configure outputs when you run with multiple
+packet threads, output files are not explicitly configured. Instead,
+you can use the options below to format the paths:
-If we are defining a new Inspector called, say, gadget, it might be
-configured in snort.lua like this:
+<logdir>/[<run_prefix>][<id#>][<X>]<name>
-gadget =
-{
- brain = true,
- claw = 3
-}
+Log to unified in the current directory:
-When the gadget table is processed, Snort++ will look for a module
-called gadget. If that Module has an associated API, it will be used
-to configure a new instance of the plugin. In this case, a
-GadgetModule would be instantiated, brain and claw would be set, and
-the Module instance would be passed to the GadgetInspector
-constructor.
+snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2
-Module has three key virtual methods:
+Log to unified in the current directory with a different prefix:
- * begin() - called when Snort++ starts processing the associated
- Lua table. This is a good place to allocate any required data and
- set defaults.
- * set() - called to set each parameter after validation.
- * end() - called when Snort++ finishes processing the associated
- Lua table. This is where additional integrity checks of related
- parameters should be done.
+snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2 \
+ --run-prefix take2
-The configured Module is passed to the plugin constructor which pulls
-the configuration data from the Module. For non-trivial
-configurations, the working paradigm is that Module hands a pointer
-to the configured data to the plugin instance which takes ownership.
+Log to unified in /tmp:
-Note that there is at most one instance of a given Module, even if
-multiple plugin instances are created which use that Module.
-(Multiple instances require Snort++ binding configuration.)
+snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2 -l /tmp
-14.17.3. Inspectors
+Run 4 packet threads and log with thread number prefix (0-3):
-There are several types of inspector, which determines which
-inspectors are executed when:
+snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \
+ --pcap-filter '*.pcap' -z 4 -A unified2
- * IT_BINDER - determines which inspectors apply to given flows
- * IT_WIZARD - determines which service inspector to use if none
- explicitly bound
- * IT_PACKET - used to process all packets before session and
- service processing (e.g. normalize)
- * IT_NETWORK - processes packets w/o service (e.g. arp_spoof,
- back_orifice)
- * IT_STREAM - for flow tracking, ip defrag, and tcp reassembly
- * IT_SERVICE - for http, ftp, telnet, etc.
- * IT_PROBE - process all packets after all the above (e.g.
- perf_monitor, port_scan)
+Run 4 packet threads and log in thread number subdirs (0-3):
-14.17.4. Codecs
+snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \
+ --pcap-filter '*.pcap' -z 4 -A unified2 --id-subdir
-The Snort3.0 Codecs decipher raw packets. These Codecs are now
-completely pluggable; almost every Snort3.0 Codec can be built
-dynamically and replaced with an alternative, customized Codec. The
-pluggable nature has also made it easier to build new Codecs for
-protocols without having to touch the Snort3.0 code base.
+Note
-The first step in creating a Codec is defining its class and
-protocol. Every Codec must inherit from the Snort3.0 Codec class
-defined in "framework/codec.h". The following is an example Codec
-named "example" and has an associated struct that is 14 bytes long.
+subdirectories are created automatically if required. Log filename is
+based on module name that writes the file. All text mode outputs
+default to stdout. These options can be combined.
-#include <cstdint>
-#include <arpa/inet.h>
-#include “framework/codec.h”
-#include "main/snort_types.h"
+16.4.1. DAQ Alternatives
-#define EX_NAME “example”
-#define EX_HELP “example codec help string”
+Process hext packets from stdin:
-struct Example
-{
- uint8_t dst[6];
- uint8_t src[6];
- uint16_t ethertype;
+snort -c $my_path/etc/snort/snort.lua \
+ --plugin-path $my_path/lib/snort_extra \
+ --daq-dir $my_path/lib/snort_extra/daqs --daq hext -i tty << END
+$packet 10.1.2.3 48620 -> 10.9.8.7 80
+"GET / HTTP/1.1\r\n"
+"Host: localhost\r\n"
+"\r\n"
+END
- static inline uint8_t size()
- { return 14; }
-}
+Process raw ethernet from hext file:
-class ExCodec : public Codec
-{
-public:
- ExCodec() : Codec(EX_NAME) { }
- ~ExCodec() { }
+snort -c $my_path/etc/snort/snort.lua \
+ --plugin-path $my_path/lib/snort_extra \
+ --daq-dir $my_path/lib/snort_extra/daqs --daq hext \
+ --daq-var dlt=1 -r <hext-file>
- bool decode(const RawData&, CodecData&, DecodeData&) override;
- void get_protocol_ids(std::vector<uint16_t>&) override;
-};
+Process a directory of plain files (ie non-pcap) with 4 threads:
-After defining ExCodec, the next step is adding the Codec’s decode
-functionality. The function below does this by implementing a valid
-decode function. The first parameter, which is the RawData struct,
-provides both a pointer to the raw data that has come from a wire and
-the length of that raw data. The function takes this information and
-validates that there are enough bytes for this protocol. If the raw
-data’s length is less than 14 bytes, the function returns false and
-Snort3.0 discards the packet; the packet is neither inspected nor
-processed. If the length is greater than 14 bytes, the function
-populates two fields in the CodecData struct, next_prot_id and
-lyr_len. The lyr_len field tells Snort3.0 the number of bytes that
-this layer contains. The next_prot_id field provides Snort3.0 the
-value of the next EtherType or IP protocol number.
+snort -c $my_path/etc/snort/snort.lua \
+ --plugin-path $my_path/lib/snort_extra \
+ --daq-dir $my_path/lib/snort_extra/daqs --daq file \
+ --pcap-dir path/to/files -z 4
-bool ExCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
-{
- if ( raw.len < Example::size() )
- return false;
+Bridge two TCP connections on port 8000 and inspect the traffic:
- const Example* const ex = reinterpret_cast<const Example*>(raw.data);
- codec.next_prot_id = ntohs(ex->ethertype);
- codec.lyr_len = ex->size();
- return true;
-}
+snort -c $my_path/etc/snort/snort.lua \
+ --plugin-path $my_path/lib/snort_extra \
+ --daq-dir $my_path/lib/snort_extra/daqs --daq socket
+
+16.4.2. Logger Alternatives
+
+Dump TCP stream payload in hext mode:
+
+snort -c $my_path/etc/snort/snort.lua \
+ --plugin-path $my_path/lib/snort_extra -L hext
+
+Output timestamp, pkt_num, proto, pkt_gen, dgm_len, dir, src_ap,
+dst_ap, rule, action for each alert:
+
+snort -c $my_path/etc/snort/snort.lua -A csv
+
+Output the old test format alerts:
+
+snort -c $my_path/etc/snort/snort.lua \
+ --lua "alert_csv = { fields = 'pkt_num gid sid rev', separator = '\t' }"
+
+16.4.3. Shell
+
+You must build with --enable-shell to make the command line shell
+available.
+
+Enable shell mode:
+
+snort --shell <args>
+
+You will see the shell mode command prompt, which looks like this:
+
+o")~
+
+(The prompt can be changed with the SNORT_PROMPT environment
+variable.)
+
+You can pause immediately after loading the configuration and again
+before exiting with:
+
+snort --shell --pause <args>
+
+In that case you must issue the resume() command to continue. Enter
+quit() to terminate Snort or detach() to exit the shell. You can list
+the available commands with help().
+
+To enable local telnet access on port 12345:
+
+snort --shell -j 12345 <args>
+
+The command line interface is still under development. Suggestions
+are welcome.
+
+16.4.4. Signals
+
+Note
+
+The following examples assume that Snort++ is currently running and
+has a process ID of <pid>.
+
+Modify and Reload Configuration:
+
+echo 'suppress = { { gid = 1, sid = 2215 } }' >> $my_path/etc/snort/snort.lua
+kill -hup <pid>
+
+Dump stats to stdout:
+
+kill -usr1 <pid>
+
+Shutdown normally:
-For instance, assume this decode function receives the following raw
-data with a validated length of 32 bytes:
+kill -term <pid>
-00 11 22 33 44 55 66 77 88 99 aa bb 08 00 45 00
-00 38 00 01 00 00 40 06 5c ac 0a 01 02 03 0a 09
+Exit without flushing packets:
-The Example struct’s EtherType field is the 13 and 14 bytes.
-Therefore, this function tells Snort that the next protocol has an
-EtherType of 0x0800. Additionally, since the lyr_len is set to 14,
-Snort knows that the next protocol begins 14 bytes after the
-beginning of this protocol. The Codec with EtherType 0x0800, which
-happens to be the IPv4 Codec, will receive the following data with a
-validated length of 18 ( == 32 – 14):
+kill -quit <pid>
-45 00 00 38 00 01 00 00 40 06 5c ac 0a 01 02 03
-0a 09
+List available signals:
-How does Snort3.0 know that the IPv4 Codec has an EtherType of
-0x0800? The Codec class has a second virtual function named
-get_protocol_ids(). When implementing the function, a Codec can
-register for any number of values between 0x0000 - 0xFFFF. Then, if
-the next_proto_id is set to a value for which this Codec has
-registered, this Codec’s decode function will be called. As a general
-note, the protocol ids between [0, 0x00FF] are IP protocol numbers,
-[0x0100, 0x05FF] are custom types, and [0x0600, 0xFFFF] are
-EtherTypes.
+snort --help-signals
-For example, in the get_protocol_ids function below, the ExCodec
-registers for the protocols numbers 17, 787, and 2054. 17 happens to
-be the protocol number for UDP while 2054 is ARP’s EtherType.
-Therefore, this Codec will now attempt to decode UDP and ARP data.
-Additionally, if any Codec sets the next_protocol_id to 787,
-ExCodec’s decode function will be called. Some custom protocols are
-already defined in the file "protocols/protocol_ids.h"
+Note
-void ExCodec::get_protocol_ids(std::vector<uint16_t>&v)
-{
- v.push_back(0x0011); // == 17 == UDP
- v.push_back(0x1313); // == 787 == custom
- v.push_back(0x0806); // == 2054 == ARP
-}
+The available signals may vary from platform to platform.
-To register a Codec for Data Link Type’s rather than protocols, the
-function get_data_link_type() can be similarly implemented.
-The final step to creating a pluggable Codec is the snort_plugins
-array. This array is important because when Snort3.0 loads a dynamic
-library, the program only find plugins that are inside the
-snort_plugins array. In other words, if a plugin has not been added
-to the snort_plugins array, that plugin will not be loaded into
-Snort3.0.
+16.5. Optional Features
-Although the details will not be covered in this post, the following
-code snippet is a basic CodecApi that Snort3.0 can load. This snippet
-can be copied and used with only three minor changes. First, in the
-function ctor, ExCodec should be replaced with the name of the Codec
-that is being built. Second, EX_NAME must match the Codec’s name or
-Snort will be unable to load this Codec. Third, EX_HELP should be
-replaced with the general description of this Codec. Once this code
-snippet has been added, ExCodec is ready to be compiled and plugged
-into Snort3.0.
+------------
-static Codec* ctor(Module*)
-{ return new ExCodec; }
+Listed below are the features that must be explicitly enabled so they
+are built into the Snort binary. For a full list of build features,
+run ./configure --help.
-static void dtor(Codec *cd)
-{ delete cd; }
+ * --enable-ppm: enable packet and rule performance monitoring and
+ coarse latency enforcement.
+ * --enable-perf-profiling: enable module and rule performance
+ profiling.
+ * --enable-shell: enable local and remote command line shell
+ support.
-static const CodecApi ex_api =
-{
- {
- PT_CODEC,
- EX_NAME,
- EX_HELP,
- CDAPI_PLUGIN_V0,
- 0,
- nullptr,
- nullptr,
- },
- nullptr, // pointer to a function called during Snort's startup.
- nullptr, // pointer to a function called during Snort's exit.
- nullptr, // pointer to a function called during thread's startup.
- nullptr, // pointer to a function called during thread's destruction.
- ctor, // pointer to the codec constructor.
- dtor, // pointer to the codec destructor.
-};
-SO_PUBLIC const BaseApi* snort_plugins[] =
-{
- &ex_api.base,
- nullptr
-};
+16.6. Environment Variables
-Two example Codecs are available in the extra directory on git and
-the extra tarball on the Snort3.0 page. One of those examples is the
-Token Ring Codec while the other example is the PIM Codec.
+------------
-As a final note, there are four more virtual functions that a Codec
-should implement: encode, format, update, and log. If the functions
-are not implemented Snort will not throw any errors. However, Snort
-may also be unable to accomplish some of its basic functionality.
+ * HOSTTYPE: optional string that is output with the version at end
+ of line.
+ * LUA_PATH: you must export as follows so LuaJIT can find required
+ files.
- * encode is called whenever Snort actively responds and needs to
- builds a packet, i.e. whenever a rule using an IPS ACTION like
- react, reject, or rewrite is triggered. This function is used to
- build the response packet protocol by protocol.
- * format is called when Snort is rebuilding a packet. For instance,
- every time Snort reassembles a TCP stream or IP fragment, format
- is called. Generally, this function either swaps any source and
- destination fields in the protocol or does nothing.
- * update is similar to format in that it is called when Snort is
- reassembling a packet. Unlike format, this function only sets
- length fields.
- * log is called when either the log_codecs logger or a custom
- logger that calls PacketManager::log_protocols is used when
- running Snort3.0.
+ LUA_PATH=$install_dir/include/snort/lua/\?.lua\;\;
+
+ * SNORT_IGNORE: the list of symbols Snort should ignore when
+ parsing the Lua conf. Unknown symbols not in SNORT_IGNORE will
+ cause warnings with --warn-unknown or fatals with --warn-unknown
+ --pedantic.
+ * SNORT_LUA_PATH: an optional path where Snort can find
+ supplemental conf files such as classification.lua.
+ * SNORT_PROMPT: the character sequence that is printed at startup,
+ shutdown, and in the shell. The default is the mini-pig: o")~ .
+ * SNORT_PLUGIN_PATH: an optional path where Snort can find
+ supplemental shared libraries. This is only used when Snort is
+ building manuals. Modules in supplemental shared libraries will
+ be added to the manuals.
-14.17.5. IPS Actions
-Action plugins specify a builtin action in the API which is used to
-determine verdict. (Conversely, builtin actions don’t have an
-associated plugin function.)
+16.7. Command Line Options
+
+------------
+
+ * --alert-before-pass process alert, drop, sdrop, or reject before
+ pass; default is pass before alert, drop,…
+ * --bpf <filter options> are standard BPF options, as seen in
+ TCPDump
+ * --c2x output hex for given char (see also --x2c)
+ * --create-pidfile create PID file, even when not in Daemon mode
+ * --daq <type> select packet acquisition module (default is pcap)
+ * --daq-dir <dir> tell snort where to find desired DAQ
+ * --daq-list list packet acquisition modules available in optional
+ dir, default is static modules only
+ * --daq-mode <mode> select the DAQ operating mode
+ * --daq-var <name=value> specify extra DAQ configuration variable
+ * --dirty-pig don’t flush packets on shutdown
+ * --dump-builtin-rules [<module prefix>] output stub rules for
+ selected modules
+ * --dump-defaults [<module prefix>] output module defaults in Lua
+ format
+ * --dump-dynamic-rules output stub rules for all loaded rules
+ libraries
+ * --dump-version output the version, the whole version, and only
+ the version
+ * --enable-inline-test enable Inline-Test Mode Operation
+ * --help list command line options
+ * --help-commands [<module prefix>] output matching commands
+ * --help-config [<module prefix>] output matching config options
+ * --help-counts [<module prefix>] output matching peg counts
+ * --help-module <module> output description of given module
+ * --help-modules list all available modules with brief help
+ * --help-options <option prefix> output matching command line
+ option quick help (same as -?)
+ * --help-plugins list all available plugins with brief help
+ * --help-signals dump available control signals
+ * --id-subdir create/use instance subdirectories in logdir instead
+ of instance filename prefix
+ * --id-zero use id prefix / subdirectory even with one packet
+ thread
+ * --list-buffers output available inspection buffers
+ * --list-builtin <module prefix> output matching builtin rules
+ * --list-gids [<module prefix>] output matching generators
+ * --list-modules [<module type>] list all known modules of given
+ type
+ * --list-plugins list all known plugins
+ * --logid <0xid> log Identifier to uniquely id events for multiple
+ snorts (same as -G)
+ * --lua <chunk> extend/override conf with chunk; may be repeated
+ * --markup output help in asciidoc compatible format
+ * --max-packet-threads <count> configure maximum number of packet
+ threads (same as -z)
+ * --nolock-pidfile do not try to lock Snort PID file
+ * --nostamps don’t include timestamps in log file names
+ * --pause wait for resume/quit command before processing packets/
+ terminating
+ * --pcap-dir <dir> a directory to recurse to look for pcaps - read
+ mode is implied
+ * --pcap-file <file> file that contains a list of pcaps to read -
+ read mode is implied
+ * --pcap-filter <filter> filter to apply when getting pcaps from
+ file or directory
+ * --pcap-list <list> a space separated list of pcaps to read - read
+ mode is implied
+ * --pcap-loop <count> read all pcaps <count> times; 0 will read
+ until Snort is terminated
+ * --pcap-no-filter reset to use no filter when getting pcaps from
+ file or directory
+ * --pcap-reload if reading multiple pcaps, reload snort config
+ between pcaps
+ * --pcap-show print a line saying what pcap is currently being read
+ * --pedantic warnings are fatal
+ * --plugin-path <path> where to find plugins
+ * --process-all-events process all action groups
+ * --rule <rules> to be added to configuration; may be repeated
+ * --rule-to-hex output so rule header to stdout for text rule on
+ stdin
+ * --rule-to-text output plain so rule header to stdout for text
+ rule on stdin
+ * --run-prefix <pfx> prepend this to each output file
+ * --script-path <path> where to find luajit scripts
+ * --shell enable the interactive command line
+ * --show-plugins list module and plugin versions
+ * --skip <n> skip 1st n packets
+ * --snaplen <snap> set snaplen of packet (same as -s)
+ * --stdin-rules read rules from stdin until EOF or a line starting
+ with END is read
+ * --treat-drop-as-alert converts drop, sdrop, and reject rules into
+ alert rules during startup
+ * --treat-drop-as-ignore use drop, sdrop, and reject rules to
+ ignore session traffic when not inline
+ * --version show version number (same as -V)
+ * --warn-all enable all warnings
+ * --warn-conf warn about configuration issues
+ * --warn-daq warn about DAQ issues, usually related to mode
+ * --warn-flowbits warn about flowbits that are checked but not set
+ and vice-versa
+ * --warn-hosts warn about host table issues
+ * --warn-plugins warn about issues that prevent plugins from
+ loading
+ * --warn-rules warn about duplicate rules and rule parsing issues
+ * --warn-scripts warn about issues discovered while processing Lua
+ scripts
+ * --warn-symbols warn about unknown symbols in your Lua config
+ * --warn-vars warn about variable definition and usage issues
+ * --x2c output ASCII char for given hex (see also --c2x)
+ * -? <option prefix> output matching command line option quick help
+ (same as --help-options)
+ * -A <mode> set alert mode: none, cmg, or alert_*
+ * -B <mask> obfuscated IP addresses in alerts and packet dumps
+ using CIDR mask
+ * -C print out payloads with character data only (no hex)
+ * -D run Snort in background (daemon) mode
+ * -E enable daemon restart
+ * -G <0xid> (same as --logid)
+ * -H make hash tables deterministic
+ * -L <mode> logging mode (none, dump, pcap, or log_*)
+ * -M log messages to syslog (not alerts)
+ * -O obfuscate the logged IP addresses
+ * -Q enable inline mode operation
+ * -R <rules> include this rules file in the default policy
+ * -S <x=v> set config variable x equal to value v
+ * -T test and report on the current Snort configuration
+ * -U use UTC for timestamps
+ * -V (same as --version)
+ * -W lists available interfaces
+ * -X dump the raw packet data starting at the link layer
+ * -c <conf> use this configuration
+ * -d dump the Application Layer
+ * -e display the second layer header info
+ * -f turn off fflush() calls after binary log writes
+ * -g <gname> run snort gid as <gname> group (or gid) after
+ initialization
+ * -i <iface>… list of interfaces
+ * -j <port> to listen for telnet connections
+ * -k <mode> checksum mode (all,noip,notcp,noudp,noicmp,none)
+ * -l <logdir> log to this directory instead of current directory
+ * -m <umask> set umask = <umask>
+ * -n <count> stop after count packets
+ * -q quiet mode - Don’t show banner and status report
+ * -r <pcap>… (same as --pcap-list)
+ * -s <snap> (same as --snaplen)
+ * -t <dir> chroots process to <dir> after initialization
+ * -u <uname> run snort as <uname> or <uid> after initialization
+ * -v be verbose
+ * -w dump 802.11 management and control frames
+ * -x same as --pedantic
+ * -y include year in timestamp in the alert and log files
+ * -z <count> maximum number of packet threads (same as
+ --max-packet-threads); 0 gets the number of CPU cores reported by
+ the system
+
+
+16.8. Parameters
-14.17.6. Coding Style
+------------
-All new code should try to follow these style guidelines. These are
-not yet firm so feedback is welcome to get something we can live
-with.
+Parameters are given with this format:
-14.17.6.1. General
+type name = default: help { range }
- * Generally try to follow http://google-styleguide.googlecode.com/
- svn/trunk/cppguide.xml, but there are a few differences.
+The following types are used:
-14.17.6.2. Naming
+ * addr: any valid IP4 or IP6 address or CIDR
+ * addr_list: a space separated list of addr values
+ * bit_list: a list of consecutive integer values from 1 to the
+ range maximum
+ * bool: true or false
+ * enum: a string selected from the given range
+ * implied: an IPS rule option that takes no value but means true
+ * int: a whole number in the given range
+ * ip4: an IP4 address or CIDR
+ * mac: an ethernet address with the form 01:02:03:04:05:06
+ * multi: one or more space separated strings from the given range
+ * port: an int in the range 0:65535 indicating a TCP or UDP port
+ number
+ * real: a real number in the given range
+ * select: a string selected from the given range
+ * string: any string with no more than the given length, if any
- * Use camel case for namespaces, classes, and types like
- WhizBangPdfChecker.
- * Use lower case identifiers with underscore separators, e.g.
- some_function() and my_var.
- * Use lower case filenames with underscores.
+The parameter name may be adorned in various ways to indicate
+additional information about the type and use of the parameter:
-14.17.6.3. Comments
+ * For Lua configuration (not IPS rules), if the name ends with []
+ it is a list item and can be repeated.
+ * For IPS rules only, names starting with ~ indicate positional
+ parameters. The names of such parameters do not appear in the
+ rule.
+ * IPS rules may also have a wild card parameter, which is indicated
+ by a *. Only used for metadata that Snort ignores.
+ * The snort module has command line options starting with a -.
- * Write comments sparingly with a mind towards future proofing.
- Often the comments can be obviated with better code. Clear code
- is better than a comment.
- * Function comment blocks are generally just noise that quickly
- becomes obsolete. If you absolutely must comment on parameters,
- put each on a separate line along with the comment. That way
- changing the signature may prompt a change to the comments too.
- * Use FIXIT (not FIXTHIS or TODO or whatever) to mark things left
- for a day or even just a minute. That way we can find them easily
- and won’t lose track of them.
- * Presently using FIXIT-X where X = P | H | M | L, indicating perf,
- high, med, or low priority. For now, H, M, or L can indicate
- alpha 1, 2, or 3. Perf changes fall between alpha 1 and 2.
- * Put the copyright(s) and license in a comment block at the top of
- each source file (.h and .cc). Don’t bother with trivial scripts
- and make foo. Some interesting Lua code should get a comment
- block too. Copy and paste exactly from src/main.h (don’t
- reformat).
- * Put author, description, etc. in separate comment(s) following
- the license. Do not put such comments in the middle of the
- license foo.
+Some additional details to note:
-14.17.6.4. Logging
+ * Table and variable names are case sensitive; use lower case only.
+ * String values are case sensitive too; use lower case only.
+ * Numeric ranges may be of the form low:high where low and high are
+ bounds included in the range. If either is omitted, there is no
+ hard bound. E.g. 0: means any x where x >= 0.
+ * Strings may have a numeric range indicating a length limit;
+ otherwise there is no hard limit.
+ * bit_list is typically used to store a set of byte, port, or VLAN
+ ID values.
- * Messages intended for the user should not look like debug
- messages. Eg, the function name should not be included.
- * Most debug messages should just be deleted.
- * Don’t bang your error messages (no !). The user feels bad enough
- about the problem already w/o you shouting at him.
-14.17.6.5. Types
+16.9. Configuration
- * Use logical types to make the code clearer and to help the
- compiler catch problems. typedef uint16_t Port; bool foo(Port) is
- way better than int foo(int port).
- * Use forward declarations (e.g. struct SnortConfig;) instead of
- void*.
- * Try not to use extern data unless absolutely necessary and then
- put the extern in an appropriate header.
- * Use const liberally. In most cases, const char* s = "foo" should
- be const char* const s = "foo". The former goes in the
- initialized data section and the latter in read only data
- section.
- * But use const char s[] = "foo" instead of const char* s = "foo"
- when possible. The latter form allocates a pointer variable and
- the data while the former allocates only the data.
- * Use static wherever possible to minimize public symbols and
- eliminate unneeded relocations.
- * Declare functions virtual only in the parent class introducing
- the function (not in a derived class that is overriding the
- function). This makes it clear which class introduces the
- function.
- * Declare functions as override if they are intended to override a
- function. This makes it possible to find derived implementations
- that didn’t get updated and therefore won’t get called due a
- change in the parent signature.
+------------
-14.17.6.6. Macros (aka defines)
+ * string ack.~range: check if packet payload size is size | min<>
+ max | <max | >min
+ * int active.attempts = 0: number of TCP packets sent per response
+ (with varying sequence numbers) { 0:20 }
+ * string active.device: use ip for network layer responses or eth0
+ etc for link layer
+ * string active.dst_mac: use format 01:23:45:67:89:ab
+ * int active.max_responses = 0: maximum number of responses { 0: }
+ * int active.min_interval = 255: minimum number of seconds between
+ responses { 1: }
+ * multi alert_csv.fields = timestamp pkt_num proto pkt_gen dgm_len
+ dir src_ap dst_ap rule action: selected fields will be output in
+ given order left to right { action | dir | dgm_len | dst_addr |
+ dst_ap | dst_port | eth_dst | eth_len | eth_src | eth_type | gid
+ | icmp_code | icmp_id | icmp_seq | icmp_type | ip_id | ip_len |
+ msg | pkt_gen | pkt_num | proto | rev | rule | sid | src_addr |
+ src_ap | src_port | tcp_ack | tcp_flags | tcp_len | tcp_seq |
+ tcp_win | timestamp | tos | ttl | udp_len }
+ * bool alert_csv.file = false: output to alert_csv.txt instead of
+ stdout
+ * int alert_csv.limit = 0: set limit (0 is unlimited) { 0: }
+ * string alert_csv.separator = , : separate fields with this
+ character sequence
+ * enum alert_csv.units = B: bytes | KB | MB | GB { B | K | M | G }
+ * bool alert_ex.upper = false: true/false → convert to upper/lower
+ case
+ * bool alert_fast.file = false: output to alert_fast.txt instead of
+ stdout
+ * int alert_fast.limit = 0: set limit (0 is unlimited) { 0: }
+ * bool alert_fast.packet = false: output packet dump with alert
+ * enum alert_fast.units = B: bytes | KB | MB | GB { B | K | M | G }
+ * bool alert_full.file = false: output to alert_full.txt instead of
+ stdout
+ * int alert_full.limit = 0: set limit (0 is unlimited) { 0: }
+ * enum alert_full.units = B: limit is in bytes | KB | MB | GB { B |
+ K | M | G }
+ * enum alert_syslog.facility = auth: part of priority applied to
+ each message { auth | authpriv | daemon | user | local0 | local1
+ | local2 | local3 | local4 | local5 | local6 | local7 }
+ * enum alert_syslog.level = info: part of priority applied to each
+ message { emerg | alert | crit | err | warning | notice | info |
+ debug }
+ * multi alert_syslog.options: used to open the syslog connection {
+ cons | ndelay | perror | pid }
+ * bool alerts.alert_with_interface_name = false: include interface
+ in alert info (fast, full, or syslog only)
+ * bool alerts.default_rule_state = true: enable or disable ips
+ rules
+ * int alerts.detection_filter_memcap = 1048576: set available
+ memory for filters { 0: }
+ * int alerts.event_filter_memcap = 1048576: set available memory
+ for filters { 0: }
+ * string alerts.order = pass drop alert log: change the order of
+ rule action application
+ * int alerts.rate_filter_memcap = 1048576: set available memory for
+ filters { 0: }
+ * string alerts.reference_net: set the CIDR for homenet (for use
+ with -l or -B, does NOT change $HOME_NET in IDS mode)
+ * bool alerts.stateful = false: don’t alert w/o established session
+ (note: rule action still taken)
+ * string alerts.tunnel_verdicts: let DAQ handle non-allow verdicts
+ for GTP|Teredo|6in4|4in6 traffic
+ * ip4 arp_spoof.hosts[].ip: host ip address
+ * mac arp_spoof.hosts[].mac: host mac address
+ * int asn1.absolute_offset: Absolute offset from the beginning of
+ the packet. { 0: }
+ * implied asn1.bitstring_overflow: Detects invalid bitstring
+ encodings that are known to be remotely exploitable.
+ * implied asn1.double_overflow: Detects a double ASCII encoding
+ that is larger than a standard buffer.
+ * int asn1.oversize_length: Compares ASN.1 type lengths with the
+ supplied argument. { 0: }
+ * implied asn1.print: <>max | <max | >min
+ * int asn1.relative_offset: relative offset from the cursor.
+ * int attribute_table.max_hosts = 1024: maximum number of hosts in
+ attribute table { 32:207551 }
+ * int attribute_table.max_metadata_services = 8: maximum number of
+ services in rule metadata { 1:256 }
+ * int attribute_table.max_services_per_host = 8: maximum number of
+ services per host entry in attribute table { 1:65535 }
+ * int base64_decode.bytes: Number of base64 encoded bytes to
+ decode. { 1: }
+ * int base64_decode.offset = 0: Bytes past start of buffer to start
+ decoding. { 0: }
+ * implied base64_decode.relative: Apply offset to cursor instead of
+ start of buffer.
+ * enum binder[].use.action = inspect: what to do with matching
+ traffic { reset | block | allow | inspect }
+ * string binder[].use.file: use configuration in given file
+ * string binder[].use.name: symbol name (defaults to type)
+ * string binder[].use.service: override automatic service
+ identification
+ * string binder[].use.type: select module for binding
+ * bit_list binder[].when.ifaces: list of interface indices { 255 }
+ * addr_list binder[].when.nets: list of networks
+ * int binder[].when.policy_id = 0: unique ID for selection of this
+ config by external logic { 0: }
+ * bit_list binder[].when.ports: list of ports { 65535 }
+ * enum binder[].when.proto: protocol { any | ip | icmp | tcp | udp
+ | user | file }
+ * enum binder[].when.role = any: use the given configuration on one
+ or any end of a session { client | server | any }
+ * string binder[].when.service: override default configuration
+ * bit_list binder[].when.vlans: list of VLAN IDs { 4095 }
+ * string bufferlen.~range: len | min<>max | <max | >min
+ * int byte_extract.align = 0: round the number of converted bytes
+ up to the next 2- or 4-byte boundary { 0:4 }
+ * implied byte_extract.big: big endian
+ * implied byte_extract.dce: dcerpc2 determines endianness
+ * implied byte_extract.dec: convert from decimal string
+ * implied byte_extract.hex: convert from hex string
+ * implied byte_extract.little: little endian
+ * int byte_extract.multiplier = 1: scale extracted value by given
+ amount { 1:65535 }
+ * implied byte_extract.oct: convert from octal string
+ * implied byte_extract.relative: offset from cursor instead of
+ start of buffer
+ * implied byte_extract.string: convert from string
+ * int byte_extract.~count: number of bytes to pick up from the
+ buffer { 1:10 }
+ * string byte_extract.~name: name of the variable that will be used
+ in other rule options
+ * int byte_extract.~offset: number of bytes into the buffer to
+ start processing { -65535:65535 }
+ * int byte_jump.align = 0: round the number of converted bytes up
+ to the next 2- or 4-byte boundary { 0:4 }
+ * implied byte_jump.big: big endian
+ * implied byte_jump.dce: dcerpc2 determines endianness
+ * implied byte_jump.dec: convert from decimal string
+ * implied byte_jump.from_beginning: jump from start of buffer
+ instead of cursor
+ * implied byte_jump.hex: convert from hex string
+ * implied byte_jump.little: little endian
+ * int byte_jump.multiplier = 1: scale extracted value by given
+ amount { 1:65535 }
+ * implied byte_jump.oct: convert from octal string
+ * int byte_jump.post_offset = 0: also skip forward or backwards
+ (positive of negative value) this number of bytes { -65535:65535
+ }
+ * implied byte_jump.relative: offset from cursor instead of start
+ of buffer
+ * implied byte_jump.string: convert from string
+ * int byte_jump.~count: number of bytes to pick up from the buffer
+ { 1:10 }
+ * string byte_jump.~offset: variable name or number of bytes into
+ the buffer to start processing
+ * implied byte_test.big: big endian
+ * implied byte_test.dce: dcerpc2 determines endianness
+ * implied byte_test.dec: convert from decimal string
+ * implied byte_test.hex: convert from hex string
+ * implied byte_test.little: little endian
+ * implied byte_test.oct: convert from octal string
+ * implied byte_test.relative: offset from cursor instead of start
+ of buffer
+ * implied byte_test.string: convert from string
+ * string byte_test.~compare: variable name or value to test the
+ converted result against
+ * int byte_test.~count: number of bytes to pick up from the buffer
+ { 1:10 }
+ * string byte_test.~offset: variable name or number of bytes into
+ the payload to start processing
+ * string byte_test.~operator: variable name or number of bytes into
+ the buffer to start processing
+ * string classifications[].name: name used with classtype rule
+ option
+ * int classifications[].priority = 1: default priority for class {
+ 0: }
+ * string classifications[].text: description of class
+ * string classtype.~: classification for this rule
+ * string content.depth: var or maximum number of bytes to search
+ from beginning of buffer
+ * string content.distance: var or number of bytes from cursor to
+ start search
+ * implied content.fast_pattern: use this content in the fast
+ pattern matcher instead of the content selected by default
+ * int content.fast_pattern_length: maximum number of characters
+ from this content the fast pattern matcher should use { 1: }
+ * int content.fast_pattern_offset = 0: number of leading characters
+ of this content the fast pattern matcher should exclude { 0: }
+ * implied content.nocase: case insensitive match
+ * string content.offset: var or number of bytes from start of
+ buffer to start search
+ * string content.within: var or maximum number of bytes to search
+ from cursor
+ * string content.~data: data to match
+ * implied cvs.invalid-entry: looks for an invalid Entry string
+ * bool daq.decode_data_link = false: display the second layer
+ header info
+ * string daq.dir: directory where to search for DAQ plugins
+ * select daq.mode: set mode of operation { passive | inline |
+ read-file }
+ * bool daq.no_promisc = false: whether to put DAQ device into
+ promiscuous mode
+ * int daq.snaplen = deflt: set snap length (same as -P) { 0:65535 }
+ * string daq.type: select type of DAQ
+ * string daq.vars: comma separated list of name=value DAQ-specific
+ parameters
+ * string data_log.key = http_uri: name of data buffer to log
+ * int detection.asn1 = 256: maximum decode nodes { 1: }
+ * bool detection.pcre_enable = true: disable pcre pattern matching
+ * int detection.pcre_match_limit = 1500: limit pcre backtracking,
+ -1 = max, 0 = off { -1:1000000 }
+ * int detection.pcre_match_limit_recursion = 1500: limit pcre stack
+ consumption, -1 = max, 0 = off { -1:10000 }
+ * int detection_filter.count: hits in interval before allowing the
+ rule to fire { 1: }
+ * int detection_filter.seconds: length of interval to count hits {
+ 1: }
+ * enum detection_filter.track: track hits by source or destination
+ IP address { by_src | by_dst }
+ * int dpx.max = 0: maximum payload before alert { 0:65535 }
+ * port dpx.port: port to check
+ * string dsize.~range: check if packet payload size is size | min<>
+ max | <max | >min
+ * bool esp.decode_esp = false: enable for inspection of esp traffic
+ that has authentication but not encryption
+ * int event_filter[].count = 0: number of events in interval before
+ tripping; -1 to disable { -1: }
+ * int event_filter[].gid = 1: rule generator ID { 0: }
+ * string event_filter[].ip: restrict filter to these addresses
+ according to track
+ * int event_filter[].seconds = 0: count interval { 0: }
+ * int event_filter[].sid = 1: rule signature ID { 0: }
+ * enum event_filter[].track: filter only matching source or
+ destination addresses { by_src | by_dst }
+ * enum event_filter[].type: 1st count events | every count events |
+ once after count events { limit | threshold | both }
+ * int event_queue.log = 3: maximum events to log { 1: }
+ * int event_queue.max_queue = 8: maximum events to queue { 1: }
+ * enum event_queue.order_events = content_length: criteria for
+ ordering incoming events { priority|content_length }
+ * bool event_queue.process_all_events = false: process just first
+ action group or all action groups
+ * int file_id.block_timeout = 86400: stop blocking after this many
+ seconds { 0: }
+ * bool file_id.block_timeout_lookup = false: block if lookup times
+ out
+ * bool file_id.enable_signature = false: enable signature
+ calculation
+ * bool file_id.enable_type = false: enable type ID
+ * string file_id.file_rules[].category: file type category
+ * int file_id.file_rules[].id = 0: file type id { 0: }
+ * string file_id.file_rules[].magic[].content: file magic content
+ * int file_id.file_rules[].magic[].offset = 0: file magic offset {
+ 0: }
+ * string file_id.file_rules[].msg: information about the file type
+ * int file_id.file_rules[].rev = 0: rule revision { 0: }
+ * string file_id.file_rules[].type: file type name
+ * string file_id.file_rules[].version: file type version
+ * int file_id.lookup_timeout = 2: give up on lookup after this many
+ seconds { 0: }
+ * int file_id.show_data_depth = 100: print this many octets { 0: }
+ * int file_id.signature_depth = 10485760: stop signature at this
+ point { 0: }
+ * bool file_id.trace_signature = false: enable runtime dump of
+ signature info
+ * bool file_id.trace_stream = false: enable runtime dump of file
+ data
+ * bool file_id.trace_type = false: enable runtime dump of type info
+ * int file_id.type_depth = 1460: stop type ID at this point { 0: }
+ * string flags.~mask_flags: these flags are don’t cares
+ * string flags.~test_flags: these flags are tested
+ * implied flow.established: match only during data transfer phase
+ * implied flow.from_client: same as to_server
+ * implied flow.from_server: same as to_client
+ * implied flow.no_frag: match on raw packets only
+ * implied flow.no_stream: match on raw packets only
+ * implied flow.not_established: match only outside data transfer
+ phase
+ * implied flow.only_frag: match on defragmented packets only
+ * implied flow.only_stream: match on reassembled packets only
+ * implied flow.stateless: match regardless of stream state
+ * implied flow.to_client: match on server responses
+ * implied flow.to_server: match on client requests
+ * string flowbits.~arg1: bits or group
+ * string flowbits.~arg2: group if arg1 is bits
+ * string flowbits.~command: set|reset|isset|etc.
+ * string fragbits.~flags: these flags are tested
+ * string fragoffset.~range: check if packet payload size is size |
+ min<>max | <max | >min
+ * bool ftp_client.bounce = false: check for bounces
+ * addr ftp_client.bounce_to[].address = 1.0.0.0/32: allowed ip
+ address in CIDR format
+ * port ftp_client.bounce_to[].last_port: optional allowed range
+ from port to last_port inclusive { 0: }
+ * port ftp_client.bounce_to[].port = 20: allowed port { 1: }
+ * bool ftp_client.ignore_telnet_erase_cmds = false: ignore erase
+ character and erase line commands when normalizing
+ * int ftp_client.max_resp_len = -1: maximum ftp response accepted
+ by client { -1: }
+ * bool ftp_client.telnet_cmds = false: detect telnet escape
+ sequences on ftp control channel
+ * bool ftp_server.check_encrypted = false: check for end of
+ encryption
+ * string ftp_server.chk_str_fmt: check the formatting of the given
+ commands
+ * string ftp_server.cmd_validity[].command: command string
+ * string ftp_server.cmd_validity[].format: format specification
+ * int ftp_server.cmd_validity[].length = 0: specify non-default
+ maximum for command { 0: }
+ * string ftp_server.data_chan_cmds: check the formatting of the
+ given commands
+ * string ftp_server.data_xfer_cmds: check the formatting of the
+ given commands
+ * int ftp_server.def_max_param_len = 100: default maximum length of
+ commands handled by server; 0 is unlimited { 1: }
+ * string ftp_server.directory_cmds[].dir_cmd: directory command
+ * int ftp_server.directory_cmds[].rsp_code = 200: expected
+ successful response code for command { 200: }
+ * string ftp_server.encr_cmds: check the formatting of the given
+ commands
+ * bool ftp_server.encrypted_traffic = false: check for encrypted
+ telnet and ftp
+ * string ftp_server.file_get_cmds: check the formatting of the
+ given commands
+ * string ftp_server.file_put_cmds: check the formatting of the
+ given commands
+ * string ftp_server.ftp_cmds: specify additional commands supported
+ by server beyond RFC 959
+ * bool ftp_server.ignore_data_chan = false: do not inspect ftp data
+ channels
+ * bool ftp_server.ignore_telnet_erase_cmds = false: ignore erase
+ character and erase line commands when normalizing
+ * string ftp_server.login_cmds: check the formatting of the given
+ commands
+ * bool ftp_server.print_cmds = false: print command configurations
+ on start up
+ * bool ftp_server.telnet_cmds = false: detect telnet escape
+ sequences of ftp control channel
+ * int gid.~: generator id { 1: }
+ * enum hosts[].frag_policy: defragmentation policy { first | linux
+ | bsd | bsd_right | last | windows | solaris }
+ * addr hosts[].ip = 0.0.0.0/32: hosts address / cidr
+ * string hosts[].services[].name: service identifier
+ * port hosts[].services[].port: port number
+ * enum hosts[].services[].proto = tcp: ip protocol { tcp | udp }
+ * enum hosts[].tcp_policy: tcp reassembly policy { first | last |
+ linux | old_linux | bsd | macos | solaris | irix | hpux11 |
+ hpux10 | windows | win_2003 | vista | proxy }
+ * int http_global.compress_depth = 65535: maximum amount of packet
+ payload to decompress { 1:65535 }
+ * int http_global.decode.b64_decode_depth = 0: single packet decode
+ depth { -1:65535 }
+ * int http_global.decode.bitenc_decode_depth = 0: single packet
+ decode depth { -1:65535 }
+ * int http_global.decode.max_mime_mem = 838860: single packet
+ decode depth { 3276: }
+ * int http_global.decode.qp_decode_depth = 0: single packet decode
+ depth { -1:65535 }
+ * int http_global.decode.uu_decode_depth = 0: single packet decode
+ depth { -1:65535 }
+ * int http_global.decompress_depth = 65535: maximum amount of
+ decompressed data to process { 1:65535 }
+ * bool http_global.detect_anomalous_servers = false: inspect
+ non-configured ports for HTTP - bad idea
+ * int http_global.max_gzip_mem = 838860: total memory used for
+ decompression across all active sessions { 3276: }
+ * int http_global.memcap = 150994944: limit of memory used for
+ logging extra data { 2304: }
+ * bool http_global.proxy_alert = false: alert on proxy usage for
+ servers without allow_proxy_use
+ * int http_global.unicode_map.code_page = 1252: select code page in
+ map file { 0: }
+ * string http_global.unicode_map.map_file: unicode map file
+ * string http_header.~name: restrict to given header
+ * bool http_inspect.allow_proxy_use = false: don’t alert on proxy
+ use for this server
+ * bool http_inspect.decompress_pdf = false: enable decompression of
+ the compressed portions of PDF files
+ * bool http_inspect.decompress_swf = false: enable decompression of
+ SWF (Adobe Flash content)
+ * bool http_inspect.enable_cookies = true: extract cookies
+ * bool http_inspect.enable_xff = false: log True-Client-IP and
+ X-Forwarded-For headers with unified2 alerts as extra data
+ * bool http_inspect.extended_ascii_uri = false: allow extended
+ ASCII codes in the request URI
+ * bool http_inspect.extended_response_inspection = true: extract
+ response headers
+ * string http_inspect.http_methods = GET POST PUT SEARCH MKCOL COPY
+ MOVE LOCK UNLOCK NOTIFY POLL BCOPY BDELETE BMOVE LINK UNLINK
+ OPTIONS HEAD DELETE TRACE TRACK CONNECT SOURCE SUBSCRIBE
+ UNSUBSCRIBE PROPFIND PROPPATCH BPROPFIND BPROPPATCH RPC_CONNECT
+ PROXY_SUCCESS BITS_POST CCM_POST SMS_POST RPC_IN_DATA
+ RPC_OUT_DATA RPC_ECHO_DATA: request methods allowed in addition
+ to GET and POST
+ * bool http_inspect.inspect_gzip = true: enable gzip decompression
+ of compressed bodies
+ * bool http_inspect.inspect_uri_only = false: disable all detection
+ except for uricontent
+ * bool http_inspect.log_hostname = false: enable logging of
+ Hostname with unified2 alerts as extra data
+ * bool http_inspect.log_uri = false: enable logging of URI with
+ unified2 alerts as extra data
+ * bool http_inspect.no_pipeline_req = false: don’t inspect
+ pipelined requests after first (still does general detection)
+ * bit_list http_inspect.non_rfc_chars = 0x00 0x01 0x02 0x03 0x04
+ 0x05 0x06 0x07: alert on given non-RFC chars being present in the
+ URI { 255 }
+ * bool http_inspect.normalize_cookies = false: normalize cookies
+ similar to URI
+ * bool http_inspect.normalize_headers = false: normalize headers
+ other than cookie similar to URI
+ * int http_inspect.oversize_dir_length = 500: alert if a URL has a
+ directory longer than this limit { 0: }
+ * bool http_inspect.profile.apache_whitespace = false: don’t alert
+ if tab is used in lieu of space characters
+ * bool http_inspect.profile.ascii = false: enable decoding ASCII
+ like %2f to /
+ * bool http_inspect.profile.bare_byte = false: decode non-standard,
+ non-ASCII character encodings
+ * int http_inspect.profile.chunk_length = 500000: alert on chunk
+ lengths greater than specified { 1: }
+ * int http_inspect.profile.client_flow_depth = 0: raw request
+ payload to inspect { -1:1460 }
+ * bool http_inspect.profile.directory = false: normalize . and ..
+ sequences out of URI
+ * bool http_inspect.profile.double_decode = false: iis specific
+ extra decoding
+ * bool http_inspect.profile.iis_backslash = false: normalize
+ directory slashes
+ * bool http_inspect.profile.iis_delimiter = false: allow use of
+ non-standard delimiter
+ * bool http_inspect.profile.iis_unicode = false: enable unicode
+ code point mapping using unicode_map settings
+ * int http_inspect.profile.iis_unicode_map.code_page = 1252: select
+ code page in map file { 0: }
+ * string http_inspect.profile.iis_unicode_map.map_file: unicode map
+ file
+ * int http_inspect.profile.max_header_length = 750: maximum allowed
+ client request header field { 0:65535 }
+ * int http_inspect.profile.max_headers = 100: maximum allowed
+ client request headers { 0:1024 }
+ * int http_inspect.profile.max_javascript_whitespaces = 200:
+ maximum number of consecutive whitespaces { 0: }
+ * int http_inspect.profile.max_spaces = 200: maximum allowed
+ whitespaces when folding { 0:65535 }
+ * bool http_inspect.profile.multi_slash = false: normalize out
+ consecutive slashes in URI
+ * bool http_inspect.profile.non_strict = true: allows HTTP 0.9
+ processing
+ * bool http_inspect.profile.normalize_javascript = true: normalize
+ javascript between <script> tags
+ * bool http_inspect.profile.normalize_utf = true: normalize
+ response bodies with UTF content-types
+ * int http_inspect.profile.post_depth = 65495: amount of POST data
+ to inspect { -1:65535 }
+ * enum http_inspect.profile.profile_type = default: set defaults
+ appropriate for selected server { default | apache | iis | iis_40
+ | iis_50 }
+ * int http_inspect.profile.server_flow_depth = 0: response payload
+ to inspect; includes headers with extended_response_inspection {
+ -1:65535 }
+ * bool http_inspect.profile.u_encode = true: decode %uXXXX
+ character sequences
+ * bool http_inspect.profile.utf_8 = false: decode UTF-8 unicode
+ sequences in URI
+ * bool http_inspect.profile.webroot = false: alert on directory
+ traversals past the top level (web server root)
+ * bit_list http_inspect.profile.whitespace_chars: allowed white
+ space characters { 255 }
+ * int http_inspect.small_chunk_count = 5: alert if more than this
+ limit of consecutive chunks are below small_chunk_length { 0:255
+ }
+ * int http_inspect.small_chunk_length = 10: alert if more than
+ small_chunk_count consecutive chunks below this limit { 0:255 }
+ * bool http_inspect.tab_uri_delimiter = false: whether a tab not
+ preceded by a space is considered a delimiter or part of URI
+ * bool http_inspect.unlimited_decompress = true: decompress across
+ multiple packets
+ * bool http_inspect.xff_headers = false: not implemented
+ * string icmp_id.~range: check if icmp id is id | min<>max | <max |
+ >min
+ * string icmp_seq.~range: check if icmp sequence number is seq |
+ min<>max | <max | >min
+ * string icode.~range: check if ICMP code is code | min<>max | <max
+ | >min
+ * string id.~range: check if the IP ID is id | min<>max | <max | >
+ min
+ * int imap.b64_decode_depth = 1460: base64 decoding depth {
+ -1:65535 }
+ * int imap.bitenc_decode_depth = 1460: Non-Encoded MIME attachment
+ extraction depth { -1:65535 }
+ * int imap.qp_decode_depth = 1460: Quoted Printable decoding depth
+ { -1:65535 }
+ * int imap.uu_decode_depth = 1460: Unix-to-Unix decoding depth {
+ -1:65535 }
+ * string ip_proto.~proto: [!|>|<] name or number
+ * select ipopts.~opt: output format { rr|eol|nop|ts|sec|esec|lsrr|
+ lsrre|ssrr|satid|any }
+ * bool ips.enable_builtin_rules = false: enable events from builtin
+ rules w/o stubs
+ * int ips.id = 0: correlate unified2 events with configuration {
+ 0:65535 }
+ * string ips.include: legacy snort rules and includes
+ * enum ips.mode: set policy mode { tap | inline | inline-test }
+ * string ips.rules: snort rules and includes
+ * implied isdataat.relative: offset from cursor instead of start of
+ buffer
+ * string isdataat.~length: num | !num
+ * string itype.~range: check if icmp type is type | min<>max | <max
+ | >min
+ * bool log_codecs.file = false: output to log_codecs.txt instead of
+ stdout
+ * bool log_codecs.msg = false: include alert msg
+ * bool log_hext.file = false: output to log_hext.txt instead of
+ stdout
+ * int log_hext.limit = 0: set limit (0 is unlimited) { 0: }
+ * bool log_hext.raw = false: output all full packets if true, else
+ just TCP payload
+ * enum log_hext.units = B: bytes | KB | MB | GB { B | K | M | G }
+ * int log_hext.width = 20: set line width (0 is unlimited) { 0: }
+ * int log_pcap.limit = 0: set limit (0 is unlimited) { 0: }
+ * enum log_pcap.units = B: bytes | KB | MB | GB { B | K | M | G }
+ * string lowmem_q.var: additional print text
+ * int md5.length: number of octets in plain text { 1:65535 }
+ * string md5.offset: var or number of bytes from start of buffer to
+ start search
+ * implied md5.relative = false: offset from cursor instead of start
+ of buffer
+ * string md5.~hash: data to match
+ * string metadata.*: additional parameters not used by snort
+ * string metadata.service: service name
+ * bool mpls.enable_mpls_multicast = false: enables support for MPLS
+ multicast
+ * bool mpls.enable_mpls_overlapping_ip = false: enable if private
+ network addresses overlap and must be differentiated by MPLS
+ label(s)
+ * int mpls.max_mpls_stack_depth = -1: set MPLS stack depth { -1: }
+ * enum mpls.mpls_payload_type = ip4: set encapsulated payload type
+ { eth | ip4 | ip6 }
+ * string msg.~: message describing rule
+ * multi network.checksum_drop = none: drop if checksum is bad { all
+ | ip | noip | tcp | notcp | udp | noudp | icmp | noicmp | none }
+ * multi network.checksum_eval = none: checksums to verify { all |
+ ip | noip | tcp | notcp | udp | noudp | icmp | noicmp | none }
+ * bool network.decode_drops = false: enable dropping of packets by
+ the decoder
+ * int network.id = 0: correlate unified2 events with configuration
+ { 0:65535 }
+ * int network.layers = 40: The maximum number of protocols that
+ Snort can correctly decode { 3:255 }
+ * int network.max_ip6_extensions = 0: The number of IP6 options
+ Snort will process for a given IPv6 layer. If this limit is hit,
+ rule 116:456 may fire. 0 = unlimited { 0:255 }
+ * int network.max_ip_layers = 0: The maximum number of IP layers
+ Snort will process for a given packet If this limit is hit, rule
+ 116:293 may fire. 0 = unlimited { 0:255 }
+ * int network.min_ttl = 1: alert / normalize packets with lower ttl
+ / hop limit (you must enable rules and / or normalization also) {
+ 1:255 }
+ * int network.new_ttl = 1: use this value for responses and when
+ normalizing { 1:255 }
+ * bool new_http_inspect.test_input = false: read HTTP messages from
+ text file
+ * bool new_http_inspect.test_output = false: print out HTTP section
+ data
+ * bool normalizer.icmp4 = false: clear reserved flag
+ * bool normalizer.icmp6 = false: clear reserved flag
+ * bool normalizer.ip4.base = true: clear options
+ * bool normalizer.ip4.df = false: clear don’t frag flag
+ * bool normalizer.ip4.rf = false: clear reserved flag
+ * bool normalizer.ip4.tos = false: clear tos / differentiated
+ services byte
+ * bool normalizer.ip4.trim = false: truncate excess payload beyond
+ datagram length
+ * bool normalizer.ip6 = false: clear reserved flag
+ * string normalizer.tcp.allow_codes: don’t clear given option codes
+ * multi normalizer.tcp.allow_names: don’t clear given option names
+ { sack | echo | partial_order | conn_count | alt_checksum | md5 }
+ * bool normalizer.tcp.base = true: clear reserved bits and option
+ padding and fix urgent pointer / flags issues
+ * bool normalizer.tcp.block = true: allow packet drops during TCP
+ normalization
+ * select normalizer.tcp.ecn = off: clear ecn for all packets |
+ sessions w/o ecn setup { off | packet | stream }
+ * bool normalizer.tcp.ips = false: ensure consistency in
+ retransmitted data
+ * bool normalizer.tcp.opts = true: clear all options except mss,
+ wscale, timestamp, and any explicitly allowed
+ * bool normalizer.tcp.pad = true: clear any option padding bytes
+ * bool normalizer.tcp.req_pay = true: clear the urgent pointer and
+ the urgent flag if there is no payload
+ * bool normalizer.tcp.req_urg = true: clear the urgent pointer if
+ the urgent flag is not set
+ * bool normalizer.tcp.req_urp = true: clear the urgent flag if the
+ urgent pointer is not set
+ * bool normalizer.tcp.rsv = true: clear the reserved bits in the
+ TCP header
+ * bool normalizer.tcp.trim = false: enable all of the TCP trim
+ options
+ * bool normalizer.tcp.trim_mss = false: trim data to MSS
+ * bool normalizer.tcp.trim_rst = false: remove any data from RST
+ packet
+ * bool normalizer.tcp.trim_syn = false: remove data on SYN
+ * bool normalizer.tcp.trim_win = false: trim data to window
+ * bool normalizer.tcp.urp = true: adjust urgent pointer if beyond
+ segment length
+ * bool output.dump_chars_only = false: turns on character dumps
+ (same as -C)
+ * bool output.dump_payload = false: dumps application layer (same
+ as -d)
+ * bool output.dump_payload_verbose = false: dumps raw packet
+ starting at link layer (same as -X)
+ * int output.event_trace.max_data = 0: maximum amount of packet
+ data to capture { 0:65535 }
+ * bool output.log_ipv6_extra_data = false: log IPv6 source and
+ destination addresses as unified2 extra data records
+ * string output.logdir = .: where to put log files (same as -l)
+ * bool output.obfuscate = false: obfuscate the logged IP addresses
+ (same as -O)
+ * bool output.quiet = false: suppress non-fatal information (still
+ show alerts, same as -q)
+ * bool output.show_year = false: include year in timestamp in the
+ alert and log files (same as -y)
+ * int output.tagged_packet_limit = 256: maximum number of packets
+ tagged for non-packet metrics { 0: }
+ * bool output.verbose = false: be verbose (same as -v)
+ * bool packets.address_space_agnostic = false: determines whether
+ DAQ address space info is used to track fragments and connections
+ * string packets.bpf_file: file with BPF to select traffic for
+ Snort
+ * bool packets.enable_inline_init_failopen = true: whether to pass
+ traffic during later stage of initialization to avoid drops
+ * int packets.limit = 0: maximum number of packets to process
+ before stopping (0 is unlimited) { 0: }
+ * int packets.skip = 0: number of packets to skip before before
+ processing { 0: }
+ * bool packets.vlan_agnostic = false: determines whether VLAN info
+ is used to track fragments and connections
+ * string pcre.~regex: Snort regular expression
+ * bool perf_monitor.console = false: output to console
+ * bool perf_monitor.events = false: report on qualified vs
+ non-qualified events
+ * bool perf_monitor.file = false: output base stats to
+ perf_monitor.csv instead of stdout
+ * bool perf_monitor.flow = false: enable traffic statistics
+ * bool perf_monitor.flow_file = false: output traffic statistics to
+ a perf_monitor_flow.csv instead of stdout
+ * bool perf_monitor.flow_ip = false: enable statistics on host
+ pairs
+ * bool perf_monitor.flow_ip_file = false: output host pair
+ statistics to perf_monitor_flow_ip.csv instead of stdout
+ * int perf_monitor.flow_ip_memcap = 52428800: maximum memory for
+ flow tracking { 8200: }
+ * int perf_monitor.flow_ports = 1023: maximum ports to track { 0: }
+ * bool perf_monitor.max = false: calculate theoretical maximum
+ performance
+ * int perf_monitor.max_file_size = 4096: files will be rolled over
+ if they exceed this size { 4096: }
+ * int perf_monitor.packets = 10000: minim packets to report { 0: }
+ * bool perf_monitor.reset = true: reset (clear) statistics after
+ each reporting interval
+ * int perf_monitor.seconds = 60: report interval; 0 means report at
+ exit only { 0: }
+ * int pop.b64_decode_depth = 1460: base64 decoding depth { -1:65535
+ }
+ * int pop.bitenc_decode_depth = 1460: Non-Encoded MIME attachment
+ extraction depth { -1:65535 }
+ * int pop.qp_decode_depth = 1460: Quoted Printable decoding depth {
+ -1:65535 }
+ * int pop.uu_decode_depth = 1460: Unix-to-Unix decoding depth {
+ -1:65535 }
+ * string port_scan.ignore_scanned: list of CIDRs with optional
+ ports to ignore if the destination of scan alerts
+ * string port_scan.ignore_scanners: list of CIDRs with optional
+ ports to ignore if the source of scan alerts
+ * bool port_scan.include_midstream = false: list of CIDRs with
+ optional ports
+ * bool port_scan.logfile = false: write scan events to file
+ * multi port_scan.protos = all: choose the protocols to monitor {
+ tcp | udp | icmp | ip | all }
+ * multi port_scan.scan_types = all: choose type of scans to look
+ for { portscan | portsweep | decoy_portscan |
+ distributed_portscan | all }
+ * enum port_scan.sense_level = medium: choose the level of
+ detection { low | medium | high }
+ * string port_scan.watch_ip: list of CIDRs with optional ports to
+ watch
+ * int port_scan_global.memcap = 1048576: maximum tracker memory {
+ 1: }
+ * bool ppm.fastpath_expensive_packets = false: stop inspection if
+ the max_pkt_time is exceeded
+ * int ppm.max_pkt_time = 0: enable packet latency thresholding
+ (usec), 0 = off { 0: }
+ * int ppm.max_rule_time = 0: enable rule latency thresholding
+ (usec), 0 = off { 0: }
+ * enum ppm.pkt_log = none: log event if max_pkt_time is exceeded {
+ none | log | alert | both }
+ * enum ppm.rule_log = none: enable event logging for suspended
+ rules { none|log|alert|both }
+ * bool ppm.suspend_expensive_rules = false: temporarily disable
+ rule if threshold is reached
+ * int ppm.suspend_timeout = 60: seconds to suspend rule, 0 =
+ permanent { 0: }
+ * int ppm.threshold = 5: number of times to exceed limit before
+ disabling rule { 1: }
+ * int priority.~: relative severity level; 1 is highest priority {
+ 1: }
+ * string process.chroot: set chroot directory (same as -t)
+ * bool process.daemon = false: fork as a daemon (same as -D)
+ * bool process.dirty_pig = false: shutdown without internal cleanup
+ * string process.set_gid: set group ID (same as -g)
+ * string process.set_uid: set user ID (same as -u)
+ * int process.threads[].cpu = 0: pin the associated source/thread
+ to this cpu { 0:127 }
+ * string process.threads[].source: set cpu affinity for this source
+ (either pcap or <iface>
+ * int process.threads[].thread = 0: set cpu affinity for the
+ <cur_thread_num> thread that runs { 0: }
+ * string process.umask: set process umask (same as -m)
+ * bool process.utc = false: use UTC instead of local time for
+ timestamps
+ * int profile.modules.count = -1: print results to given level (-1
+ = all, 0 = off) { -1: }
+ * enum profile.modules.sort = avg_ticks: sort by given field {
+ checks | avg_ticks | total_ticks }
+ * int profile.rules.count = -1: print results to given level (-1 =
+ all, 0 = off) { -1: }
+ * enum profile.rules.sort = avg_ticks: sort by given field { checks
+ | avg_ticks | total_ticks | matches | no_matches |
+ avg_ticks_per_match | avg_ticks_per_no_match }
+ * string rate_filter[].apply_to: restrict filter to these addresses
+ according to track
+ * int rate_filter[].count = 1: number of events in interval before
+ tripping { 0: }
+ * int rate_filter[].gid = 1: rule generator ID { 0: }
+ * select rate_filter[].new_action = alert: take this action on
+ future hits until timeout { alert | drop | log | pass | | reject
+ | sdrop }
+ * int rate_filter[].seconds = 1: count interval { 0: }
+ * int rate_filter[].sid = 1: rule signature ID { 0: }
+ * int rate_filter[].timeout = 1: count interval { 0: }
+ * enum rate_filter[].track = by_src: filter only matching source or
+ destination addresses { by_src | by_dst | by_rule }
+ * bool react.msg = false: use rule msg in response page instead of
+ default message
+ * string react.page: file containing HTTP response (headers and
+ body)
+ * string reference.~id: reference id
+ * string reference.~scheme: reference scheme
+ * string references[].name: name used with reference rule option
+ * string references[].url: where this reference is defined
+ * enum reject.control: send icmp unreachable(s) { network|host|port
+ |all }
+ * enum reject.reset: send tcp reset to one or both ends { source|
+ dest|both }
+ * string rem.~: comment
+ * string replace.~: byte code to replace with
+ * int rev.~: revision { 1: }
+ * string rpc.~app: application number
+ * string rpc.~proc: procedure number or * for any
+ * string rpc.~ver: version number or * for any
+ * bool rule_state.enable = true: enable or disable rule in all
+ policies
+ * int rule_state.gid = 0: rule generator ID { 0: }
+ * int rule_state.sid = 0: rule signature ID { 0: }
+ * int search_engine.bleedover_port_limit = 1024: maximum ports in
+ rule before demotion to any-any port group { 1: }
+ * bool search_engine.bleedover_warnings_enabled = false: print
+ warning if a rule is demoted to any-any port group
+ * bool search_engine.debug = false: print verbose fast pattern info
+ * bool search_engine.debug_print_fast_pattern = false: print fast
+ pattern info for each rule
+ * bool search_engine.debug_print_nocontent_rule_tests = false:
+ print rule group info during packet evaluation
+ * bool search_engine.debug_print_rule_group_build_details = false:
+ print rule group info during compilation
+ * bool search_engine.debug_print_rule_groups_compiled = false:
+ prints compiled rule group information
+ * bool search_engine.debug_print_rule_groups_uncompiled = false:
+ prints uncompiled rule group information
+ * bool search_engine.enable_single_rule_group = false: put all
+ rules into one group
+ * bool search_engine.inspect_stream_inserts = false: inspect
+ reassembled payload - disabling is good for performance, bad for
+ detection
+ * int search_engine.max_pattern_len = 0: truncate patterns when
+ compiling into state machine (0 means no maximum) { 0: }
+ * int search_engine.max_queue_events = 5: maximum number of
+ matching fast pattern states to queue per packet
+ * string search_engine.search_method = ac_bnfa_q: set fast pattern
+ algorithm - choose available search engine
+ * bool search_engine.search_optimize = false: tweak state machine
+ construction for better performance
+ * bool search_engine.split_any_any = false: evaluate any-any rules
+ separately to save memory
+ * string seq.~range: check if packet payload size is size | min<>
+ max | <max | >min
+ * enum session.~mode: output format { printable|binary|all }
+ * int sha256.length: number of octets in plain text { 1:65535 }
+ * string sha256.offset: var or number of bytes from start of buffer
+ to start search
+ * implied sha256.relative = false: offset from cursor instead of
+ start of buffer
+ * string sha256.~hash: data to match
+ * int sha512.length: number of octets in plain text { 1:65535 }
+ * string sha512.offset: var or number of bytes from start of buffer
+ to start search
+ * implied sha512.relative = false: offset from cursor instead of
+ start of buffer
+ * string sha512.~hash: data to match
+ * int sid.~: signature id { 1: }
+ * bool sip.ignore_call_channel = false: enables the support for
+ ignoring audio/video data channel
+ * int sip.max_call_id_len = 256: maximum call id field size {
+ 0:65535 }
+ * int sip.max_contact_len = 256: maximum contact field size {
+ 0:65535 }
+ * int sip.max_content_len = 1024: maximum content length of the
+ message body { 0:65535 }
+ * int sip.max_dialogs = 4: maximum number of dialogs within one
+ stream session { 1:4194303 }
+ * int sip.max_from_len = 256: maximum from field size { 0:65535 }
+ * int sip.max_requestName_len = 20: maximum request name field size
+ { 0:65535 }
+ * int sip.max_sessions = 10000: maximum number of sessions that can
+ be allocated { 1024:4194303 }
+ * int sip.max_to_len = 256: maximum to field size { 0:65535 }
+ * int sip.max_uri_len = 256: maximum request uri field size {
+ 0:65535 }
+ * int sip.max_via_len = 1024: maximum via field size { 0:65535 }
+ * string sip.methods = invite cancel ack bye register options: list
+ of methods to check in sip messages
+ * string sip_method.*method: sip method
+ * int sip_stat_code.*code: stat code { 1:999 }
+ * string smtp.alt_max_command_line_len[].command: command string
+ * int smtp.alt_max_command_line_len[].length = 0: specify
+ non-default maximum for command { 0: }
+ * string smtp.auth_cmds: commands that initiate an authentication
+ exchange
+ * int smtp.b64_decode_depth = 25: depth used to decode the base64
+ encoded MIME attachments { -1:65535 }
+ * string smtp.binary_data_cmds: commands that initiate sending of
+ data and use a length value after the command
+ * int smtp.bitenc_decode_depth = 25: depth used to extract the
+ non-encoded MIME attachments { -1:65535 }
+ * string smtp.data_cmds: commands that initiate sending of data
+ with an end of data delimiter
+ * int smtp.email_hdrs_log_depth = 1464: depth for logging email
+ headers { 0:20480 }
+ * bool smtp.ignore_data = false: ignore data section of mail
+ * bool smtp.ignore_tls_data = false: ignore TLS-encrypted data when
+ processing rules
+ * string smtp.invalid_cmds: alert if this command is sent from
+ client side
+ * bool smtp.log_email_hdrs = false: log the SMTP email headers
+ extracted from SMTP data
+ * bool smtp.log_filename = false: log the MIME attachment filenames
+ extracted from the Content-Disposition header within the MIME
+ body
+ * bool smtp.log_mailfrom = false: log the sender’s email address
+ extracted from the MAIL FROM command
+ * bool smtp.log_rcptto = false: log the recipient’s email address
+ extracted from the RCPT TO command
+ * int smtp.max_command_line_len = 0: max Command Line Length {
+ 0:65535 }
+ * int smtp.max_header_line_len = 0: max SMTP DATA header line {
+ 0:65535 }
+ * int smtp.max_response_line_len = 0: max SMTP response line {
+ 0:65535 }
+ * enum smtp.normalize = none: turns on/off normalization { none |
+ cmds | all }
+ * string smtp.normalize_cmds: list of commands to normalize
+ * int smtp.qp_decode_depth = 25: quoted-Printable decoding depth {
+ -1:65535 }
+ * int smtp.uu_decode_depth = 25: unix-to-Unix decoding depth {
+ -1:65535 }
+ * string smtp.valid_cmds: list of valid commands
+ * enum smtp.xlink2state = alert: enable/disable xlink2state alert {
+ disable | alert | drop }
+ * implied snort.--alert-before-pass: process alert, drop, sdrop, or
+ reject before pass; default is pass before alert, drop,…
+ * string snort.--bpf: <filter options> are standard BPF options, as
+ seen in TCPDump
+ * string snort.--c2x: output hex for given char (see also --x2c)
+ * implied snort.--create-pidfile: create PID file, even when not in
+ Daemon mode
+ * string snort.--daq: <type> select packet acquisition module
+ (default is pcap)
+ * string snort.--daq-dir: <dir> tell snort where to find desired
+ DAQ
+ * implied snort.--daq-list: list packet acquisition modules
+ available in optional dir, default is static modules only
+ * string snort.--daq-mode: <mode> select the DAQ operating mode
+ * string snort.--daq-var: <name=value> specify extra DAQ
+ configuration variable
+ * implied snort.--dirty-pig: don’t flush packets on shutdown
+ * implied snort.--dump-builtin-rules: [<module prefix>] output stub
+ rules for selected modules
+ * string snort.--dump-defaults: [<module prefix>] output module
+ defaults in Lua format { (optional) }
+ * implied snort.--dump-dynamic-rules: output stub rules for all
+ loaded rules libraries
+ * string snort.--dump-version: output the version, the whole
+ version, and only the version { (optional) }
+ * implied snort.--enable-inline-test: enable Inline-Test Mode
+ Operation
+ * implied snort.--help: list command line options
+ * string snort.--help-commands: [<module prefix>] output matching
+ commands { (optional) }
+ * string snort.--help-config: [<module prefix>] output matching
+ config options { (optional) }
+ * string snort.--help-counts: [<module prefix>] output matching peg
+ counts { (optional) }
+ * string snort.--help-module: <module> output description of given
+ module
+ * implied snort.--help-modules: list all available modules with
+ brief help
+ * string snort.--help-options: <option prefix> output matching
+ command line option quick help (same as -?) { (optional) }
+ * implied snort.--help-plugins: list all available plugins with
+ brief help
+ * implied snort.--help-signals: dump available control signals
+ * implied snort.--id-subdir: create/use instance subdirectories in
+ logdir instead of instance filename prefix
+ * implied snort.--id-zero: use id prefix / subdirectory even with
+ one packet thread
+ * implied snort.--list-buffers: output available inspection buffers
+ * string snort.--list-builtin: <module prefix> output matching
+ builtin rules { (optional) }
+ * string snort.--list-gids: [<module prefix>] output matching
+ generators { (optional) }
+ * string snort.--list-modules: [<module type>] list all known
+ modules of given type { (optional) }
+ * implied snort.--list-plugins: list all known plugins
+ * int snort.--logid: <0xid> log Identifier to uniquely id events
+ for multiple snorts (same as -G) { 0:65535 }
+ * string snort.--lua: <chunk> extend/override conf with chunk; may
+ be repeated
+ * implied snort.--markup: output help in asciidoc compatible format
+ * int snort.--max-packet-threads = 1: <count> configure maximum
+ number of packet threads (same as -z) { 0: }
+ * implied snort.--nolock-pidfile: do not try to lock Snort PID file
+ * implied snort.--nostamps: don’t include timestamps in log file
+ names
+ * implied snort.--pause: wait for resume/quit command before
+ processing packets/terminating
+ * string snort.--pcap-dir: <dir> a directory to recurse to look for
+ pcaps - read mode is implied
+ * string snort.--pcap-file: <file> file that contains a list of
+ pcaps to read - read mode is implied
+ * string snort.--pcap-filter: <filter> filter to apply when getting
+ pcaps from file or directory
+ * string snort.--pcap-list: <list> a space separated list of pcaps
+ to read - read mode is implied
+ * int snort.--pcap-loop: <count> read all pcaps <count> times; 0
+ will read until Snort is terminated { -1: }
+ * implied snort.--pcap-no-filter: reset to use no filter when
+ getting pcaps from file or directory
+ * implied snort.--pcap-reload: if reading multiple pcaps, reload
+ snort config between pcaps
+ * implied snort.--pcap-show: print a line saying what pcap is
+ currently being read
+ * implied snort.--pedantic: warnings are fatal
+ * string snort.--plugin-path: <path> where to find plugins
+ * implied snort.--process-all-events: process all action groups
+ * string snort.--rule: <rules> to be added to configuration; may be
+ repeated
+ * implied snort.--rule-to-hex: output so rule header to stdout for
+ text rule on stdin
+ * implied snort.--rule-to-text: output plain so rule header to
+ stdout for text rule on stdin
+ * string snort.--run-prefix: <pfx> prepend this to each output file
+ * string snort.--script-path: <path> where to find luajit scripts
+ * implied snort.--shell: enable the interactive command line
+ * implied snort.--show-plugins: list module and plugin versions
+ * int snort.--skip: <n> skip 1st n packets { 0: }
+ * int snort.--snaplen = 1514: <snap> set snaplen of packet (same as
+ -s) { 68:65535 }
+ * implied snort.--stdin-rules: read rules from stdin until EOF or a
+ line starting with END is read
+ * implied snort.--treat-drop-as-alert: converts drop, sdrop, and
+ reject rules into alert rules during startup
+ * implied snort.--treat-drop-as-ignore: use drop, sdrop, and reject
+ rules to ignore session traffic when not inline
+ * implied snort.--version: show version number (same as -V)
+ * implied snort.--warn-all: enable all warnings
+ * implied snort.--warn-conf: warn about configuration issues
+ * implied snort.--warn-daq: warn about DAQ issues, usually related
+ to mode
+ * implied snort.--warn-flowbits: warn about flowbits that are
+ checked but not set and vice-versa
+ * implied snort.--warn-hosts: warn about host table issues
+ * implied snort.--warn-plugins: warn about issues that prevent
+ plugins from loading
+ * implied snort.--warn-rules: warn about duplicate rules and rule
+ parsing issues
+ * implied snort.--warn-scripts: warn about issues discovered while
+ processing Lua scripts
+ * implied snort.--warn-symbols: warn about unknown symbols in your
+ Lua config
+ * implied snort.--warn-vars: warn about variable definition and
+ usage issues
+ * int snort.--x2c: output ASCII char for given hex (see also --c2x)
+ * string snort.-?: <option prefix> output matching command line
+ option quick help (same as --help-options) { (optional) }
+ * string snort.-A: <mode> set alert mode: none, cmg, or alert_*
+ * implied snort.-B: <mask> obfuscated IP addresses in alerts and
+ packet dumps using CIDR mask
+ * implied snort.-C: print out payloads with character data only (no
+ hex)
+ * implied snort.-D: run Snort in background (daemon) mode
+ * implied snort.-E: enable daemon restart
+ * int snort.-G: <0xid> (same as --logid) { 0:65535 }
+ * implied snort.-H: make hash tables deterministic
+ * string snort.-L: <mode> logging mode (none, dump, pcap, or log_*)
+ * implied snort.-M: log messages to syslog (not alerts)
+ * implied snort.-O: obfuscate the logged IP addresses
+ * implied snort.-Q: enable inline mode operation
+ * string snort.-R: <rules> include this rules file in the default
+ policy
+ * string snort.-S: <x=v> set config variable x equal to value v
+ * implied snort.-T: test and report on the current Snort
+ configuration
+ * implied snort.-U: use UTC for timestamps
+ * implied snort.-V: (same as --version)
+ * implied snort.-W: lists available interfaces
+ * implied snort.-X: dump the raw packet data starting at the link
+ layer
+ * string snort.-c: <conf> use this configuration
+ * implied snort.-d: dump the Application Layer
+ * implied snort.-e: display the second layer header info
+ * implied snort.-f: turn off fflush() calls after binary log writes
+ * string snort.-g: <gname> run snort gid as <gname> group (or gid)
+ after initialization
+ * string snort.-i: <iface>… list of interfaces
+ * port snort.-j: <port> to listen for telnet connections
+ * enum snort.-k = all: <mode> checksum mode
+ (all,noip,notcp,noudp,noicmp,none) { all|noip|notcp|noudp|noicmp|
+ none }
+ * string snort.-l: <logdir> log to this directory instead of
+ current directory
+ * int snort.-m: <umask> set umask = <umask> { 0: }
+ * int snort.-n: <count> stop after count packets { 0: }
+ * implied snort.-q: quiet mode - Don’t show banner and status
+ report
+ * string snort.-r: <pcap>… (same as --pcap-list)
+ * int snort.-s = 1514: <snap> (same as --snaplen) { 68:65535 }
+ * string snort.-t: <dir> chroots process to <dir> after
+ initialization
+ * string snort.-u: <uname> run snort as <uname> or <uid> after
+ initialization
+ * implied snort.-v: be verbose
+ * implied snort.-w: dump 802.11 management and control frames
+ * implied snort.-x: same as --pedantic
+ * implied snort.-y: include year in timestamp in the alert and log
+ files
+ * int snort.-z = 1: <count> maximum number of packet threads (same
+ as --max-packet-threads); 0 gets the number of CPU cores reported
+ by the system { 0: }
+ * string so.~func: name of eval function
+ * string soid.~: SO rule ID has <gid>|<sid> format, like 3|12345
+ * int ssh.max_client_bytes = 19600: number of unanswered bytes
+ before alerting on challenge-response overflow or CRC32 { 0:65535
+ }
+ * int ssh.max_encrypted_packets = 25: ignore session after this
+ many encrypted packets { 0:65535 }
+ * int ssh.max_server_version_len = 80: limit before alerting on
+ secure CRT server version string overflow { 0:255 }
+ * int ssl.max_heartbeat_length = 0: maximum length of heartbeat
+ record allowed { 0:65535 }
+ * bool ssl.trust_servers = false: disables requirement that
+ application (encrypted) data must be observed on both sides
+ * implied ssl_state.!client_hello: check for records that are not
+ client hello
+ * implied ssl_state.!client_keyx: check for records that are not
+ client keyx
+ * implied ssl_state.!server_hello: check for records that are not
+ server hello
+ * implied ssl_state.!server_keyx: check for records that are not
+ server keyx
+ * implied ssl_state.!unknown: check for records that are not
+ unknown
+ * implied ssl_state.client_hello: check for client hello
+ * implied ssl_state.client_keyx: check for client keyx
+ * implied ssl_state.server_hello: check for server hello
+ * implied ssl_state.server_keyx: check for server keyx
+ * implied ssl_state.unknown: check for unknown record
+ * implied ssl_version.!sslv2: check for records that are not sslv2
+ * implied ssl_version.!sslv3: check for records that are not sslv3
+ * implied ssl_version.!tls1.0: check for records that are not
+ tls1.0
+ * implied ssl_version.!tls1.1: check for records that are not
+ tls1.1
+ * implied ssl_version.!tls1.2: check for records that are not
+ tls1.2
+ * implied ssl_version.sslv2: check for sslv2
+ * implied ssl_version.sslv3: check for sslv3
+ * implied ssl_version.tls1.0: check for tls1.0
+ * implied ssl_version.tls1.1: check for tls1.1
+ * implied ssl_version.tls1.2: check for tls1.2
+ * int stream.file_cache.idle_timeout = 180: maximum inactive time
+ before retiring session tracker { 1: }
+ * int stream.file_cache.max_sessions = 128: maximum simultaneous
+ sessions tracked before pruning { 1: }
+ * int stream.file_cache.memcap = 0: maximum cache memory before
+ pruning (0 is unlimited) { 0: }
+ * int stream.file_cache.pruning_timeout = 30: minimum inactive time
+ before being eligible for pruning { 1: }
+ * int stream.icmp_cache.idle_timeout = 180: maximum inactive time
+ before retiring session tracker { 1: }
+ * int stream.icmp_cache.max_sessions = 32768: maximum simultaneous
+ sessions tracked before pruning { 1: }
+ * int stream.icmp_cache.memcap = 1048576: maximum cache memory
+ before pruning (0 is unlimited) { 0: }
+ * int stream.icmp_cache.pruning_timeout = 30: minimum inactive time
+ before being eligible for pruning { 1: }
+ * int stream.ip_cache.idle_timeout = 180: maximum inactive time
+ before retiring session tracker { 1: }
+ * int stream.ip_cache.max_sessions = 16384: maximum simultaneous
+ sessions tracked before pruning { 1: }
+ * int stream.ip_cache.memcap = 23920640: maximum cache memory
+ before pruning (0 is unlimited) { 0: }
+ * int stream.ip_cache.pruning_timeout = 30: minimum inactive time
+ before being eligible for pruning { 1: }
+ * int stream.tcp_cache.idle_timeout = 180: maximum inactive time
+ before retiring session tracker { 1: }
+ * int stream.tcp_cache.max_sessions = 131072: maximum simultaneous
+ sessions tracked before pruning { 1: }
+ * int stream.tcp_cache.memcap = 268435456: maximum cache memory
+ before pruning (0 is unlimited) { 0: }
+ * int stream.tcp_cache.pruning_timeout = 30: minimum inactive time
+ before being eligible for pruning { 1: }
+ * int stream.udp_cache.idle_timeout = 180: maximum inactive time
+ before retiring session tracker { 1: }
+ * int stream.udp_cache.max_sessions = 65536: maximum simultaneous
+ sessions tracked before pruning { 1: }
+ * int stream.udp_cache.memcap = 0: maximum cache memory before
+ pruning (0 is unlimited) { 0: }
+ * int stream.udp_cache.pruning_timeout = 30: minimum inactive time
+ before being eligible for pruning { 1: }
+ * int stream.user_cache.idle_timeout = 180: maximum inactive time
+ before retiring session tracker { 1: }
+ * int stream.user_cache.max_sessions = 1024: maximum simultaneous
+ sessions tracked before pruning { 1: }
+ * int stream.user_cache.memcap = 1048576: maximum cache memory
+ before pruning (0 is unlimited) { 0: }
+ * int stream.user_cache.pruning_timeout = 30: minimum inactive time
+ before being eligible for pruning { 1: }
+ * bool stream_file.upload = false: indicate file transfer direction
+ * int stream_icmp.session_timeout = 30: session tracking timeout {
+ 1:86400 }
+ * int stream_ip.max_frags = 8192: maximum number of simultaneous
+ fragments being tracked { 1: }
+ * int stream_ip.max_overlaps = 0: maximum allowed overlaps per
+ datagram; 0 is unlimited { 0: }
+ * int stream_ip.min_frag_length = 0: alert if fragment length is
+ below this limit before or after trimming { 0: }
+ * int stream_ip.min_ttl = 1: discard fragments with ttl below the
+ minimum { 1:255 }
+ * enum stream_ip.policy = linux: fragment reassembly policy { first
+ | linux | bsd | bsd_right | last | windows | solaris }
+ * int stream_ip.session_timeout = 30: session tracking timeout {
+ 1:86400 }
+ * enum stream_reassemble.action: stop or start stream reassembly {
+ disable|enable }
+ * enum stream_reassemble.direction: action applies to the given
+ direction(s) { client|server|both }
+ * implied stream_reassemble.fastpath: optionally whitelist the
+ remainder of the session
+ * implied stream_reassemble.noalert: don’t alert when rule matches
+ * enum stream_size.~direction: compare applies to the given
+ direction(s) { either|to_server|to_client|both }
+ * string stream_size.~range: size for comparison
+ * int stream_tcp.flush_factor = 0: flush upon seeing a drop in
+ segment size after given number of non-decreasing segments { 0: }
+ * int stream_tcp.footprint = 0: use zero for production, non-zero
+ for testing at given size { 0: }
+ * bool stream_tcp.ignore_any_rules = false: process tcp content
+ rules w/o ports only if rules with ports are present
+ * int stream_tcp.max_pdu = 16384: maximum reassembled PDU size {
+ 1460:65535 }
+ * int stream_tcp.max_window = 0: maximum allowed tcp window {
+ 0:1073725440 }
+ * int stream_tcp.overlap_limit = 0: maximum number of allowed
+ overlapping segments per session { 0:255 }
+ * enum stream_tcp.policy = bsd: determines operating system
+ characteristics like reassembly { first | last | linux |
+ old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 |
+ windows | win_2003 | vista | proxy }
+ * int stream_tcp.queue_limit.max_bytes = 1048576: don’t queue more
+ than given bytes per session and direction { 0: }
+ * int stream_tcp.queue_limit.max_segments = 2621: don’t queue more
+ than given segments per session and direction { 0: }
+ * bool stream_tcp.reassemble_async = true: queue data for
+ reassembly before traffic is seen in both directions
+ * int stream_tcp.require_3whs = -1: don’t track midstream sessions
+ after given seconds from start up; -1 tracks all { -1:86400 }
+ * int stream_tcp.session_timeout = 30: session tracking timeout {
+ 1:86400 }
+ * bool stream_tcp.show_rebuilt_packets = false: enable cmg like
+ output of reassembled packets
+ * int stream_tcp.small_segments.count = 0: limit number of small
+ segments queued { 0:2048 }
+ * int stream_tcp.small_segments.maximum_size = 0: limit number of
+ small segments queued { 0:2048 }
+ * bool stream_udp.ignore_any_rules = false: process udp content
+ rules w/o ports only if rules with ports are present
+ * int stream_udp.session_timeout = 30: session tracking timeout {
+ 1:86400 }
+ * int stream_user.session_timeout = 30: session tracking timeout {
+ 1:86400 }
+ * int suppress[].gid = 0: rule generator ID { 0: }
+ * string suppress[].ip: restrict suppression to these addresses
+ according to track
+ * int suppress[].sid = 0: rule signature ID { 0: }
+ * enum suppress[].track: suppress only matching source or
+ destination addresses { by_src | by_dst }
+ * int tag.bytes: tag for this many bytes { 1: }
+ * int tag.packets: tag this many packets { 1: }
+ * int tag.seconds: tag for this many seconds { 1: }
+ * enum tag.~: log all packets in session or all packets to or from
+ host { session|host_src|host_dst }
+ * int telnet.ayt_attack_thresh = -1: alert on this number of
+ consecutive telnet AYT commands { -1: }
+ * bool telnet.check_encrypted = false: check for end of encryption
+ * bool telnet.encrypted_traffic = false: check for encrypted telnet
+ and ftp
+ * bool telnet.normalize = false: eliminate escape sequences
+ * string tos.~range: check if packet payload size is size | min<>
+ max | <max | >min
+ * string ttl.~range: check if packet payload size is size | min<>
+ max | <max | >min
+ * bool udp.deep_teredo_inspection = false: look for Teredo on all
+ UDP ports (default is only 3544)
+ * bool udp.enable_gtp = false: decode GTP encapsulations
+ * bit_list udp.gtp_ports = 2152 3386: set GTP ports { 65535 }
+ * int unified2.limit = 0: set limit (0 is unlimited) { 0: }
+ * bool unified2.mpls_event_types = false: include mpls labels in
+ events
+ * bool unified2.nostamp = true: append file creation time to name
+ (in Unix Epoch format)
+ * enum unified2.units = B: limit multiplier { B | K | M | G }
+ * bool unified2.vlan_event_types = false: include vlan IDs in
+ events
+ * string urg.~range: check if urgent offset is min<>max | <max | >
+ min
+ * string window.~range: check if packet payload size is size | min
+ <>max | <max | >min
+ * bool wizard.hexes[].client_first = true: which end initiates data
+ transfer
+ * select wizard.hexes[].proto = tcp: protocol to scan { tcp | udp }
+ * string wizard.hexes[].service: name of service
+ * string wizard.hexes[].to_client[].hex: sequence of data with wild
+ chars (?)
+ * string wizard.hexes[].to_server[].hex: sequence of data with wild
+ chars (?)
+ * bool wizard.spells[].client_first = true: which end initiates
+ data transfer
+ * select wizard.spells[].proto = tcp: protocol to scan { tcp | udp
+ }
+ * string wizard.spells[].service: name of service
+ * string wizard.spells[].to_client[].spell: sequence of data with
+ wild cards (*)
+ * string wizard.spells[].to_server[].spell: sequence of data with
+ wild cards (*)
- * In many cases, even in C++, use #define name "value" instead of a
- const char* const name = "value" because it will eliminate a
- symbol from the binary.
- * Use inline functions instead of macros where possible (pretty
- much all cases except where stringification is necessary).
- Functions offer better typing, avoid re-expansions, and a
- debugger can break there.
- * All macros except simple const values should be wrapped in () and
- all args should be wrapped in () too to avoid surprises upon
- expansion. Example:
- #define SEQ_LT(a,b) ((int)((a) - (b)) < 0)
+16.10. Counts
- * Multiline macros should be blocked (i.e. inside { }) to avoid
- if-else type surprises.
+------------
-14.17.6.7. Formatting
+ * arp_spoof.packets: total packets
+ * back_orifice.packets: total packets
+ * binder.allows: allow bindings
+ * binder.blocks: block bindings
+ * binder.inspects: inspect bindings
+ * binder.packets: initial bindings
+ * binder.resets: reset bindings
+ * daq.allow: total allow verdicts
+ * daq.analyzed: total packets analyzed from DAQ
+ * daq.blacklist: total blacklist verdicts
+ * daq.block: total block verdicts
+ * daq.dropped: packets dropped
+ * daq.fail open: packets passed during initialization
+ * daq.filtered: packets filtered out
+ * daq.idle: attempts to acquire from DAQ without available packets
+ * daq.ignore: total ignore verdicts
+ * daq.injected: active responses or replacements
+ * daq.internal blacklist: packets blacklisted internally due to
+ lack of DAQ support
+ * daq.internal whitelist: packets whitelisted internally due to
+ lack of DAQ support
+ * daq.outstanding: packets unprocessed
+ * daq.pcaps: total files and interfaces processed
+ * daq.received: total packets received from DAQ
+ * daq.replace: total replace verdicts
+ * daq.skipped: packets skipped at startup
+ * daq.whitelist: total whitelist verdicts
+ * data_log.packets: total packets
+ * detection.alert limit: events previously triggered on same PDU
+ * detection.alerts: alerts not including IP reputation
+ * detection.alt searches: alt fast pattern searches in packet data
+ * detection.analyzed: packets sent to detection
+ * detection.body searches: fast pattern searches in body buffer
+ * detection.cooked searches: fast pattern searches in cooked packet
+ data
+ * detection.event limit: events filtered
+ * detection.file searches: fast pattern searches in file buffer
+ * detection.header searches: fast pattern searches in header buffer
+ * detection.key searches: fast pattern searches in key buffer
+ * detection.log limit: events queued but not logged
+ * detection.logged: logged packets
+ * detection.match limit: fast pattern matches not processed
+ * detection.passed: passed packets
+ * detection.pkt searches: fast pattern searches in packet data
+ * detection.queue limit: events not queued because queue full
+ * detection.raw searches: fast pattern searches in raw packet data
+ * detection.slow searches: non-fast pattern rule evaluations
+ * detection.total alerts: alerts including IP reputation
+ * dns.packets: total packets
+ * dpx.packets: total packets
+ * ftp_data.packets: total packets
+ * ftp_server.packets: total packets
+ * http_global.compressed bytes: total comparessed bytes processed
+ * http_global.decompressed bytes: total bytes decompressed
+ * http_global.double unicode: double unicode normalizations
+ * http_global.gets: GET requests
+ * http_global.gzip packets: packets with gzip compression
+ * http_global.non-ascii: non-ascii normalizations
+ * http_global.packets: total packets processed
+ * http_global.paths with ../: directory traversal normalizations
+ * http_global.paths with ./: relative directory normalizations
+ * http_global.paths with //: double slash normalizations
+ * http_global.post params: POST parameters extracted
+ * http_global.posts: POST requests
+ * http_global.request cookies: requests with Cookie
+ * http_global.request headers: total requests
+ * http_global.response cookies: responses with Set-Cookie
+ * http_global.response headers: total responses
+ * http_global.unicode: unicode normalizations
+ * icmp4.bad checksum: non-zero icmp checksums
+ * icmp6.bad checksum (ip4): nonzero ipcm4 checksums
+ * icmp6.bad checksum (ip6): nonzero ipcm6 checksums
+ * imap.packets: total packets
+ * ipv4.bad checksum: nonzero ip checksums
+ * normalizer.icmp4 echo: icmp4 ping normalizations
+ * normalizer.icmp6 echo: icmp6 echo normalizations
+ * normalizer.ip4 df: don’t frag bit normalizations
+ * normalizer.ip4 opts: ip4 options cleared
+ * normalizer.ip4 rf: reserved flag bit clears
+ * normalizer.ip4 tos: type of service normalizations
+ * normalizer.ip4 trim: eth packets trimmed to datagram size
+ * normalizer.ip4 ttl: time-to-live normalizations
+ * normalizer.ip6 hops: ip6 hop limit normalizations
+ * normalizer.ip6 options: ip6 options cleared
+ * normalizer.tcp block: blocked segments
+ * normalizer.tcp ecn pkt: packets with ECN bits cleared
+ * normalizer.tcp ecn session: ECN bits cleared
+ * normalizer.tcp ips data: normalized segments
+ * normalizer.tcp nonce: packets with nonce bit cleared
+ * normalizer.tcp options: packets with options cleared
+ * normalizer.tcp paddding: packets with padding cleared
+ * normalizer.tcp req pay: cleared urgent pointer and urgent flag
+ when there is no payload
+ * normalizer.tcp req urg: cleared urgent pointer when urgent flag
+ is not set
+ * normalizer.tcp req urp: cleared the urgent flag if the urgent
+ pointer is not set
+ * normalizer.tcp reserved: packets with reserved bits cleared
+ * normalizer.tcp syn options: SYN only options cleared from non-SYN
+ packets
+ * normalizer.tcp trim mss: data trimmed to MSS
+ * normalizer.tcp trim rst: RST packets with data trimmed
+ * normalizer.tcp trim syn: tcp segments trimmed on SYN
+ * normalizer.tcp trim win: data trimed to window
+ * normalizer.tcp ts ecr: timestamp cleared on non-ACKs
+ * normalizer.tcp ts nop: timestamp options cleared
+ * normalizer.tcp urgent ptr: packets without data with urgent
+ pointer cleared
+ * normalizer.test icmp4 echo: During inline mode, would have icmp4
+ ping normalizations
+ * normalizer.test icmp6 echo: During inline mode, would have icmp6
+ echo normalizations
+ * normalizer.test ip4 df: During inline mode, would have don’t frag
+ bit normalizations
+ * normalizer.test ip4 opts: During inline mode, would have ip4
+ options cleared
+ * normalizer.test ip4 rf: During inline mode, would have reserved
+ flag bit clears
+ * normalizer.test ip4 tos: During inline mode, would have type of
+ service normalizations
+ * normalizer.test ip4 trim: During inline mode, would have eth
+ packets trimmed to datagram size
+ * normalizer.test ip4 ttl: During inline mode, would have
+ time-to-live normalizations
+ * normalizer.test ip6 hops: During inline mode, would have ip6 hop
+ limit normalizations
+ * normalizer.test ip6 options: During inline mode, would have ip6
+ options cleared
+ * normalizer.test tcp block: During inline mode, would have blocked
+ segments
+ * normalizer.test tcp ecn pkt: During inline mode, would have
+ packets with ECN bits cleared
+ * normalizer.test tcp ecn session: During inline mode, would have
+ ECN bits cleared
+ * normalizer.test tcp ips data: During inline mode, would have
+ normalized segments
+ * normalizer.test tcp nonce: During inline mode, would have packets
+ with nonce bit cleared
+ * normalizer.test tcp options: During inline mode, would have
+ packets with options cleared
+ * normalizer.test tcp paddding: During inline mode, would have
+ packets with padding cleared
+ * normalizer.test tcp req pay: During inline mode, would have
+ cleared urgent pointer and urgent flag when there is no payload
+ * normalizer.test tcp req urg: During inline mode, would have
+ cleared urgent pointer when urgent flag is not set
+ * normalizer.test tcp req urp: During inline mode, would have
+ cleared the urgent flag if the urgent pointer is not set
+ * normalizer.test tcp reserved: During inline mode, would have
+ packets with reserved bits cleared
+ * normalizer.test tcp syn options: During inline mode, would have
+ SYN only options cleared from non-SYN packets
+ * normalizer.test tcp trim mss: During inline mode, would have data
+ trimmed to MSS
+ * normalizer.test tcp trim rst: During inline mode, would have RST
+ packets with data trimmed
+ * normalizer.test tcp trim syn: During inline mode, would have tcp
+ segments trimmed on SYN
+ * normalizer.test tcp trim win: During inline mode, would have data
+ trimed to window
+ * normalizer.test tcp ts ecr: During inline mode, would have
+ timestamp cleared on non-ACKs
+ * normalizer.test tcp ts nop: During inline mode, would have
+ timestamp options cleared
+ * normalizer.test tcp urgent ptr: During inline mode, would have
+ packets without data with urgent pointer cleared
+ * perf_monitor.packets: total packets
+ * pop.packets: total packets
+ * port_scan_global.packets: total packets
+ * rpc_decode.packets: total packets
+ * sip.dialogs: total dialogs
+ * sip.events: events generated
+ * sip.ignored channels: total channels ignored
+ * sip.ignored sessions: total sessions ignored
+ * sip.requests: total requests
+ * sip.responses: total responses
+ * sip.sessions: total sessions
+ * smtp.packets: total packets
+ * snort.attribute table hosts: total number of hosts in table
+ * snort.attribute table reloads: number of times hosts table was
+ reloaded
+ * snort.conf reloads: number of times configuration was reloaded
+ * snort.local commands: total local commands processed
+ * snort.remote commands: total remote commands processed
+ * snort.signals: total signals processed
+ * ssh.packets: total packets
+ * ssl.packets: total packets
+ * stream.file flows: total file sessions
+ * stream.file prunes: file sessions pruned
+ * stream.icmp flows: total icmp sessions
+ * stream.icmp prunes: icmp sessions pruned
+ * stream.ip flows: total ip sessions
+ * stream.ip prunes: ip sessions pruned
+ * stream.tcp flows: total tcp sessions
+ * stream.tcp prunes: tcp sessions pruned
+ * stream.udp flows: total udp sessions
+ * stream.udp prunes: udp sessions pruned
+ * stream.user flows: total user sessions
+ * stream.user prunes: user sessions pruned
+ * stream_icmp.created: icmp session trackers created
+ * stream_icmp.released: icmp session trackers released
+ * stream_ip.alerts: alerts generated
+ * stream_ip.anomalies: anomalies detected
+ * stream_ip.discards: fragments discarded
+ * stream_ip.drops: fragments dropped
+ * stream_ip.frag timeouts: datagrams abandoned
+ * stream_ip.fragments: total fragments
+ * stream_ip.memory faults: memory faults
+ * stream_ip.nodes deleted: fragments deleted from tracker
+ * stream_ip.nodes inserted: fragments added to tracker
+ * stream_ip.overlaps: overlapping fragments
+ * stream_ip.reassembled: reassembled datagrams
+ * stream_ip.trackers added: datagram trackers created
+ * stream_ip.trackers freed: datagram trackers released
+ * stream_tcp.3way trackers: tcp session tracking started on ack
+ * stream_tcp.client cleanups: number of times data from server was
+ flushed when session released
+ * stream_tcp.data trackers: tcp session tracking started on data
+ * stream_tcp.discards: tcp packets discarded
+ * stream_tcp.events: events generated
+ * stream_tcp.gaps: missing data between PDUs
+ * stream_tcp.ignored: tcp packets ignored
+ * stream_tcp.internal events: 135:X events generated
+ * stream_tcp.max bytes: number of times the maximum queued byte
+ limit was reached
+ * stream_tcp.max segs: number of times the maximum queued segment
+ limit was reached
+ * stream_tcp.overlaps: overlapping segments queued
+ * stream_tcp.rebuilt buffers: rebuilt PDU sections
+ * stream_tcp.rebuilt packets: total reassembled PDUs
+ * stream_tcp.resyns: SYN received on established session
+ * stream_tcp.segs queued: total segments queued
+ * stream_tcp.segs released: total segments released
+ * stream_tcp.segs split: tcp segments split when reassembling PDUs
+ * stream_tcp.segs used: queued tcp segments applied to reassembled
+ PDUs
+ * stream_tcp.server cleanups: number of times data from client was
+ flushed when session released
+ * stream_tcp.sessions: total sessions
+ * stream_tcp.syn trackers: tcp session tracking started on syn
+ * stream_tcp.syn-ack trackers: tcp session tracking started on
+ syn-ack
+ * stream_tcp.timeouts: sessions timed out
+ * stream_tcp.trackers created: tcp session trackers created
+ * stream_tcp.trackers released: tcp session trackers released
+ * stream_tcp.untracked: tcp packets not tracked
+ * stream_udp.created: udp session trackers created
+ * stream_udp.released: udp session trackers released
+ * stream_udp.sessions: total udp sessions
+ * stream_udp.timeouts: udp session timeouts
+ * tcp.bad checksum (ip4): nonzero tcp over ip checksums
+ * tcp.bad checksum (ip6): nonzero tcp over ipv6 checksums
+ * telnet.packets: total packets
+ * udp.bad checksum (ip4): nonzero udp over ipv4 checksums
+ * udp.bad checksum (ip6): nonzero udp over ipv6 checksums
+ * wizard.tcp hits: tcp identifications
+ * wizard.tcp scans: tcp payload scans
+ * wizard.udp hits: udp identifications
+ * wizard.udp scans: udp payload scans
+ * wizard.user hits: user identifications
+ * wizard.user scans: user payload scans
- * Indent 4 space chars … no tabs!
- * If you need to indent many times, something could be rewritten or
- restructured to make it clearer. Fewer indents is generally
- easier to write, easier to read, and overall better code.
- * Braces go on the line immediately following a new scope (function
- signature, if, else, loop, switch, etc.
- * Use consistent spacing and line breaks. Always indent 4 spaces
- from the breaking line. Keep lines less than 100 chars; it
- greatly helps readability.
- No:
- calling_a_func_with_a_long_name(arg1,
- arg2,
- arg3);
+16.11. Generators
- Yes:
- calling_a_func_with_a_long_name(
- arg1, arg2, arg3);
+------------
- * Put function signature on one line, except when breaking for the
- arg list:
+ * 105: back_orifice
+ * 106: rpc_decode
+ * 112: arp_spoof
+ * 116: arp
+ * 116: auth
+ * 116: decode
+ * 116: eapol
+ * 116: erspan2
+ * 116: erspan3
+ * 116: esp
+ * 116: eth
+ * 116: fabricpath
+ * 116: gre
+ * 116: gtp
+ * 116: icmp4
+ * 116: icmp6
+ * 116: igmp
+ * 116: ipv4
+ * 116: ipv6
+ * 116: mpls
+ * 116: pgm
+ * 116: pppoe
+ * 116: tcp
+ * 116: token_ring
+ * 116: udp
+ * 116: vlan
+ * 116: wlan
+ * 119: http_global
+ * 120: http_inspect
+ * 122: port_scan
+ * 123: stream_ip
+ * 124: smtp
+ * 125: ftp_server
+ * 126: telnet
+ * 128: ssh
+ * 129: stream_tcp
+ * 131: dns
+ * 134: ppm
+ * 137: ssl
+ * 140: sip
+ * 141: imap
+ * 142: pop
+ * 219: new_http_inspect
+ * 256: dpx
- No:
- inline
- bool foo()
- { // ...
- Yes:
- inline bool foo()
- { // ...
+16.12. Builtin Rules
- * Put conditional code on the line following the if so it is easy
- to break on the conditional block:
+------------
- No:
- if ( test ) foo();
+ * 105:1 (back_orifice) BO traffic detected
+ * 105:2 (back_orifice) BO client traffic detected
+ * 105:3 (back_orifice) BO server traffic detected
+ * 105:4 (back_orifice) BO Snort buffer attack
+ * 106:1 (rpc_decode) fragmented RPC records
+ * 106:2 (rpc_decode) multiple RPC records
+ * 106:3 (rpc_decode) large RPC record fragment
+ * 106:4 (rpc_decode) incomplete RPC segment
+ * 106:5 (rpc_decode) zero-length RPC fragment
+ * 112:1 (arp_spoof) unicast ARP request
+ * 112:2 (arp_spoof) ethernet/ARP mismatch request for source
+ * 112:3 (arp_spoof) ethernet/ARP mismatch request for destination
+ * 112:4 (arp_spoof) attempted ARP cache overwrite attack
+ * 116:1 (ipv4) Not IPv4 datagram
+ * 116:2 (ipv4) hlen < minimum
+ * 116:3 (ipv4) IP dgm len < IP Hdr len
+ * 116:4 (ipv4) Ipv4 Options found with bad lengths
+ * 116:5 (ipv4) Truncated Ipv4 Options
+ * 116:6 (ipv4) IP dgm len > captured len
+ * 116:45 (tcp) TCP packet len is smaller than 20 bytes
+ * 116:46 (tcp) TCP data offset is less than 5
+ * 116:47 (tcp) TCP header length exceeds packet length
+ * 116:54 (tcp) TCP options found with bad lengths
+ * 116:55 (tcp) truncated TCP options
+ * 116:56 (tcp) T/TCP detected
+ * 116:57 (tcp) obsolete TCP options found
+ * 116:58 (tcp) experimental TCP options found
+ * 116:59 (tcp) TCP window scale option found with length > 14
+ * 116:95 (udp) truncated UDP header
+ * 116:96 (udp) invalid UDP header, length field < 8
+ * 116:97 (udp) short UDP packet, length field > payload length
+ * 116:98 (udp) long UDP packet, length field < payload length
+ * 116:105 (icmp4) ICMP header truncated
+ * 116:106 (icmp4) ICMP timestamp header truncated
+ * 116:107 (icmp4) ICMP address header truncated
+ * 116:109 (arp) truncated ARP
+ * 116:110 (eapol) truncated EAP header
+ * 116:111 (eapol) EAP key truncated
+ * 116:112 (eapol) EAP header truncated
+ * 116:120 (pppoe) bad PPPOE frame detected
+ * 116:130 (vlan) bad VLAN frame
+ * 116:131 (vlan) bad LLC header
+ * 116:132 (vlan) bad extra LLC info
+ * 116:133 (wlan) bad 802.11 LLC header
+ * 116:134 (wlan) bad 802.11 extra LLC info
+ * 116:140 (token_ring) (token_ring) Bad Token Ring Header
+ * 116:141 (token_ring) (token_ring) Bad Token Ring ETHLLC Header
+ * 116:142 (token_ring) (token_ring) Bad Token Ring MRLENHeader
+ * 116:143 (token_ring) (token_ring) Bad Token Ring MR Header
+ * 116:150 (decode) bad traffic loopback IP
+ * 116:151 (decode) bad traffic same src/dst IP
+ * 116:160 (gre) GRE header length > payload length
+ * 116:161 (gre) multiple encapsulations in packet
+ * 116:162 (gre) invalid GRE version
+ * 116:163 (gre) invalid GRE header
+ * 116:164 (gre) invalid GRE v.1 PPTP header
+ * 116:165 (gre) GRE trans header length > payload length
+ * 116:170 (mpls) bad MPLS frame
+ * 116:171 (mpls) MPLS label 0 appears in non-bottom header
+ * 116:172 (mpls) MPLS label 1 appears in bottom header
+ * 116:173 (mpls) MPLS label 2 appears in non-bottom header
+ * 116:174 (mpls) MPLS label 3 appears in header
+ * 116:175 (mpls) MPLS label 4, 5,.. or 15 appears in header
+ * 116:176 (mpls) too many MPLS headers
+ * 116:250 (icmp4) ICMP original IP header truncated
+ * 116:251 (icmp4) ICMP version and original IP header versions
+ differ
+ * 116:252 (icmp4) ICMP original datagram length < original IP
+ header length
+ * 116:253 (icmp4) ICMP original IP payload < 64 bits
+ * 116:254 (icmp4) ICMP original IP payload > 576 bytes
+ * 116:255 (icmp4) ICMP original IP fragmented and offset not 0
+ * 116:270 (ipv6) IPv6 packet below TTL limit
+ * 116:271 (ipv6) IPv6 header claims to not be IPv6
+ * 116:272 (ipv6) IPV6 truncated extension header
+ * 116:273 (ipv6) IPV6 truncated header
+ * 116:274 (ipv6) IP dgm len < IP Hdr len
+ * 116:275 (ipv6) IP dgm len > captured len
+ * 116:276 (ipv6) IPv6 packet with destination address ::0
+ * 116:277 (ipv6) IPv6 packet with multicast source address
+ * 116:278 (ipv6) IPv6 packet with reserved multicast destination
+ address
+ * 116:279 (ipv6) IPv6 header includes an undefined option type
+ * 116:280 (ipv6) IPv6 address includes an unassigned multicast
+ scope value
+ * 116:281 (ipv6) IPv6 header includes an invalid value for the next
+ header field
+ * 116:282 (ipv6) IPv6 header includes a routing extension header
+ followed by a hop-by-hop header
+ * 116:283 (ipv6) IPv6 header includes two routing extension headers
+ * 116:285 (icmp6) ICMPv6 packet of type 2 (message too big) with
+ MTU field < 1280
+ * 116:286 (icmp6) ICMPv6 packet of type 1 (destination unreachable)
+ with non-RFC 2463 code
+ * 116:287 (icmp6) ICMPv6 router solicitation packet with a code not
+ equal to 0
+ * 116:288 (icmp6) ICMPv6 router advertisement packet with a code
+ not equal to 0
+ * 116:289 (icmp6) ICMPv6 router solicitation packet with the
+ reserved field not equal to 0
+ * 116:290 (icmp6) ICMPv6 router advertisement packet with the
+ reachable time field set > 1 hour
+ * 116:291 (ipv6) IPV6 tunneled over IPv4, IPv6 header truncated,
+ possible Linux kernel attack
+ * 116:292 (ipv6) IPv6 header has destination options followed by a
+ routing header
+ * 116:293 (decode) two or more IP (v4 and/or v6) encapsulation
+ layers present
+ * 116:294 (esp) truncated encapsulated security payload header
+ * 116:295 (ipv6) IPv6 header includes an option which is too big
+ for the containing header
+ * 116:296 (ipv6) IPv6 packet includes out-of-order extension
+ headers
+ * 116:297 (gtp) two or more GTP encapsulation layers present
+ * 116:298 (gtp) GTP header length is invalid
+ * 116:400 (tcp) XMAS attack detected
+ * 116:401 (tcp) Nmap XMAS attack detected
+ * 116:402 (tcp) DOS NAPTHA vulnerability detected
+ * 116:403 (tcp) bad traffic SYN to multicast address
+ * 116:404 (ipv4) IPV4 packet with zero TTL
+ * 116:405 (ipv4) IPV4 packet with bad frag bits (both MF and DF
+ set)
+ * 116:406 (udp) invalid IPv6 UDP packet, checksum zero
+ * 116:407 (ipv4) IPV4 packet frag offset + length exceed maximum
+ * 116:408 (ipv4) IPV4 packet from current net source address
+ * 116:409 (ipv4) IPV4 packet to current net dest address
+ * 116:410 (ipv4) IPV4 packet from multicast source address
+ * 116:411 (ipv4) IPV4 packet from reserved source address
+ * 116:412 (ipv4) IPV4 packet to reserved dest address
+ * 116:413 (ipv4) IPV4 packet from broadcast source address
+ * 116:414 (ipv4) IPV4 packet to broadcast dest address
+ * 116:415 (icmp4) ICMP4 packet to multicast dest address
+ * 116:416 (icmp4) ICMP4 packet to broadcast dest address
+ * 116:418 (icmp4) ICMP4 type other
+ * 116:419 (tcp) TCP urgent pointer exceeds payload length or no
+ payload
+ * 116:420 (tcp) TCP SYN with FIN
+ * 116:421 (tcp) TCP SYN with RST
+ * 116:422 (tcp) TCP PDU missing ack for established session
+ * 116:423 (tcp) TCP has no SYN, ACK, or RST
+ * 116:424 (eth) truncated eth header
+ * 116:425 (ipv4) truncated IP4 header
+ * 116:426 (icmp4) truncated ICMP4 header
+ * 116:427 (icmp6) truncated ICMP6 header
+ * 116:428 (ipv4) IPV4 packet below TTL limit
+ * 116:429 (ipv6) IPV6 packet has zero hop limit
+ * 116:430 (ipv4) IPV4 packet both DF and offset set
+ * 116:431 (icmp6) ICMP6 type not decoded
+ * 116:432 (icmp6) ICMP6 packet to multicast address
+ * 116:433 (tcp) DDOS shaft SYN flood
+ * 116:434 (icmp4) ICMP ping NMAP
+ * 116:435 (icmp4) ICMP icmpenum v1.1.1
+ * 116:436 (icmp4) ICMP redirect host
+ * 116:437 (icmp4) ICMP redirect net
+ * 116:438 (icmp4) ICMP traceroute ipopts
+ * 116:439 (icmp4) ICMP source quench
+ * 116:440 (icmp4) broadscan smurf scanner
+ * 116:441 (icmp4) ICMP destination unreachable communication
+ administratively prohibited
+ * 116:442 (icmp4) ICMP destination unreachable communication with
+ destination host is administratively prohibited
+ * 116:443 (icmp4) ICMP destination unreachable communication with
+ destination network is administratively prohibited
+ * 116:444 (ipv4) MISC IP option set
+ * 116:445 (udp) misc large UDP Packet
+ * 116:446 (tcp) BAD-TRAFFIC TCP port 0 traffic
+ * 116:447 (udp) BAD-TRAFFIC UDP port 0 traffic
+ * 116:448 (ipv4) BAD-TRAFFIC IP reserved bit set
+ * 116:449 (decode) BAD-TRAFFIC unassigned/reserved IP protocol
+ * 116:450 (decode) BAD-TRAFFIC bad IP protocol
+ * 116:451 (icmp4) ICMP path MTU denial of service attempt
+ * 116:452 (icmp4) BAD-TRAFFIC Linux ICMP header DOS attempt
+ * 116:453 (ipv6) BAD-TRAFFIC ISATAP-addressed IPv6 traffic spoofing
+ attempt
+ * 116:454 (pgm) BAD-TRAFFIC PGM nak list overflow attempt
+ * 116:455 (igmp) DOS IGMP IP options validation attempt
+ * 116:456 (ipv6) too many IP6 extension headers
+ * 116:457 (icmp6) ICMPv6 packet of type 1 (destination unreachable)
+ with non-RFC 4443 code
+ * 116:458 (ipv6) bogus fragmentation packet, possible BSD attack
+ * 116:459 (decode) fragment with zero length
+ * 116:460 (icmp6) ICMPv6 node info query/response packet with a
+ code greater than 2
+ * 116:461 (ipv6) IPV6 routing type 0 extension header
+ * 116:462 (erspan2) ERSpan header version mismatch
+ * 116:463 (erspan2) captured < ERSpan type2 header length
+ * 116:464 (erspan3) captured < ERSpan type3 header length
+ * 116:465 (auth) truncated authentication header
+ * 116:466 (auth) bad authentication header length
+ * 116:467 (fabricpath) truncated FabricPath header
+ * 116:468 (decode) too many protocols present
+ * 119:1 (http_global) ascii encoding
+ * 119:2 (http_global) double decoding attack
+ * 119:3 (http_global) u encoding
+ * 119:4 (http_global) bare byte unicode encoding
+ * 119:5 (http_global) base36 encoding
+ * 119:6 (http_global) UTF-8 encoding
+ * 119:7 (http_global) IIS unicode codepoint encoding
+ * 119:8 (http_global) multi_slash encoding
+ * 119:9 (http_global) IIS backslash evasion
+ * 119:10 (http_global) self directory traversal
+ * 119:11 (http_global) directory traversal
+ * 119:12 (http_global) apache whitespace (tab)
+ * 119:13 (http_global) non-RFC http delimiter
+ * 119:14 (http_global) non-RFC defined char
+ * 119:15 (http_global) oversize request-URI directory
+ * 119:16 (http_global) oversize chunk encoding
+ * 119:17 (http_global) unauthorized proxy use detected
+ * 119:18 (http_global) webroot directory traversal
+ * 119:19 (http_global) long header
+ * 119:20 (http_global) max header fields
+ * 119:21 (http_global) multiple content length
+ * 119:22 (http_global) chunk size mismatch detected
+ * 119:23 (http_global) invalid ip in true-client-IP/XFF header
+ * 119:24 (http_global) multiple host hdrs detected
+ * 119:25 (http_global) hostname exceeds 255 characters
+ * 119:26 (http_global) header parsing space saturation
+ * 119:27 (http_global) client consecutive small chunk sizes
+ * 119:28 (http_global) post w/o content-length or chunks
+ * 119:29 (http_global) multiple true IPs in a session
+ * 119:30 (http_global) both true-client-IP and XFF hdrs present
+ * 119:31 (http_global) unknown method
+ * 119:32 (http_global) simple request
+ * 119:33 (http_global) unescaped space in http URI
+ * 119:34 (http_global) too many pipelined requests
+ * 120:1 (http_inspect) anomalous http server on undefined HTTP port
+ * 120:2 (http_inspect) invalid status code in HTTP response
+ * 120:3 (http_inspect) no content-length or transfer-encoding in
+ HTTP response
+ * 120:4 (http_inspect) HTTP response has UTF charset which failed
+ to normalize
+ * 120:5 (http_inspect) HTTP response has UTF-7 charset
+ * 120:6 (http_inspect) HTTP response gzip decompression failed
+ * 120:7 (http_inspect) server consecutive small chunk sizes
+ * 120:8 (http_inspect) invalid content-length or chunk size
+ * 120:9 (http_inspect) javascript obfuscation levels exceeds 1
+ * 120:10 (http_inspect) javascript whitespaces exceeds max allowed
+ * 120:11 (http_inspect) multiple encodings within javascript
+ obfuscated data
+ * 120:12 (http_inspect) HTTP response SWF file zlib decompression
+ failure
+ * 120:13 (http_inspect) HTTP response SWF file LZMA decompression
+ failure
+ * 120:14 (http_inspect) HTTP response PDF file deflate
+ decompression failure
+ * 120:15 (http_inspect) HTTP response PDF file unsupported
+ compression type
+ * 120:16 (http_inspect) HTTP response PDF file cascaded compression
+ * 120:17 (http_inspect) HTTP response PDF file parse failure
+ * 122:1 (port_scan) TCP portscan
+ * 122:2 (port_scan) TCP decoy portscan
+ * 122:3 (port_scan) TCP portsweep
+ * 122:4 (port_scan) TCP distributed portscan
+ * 122:5 (port_scan) TCP filtered portscan
+ * 122:6 (port_scan) TCP filtered decoy portscan
+ * 122:7 (port_scan) TCP filtered portsweep
+ * 122:8 (port_scan) TCP filtered distributed portscan
+ * 122:9 (port_scan) IP protocol scan
+ * 122:10 (port_scan) IP decoy protocol scan
+ * 122:11 (port_scan) IP protocol sweep
+ * 122:12 (port_scan) IP distributed protocol scan
+ * 122:13 (port_scan) IP filtered protocol scan
+ * 122:14 (port_scan) IP filtered decoy protocol scan
+ * 122:15 (port_scan) IP filtered protocol sweep
+ * 122:16 (port_scan) IP filtered distributed protocol scan
+ * 122:17 (port_scan) UDP portscan
+ * 122:18 (port_scan) UDP decoy portscan
+ * 122:19 (port_scan) UDP portsweep
+ * 122:20 (port_scan) UDP distributed portscan
+ * 122:21 (port_scan) UDP filtered portscan
+ * 122:22 (port_scan) UDP filtered decoy portscan
+ * 122:23 (port_scan) UDP filtered portsweep
+ * 122:24 (port_scan) UDP filtered distributed portscan
+ * 122:25 (port_scan) ICMP sweep
+ * 122:26 (port_scan) ICMP filtered sweep
+ * 122:27 (port_scan) open port
+ * 123:1 (stream_ip) inconsistent IP options on fragmented packets
+ * 123:2 (stream_ip) teardrop attack
+ * 123:3 (stream_ip) short fragment, possible DOS attempt
+ * 123:4 (stream_ip) fragment packet ends after defragmented packet
+ * 123:5 (stream_ip) zero-byte fragment packet
+ * 123:6 (stream_ip) bad fragment size, packet size is negative
+ * 123:7 (stream_ip) bad fragment size, packet size is greater than
+ 65536
+ * 123:8 (stream_ip) fragmentation overlap
+ * 123:11 (stream_ip) TTL value less than configured minimum, not
+ using for reassembly
+ * 123:12 (stream_ip) excessive fragment overlap
+ * 123:13 (stream_ip) tiny fragment
+ * 124:1 (smtp) Attempted command buffer overflow
+ * 124:2 (smtp) Attempted data header buffer overflow
+ * 124:3 (smtp) Attempted response buffer overflow
+ * 124:4 (smtp) Attempted specific command buffer overflow
+ * 124:5 (smtp) Unknown command
+ * 124:6 (smtp) Illegal command
+ * 124:7 (smtp) Attempted header name buffer overflow
+ * 124:8 (smtp) Attempted X-Link2State command buffer overflow
+ * 124:10 (smtp) Base64 Decoding failed.
+ * 124:11 (smtp) Quoted-Printable Decoding failed.
+ * 124:13 (smtp) Unix-to-Unix Decoding failed.
+ * 124:14 (smtp) Cyrus SASL authentication attack.
+ * 125:1 (ftp_server) TELNET cmd on FTP command channel
+ * 125:2 (ftp_server) invalid FTP command
+ * 125:3 (ftp_server) FTP command parameters were too long
+ * 125:4 (ftp_server) FTP command parameters were malformed
+ * 125:5 (ftp_server) FTP command parameters contained potential
+ string format
+ * 125:6 (ftp_server) FTP response message was too long
+ * 125:7 (ftp_server) FTP traffic encrypted
+ * 125:8 (ftp_server) FTP bounce attempt
+ * 125:9 (ftp_server) evasive (incomplete) TELNET cmd on FTP command
+ channel
+ * 126:1 (telnet) consecutive telnet AYT commands beyond threshold
+ * 126:2 (telnet) telnet traffic encrypted
+ * 126:3 (telnet) telnet subnegotiation begin command without
+ subnegotiation end
+ * 128:1 (ssh) Challenge-Response Overflow exploit
+ * 128:2 (ssh) SSH1 CRC32 exploit
+ * 128:3 (ssh) Server version string overflow
+ * 128:5 (ssh) Bad message direction
+ * 128:6 (ssh) Payload size incorrect for the given payload
+ * 128:7 (ssh) Failed to detect SSH version string
+ * 129:1 (stream_tcp) SYN on established session
+ * 129:2 (stream_tcp) data on SYN packet
+ * 129:3 (stream_tcp) data sent on stream not accepting data
+ * 129:4 (stream_tcp) TCP timestamp is outside of PAWS window
+ * 129:5 (stream_tcp) bad segment, adjusted size ⇐ 0
+ * 129:6 (stream_tcp) window size (after scaling) larger than policy
+ allows
+ * 129:7 (stream_tcp) limit on number of overlapping TCP packets
+ reached
+ * 129:8 (stream_tcp) data sent on stream after TCP Reset sent
+ * 129:9 (stream_tcp) TCP client possibly hijacked, different
+ ethernet address
+ * 129:10 (stream_tcp) TCP Server possibly hijacked, different
+ ethernet address
+ * 129:11 (stream_tcp) TCP data with no TCP flags set
+ * 129:12 (stream_tcp) consecutive TCP small segments exceeding
+ threshold
+ * 129:13 (stream_tcp) 4-way handshake detected
+ * 129:14 (stream_tcp) TCP timestamp is missing
+ * 129:15 (stream_tcp) reset outside window
+ * 129:16 (stream_tcp) FIN number is greater than prior FIN
+ * 129:17 (stream_tcp) ACK number is greater than prior FIN
+ * 129:18 (stream_tcp) data sent on stream after TCP Reset received
+ * 129:19 (stream_tcp) TCP window closed before receiving data
+ * 129:20 (stream_tcp) TCP session without 3-way handshake
+ * 131:1 (dns) Obsolete DNS RR Types
+ * 131:2 (dns) Experimental DNS RR Types
+ * 131:3 (dns) DNS Client rdata txt Overflow
+ * 134:1 (ppm) rule options disabled by rule latency
+ * 134:2 (ppm) rule options re-enabled by rule latency
+ * 134:3 (ppm) packet aborted due to latency
+ * 137:1 (ssl) Invalid Client HELLO after Server HELLO Detected
+ * 137:2 (ssl) Invalid Server HELLO without Client HELLO Detected
+ * 137:3 (ssl) Heartbeat Read Overrun Attempt Detected
+ * 137:4 (ssl) Large Heartbeat Response Detected
+ * 140:1 (sip) Maximum sessions reached
+ * 140:2 (sip) Empty request URI
+ * 140:3 (sip) URI is too long
+ * 140:4 (sip) Empty call-Id
+ * 140:5 (sip) Call-Id is too long
+ * 140:6 (sip) CSeq number is too large or negative
+ * 140:7 (sip) Request name in CSeq is too long
+ * 140:8 (sip) Empty From header
+ * 140:9 (sip) From header is too long
+ * 140:10 (sip) Empty To header
+ * 140:11 (sip) To header is too long
+ * 140:12 (sip) Empty Via header
+ * 140:13 (sip) Via header is too long
+ * 140:14 (sip) Empty Contact
+ * 140:15 (sip) Contact is too long
+ * 140:16 (sip) Content length is too large or negative
+ * 140:17 (sip) Multiple SIP messages in a packet
+ * 140:18 (sip) Content length mismatch
+ * 140:19 (sip) Request name is invalid
+ * 140:20 (sip) Invite replay attack
+ * 140:21 (sip) Illegal session information modification
+ * 140:22 (sip) Response status code is not a 3 digit number
+ * 140:23 (sip) Empty Content-type header
+ * 140:24 (sip) SIP version is invalid
+ * 140:25 (sip) Mismatch in METHOD of request and the CSEQ header
+ * 140:26 (sip) Method is unknown
+ * 140:27 (sip) Maximum dialogs within a session reached
+ * 141:1 (imap) Unknown IMAP3 command
+ * 141:2 (imap) Unknown IMAP3 response
+ * 141:4 (imap) Base64 Decoding failed.
+ * 141:5 (imap) Quoted-Printable Decoding failed.
+ * 141:7 (imap) Unix-to-Unix Decoding failed.
+ * 142:1 (pop) Unknown POP3 command
+ * 142:2 (pop) Unknown POP3 response
+ * 142:4 (pop) Base64 Decoding failed.
+ * 142:5 (pop) Quoted-Printable Decoding failed.
+ * 142:7 (pop) Unix-to-Unix Decoding failed.
+ * 219:1 (new_http_inspect) ascii encoding
+ * 219:2 (new_http_inspect) double decoding attack
+ * 219:3 (new_http_inspect) u encoding
+ * 219:4 (new_http_inspect) bare byte unicode encoding
+ * 219:5 (new_http_inspect) obsolete event—should not appear
+ * 219:6 (new_http_inspect) UTF-8 encoding
+ * 219:7 (new_http_inspect) IIS unicode codepoint encoding
+ * 219:8 (new_http_inspect) multi_slash encoding
+ * 219:9 (new_http_inspect) IIS backslash evasion
+ * 219:10 (new_http_inspect) self directory traversal
+ * 219:11 (new_http_inspect) directory traversal
+ * 219:12 (new_http_inspect) apache whitespace (tab)
+ * 219:13 (new_http_inspect) non-RFC http delimiter
+ * 219:14 (new_http_inspect) non-RFC defined char
+ * 219:15 (new_http_inspect) oversize request-uri directory
+ * 219:16 (new_http_inspect) oversize chunk encoding
+ * 219:17 (new_http_inspect) unauthorized proxy use detected
+ * 219:18 (new_http_inspect) webroot directory traversal
+ * 219:19 (new_http_inspect) long header
+ * 219:20 (new_http_inspect) max header fields
+ * 219:21 (new_http_inspect) multiple content length
+ * 219:22 (new_http_inspect) chunk size mismatch detected
+ * 219:23 (new_http_inspect) invalid IP in true-client-IP/XFF header
+ * 219:24 (new_http_inspect) multiple host hdrs detected
+ * 219:25 (new_http_inspect) hostname exceeds 255 characters
+ * 219:26 (new_http_inspect) header parsing space saturation
+ * 219:27 (new_http_inspect) client consecutive small chunk sizes
+ * 219:28 (new_http_inspect) post w/o content-length or chunks
+ * 219:29 (new_http_inspect) multiple true ips in a session
+ * 219:30 (new_http_inspect) both true-client-IP and XFF hdrs
+ present
+ * 219:31 (new_http_inspect) unknown method
+ * 219:32 (new_http_inspect) simple request
+ * 219:33 (new_http_inspect) unescaped space in HTTP URI
+ * 219:34 (new_http_inspect) too many pipelined requests
+ * 219:35 (new_http_inspect) anomalous http server on undefined HTTP
+ port
+ * 219:36 (new_http_inspect) invalid status code in HTTP response
+ * 219:37 (new_http_inspect) no content-length or transfer-encoding
+ in HTTP response
+ * 219:38 (new_http_inspect) HTTP response has UTF charset which
+ failed to normalize
+ * 219:39 (new_http_inspect) HTTP response has UTF-7 charset
+ * 219:40 (new_http_inspect) HTTP response gzip decompression failed
+ * 219:41 (new_http_inspect) server consecutive small chunk sizes
+ * 219:42 (new_http_inspect) invalid content-length or chunk size
+ * 219:43 (new_http_inspect) javascript obfuscation levels exceeds 1
+ * 219:44 (new_http_inspect) javascript whitespaces exceeds max
+ allowed
+ * 219:45 (new_http_inspect) multiple encodings within javascript
+ obfuscated data
+ * 219:46 (new_http_inspect) SWF file zlib decompression failure
+ * 219:47 (new_http_inspect) SWF file LZMA decompression failure
+ * 219:48 (new_http_inspect) PDF file deflate decompression failure
+ * 219:49 (new_http_inspect) PDF file unsupported compression type
+ * 219:50 (new_http_inspect) PDF file cascaded compression
+ * 219:51 (new_http_inspect) PDF file parse failure
+ * 219:52 (new_http_inspect) HTTP misformatted or not really HTTP
+ * 219:53 (new_http_inspect) Chunk length has excessive leading
+ zeros
+ * 219:54 (new_http_inspect) White space before or between messages
+ * 219:55 (new_http_inspect) Request message without URI
+ * 219:56 (new_http_inspect) Control character in reason phrase
+ * 219:57 (new_http_inspect) Illegal extra whitespace in start line
+ * 219:58 (new_http_inspect) Corrupted HTTP version
+ * 219:59 (new_http_inspect) Unknown HTTP version
+ * 219:60 (new_http_inspect) Format error in HTTP header
+ * 219:61 (new_http_inspect) Chunk header options present
+ * 219:62 (new_http_inspect) URI badly formatted
+ * 219:63 (new_http_inspect) URI bad port number
+ * 219:64 (new_http_inspect) HTTP chunk misformatted
+ * 219:65 (new_http_inspect) White space following chunk length
+ * 256:1 (dpx) too much data sent to port
- Yes:
- if ( test )
- foo();
-14.17.6.8. Headers
+16.13. Command Set
- * Don’t hesitate to create a new header if it is needed. Don’t lump
- unrelated stuff into an header because it is convenient.
- * Write header guards like this (leading underscores are reserved
- for system stuff). In my_header.h:
+------------
- #ifndef MY_HEADER_H
- #define MY_HEADER_H
- // ...
- #endif
+ * snort.detach(): exit shell w/o shutdown
+ * snort.dump_stats(): show summary statistics
+ * snort.help(): this output
+ * snort.pause(): suspend packet processing
+ * snort.quit(): shutdown and dump-stats
+ * snort.reload_config(): load new configuration
+ * snort.resume(): continue packet processing
+ * snort.rotate_stats(): roll perfmonitor log files
+ * snort.show_plugins(): show available plugins
- * Includes from a different directory should specify parent
- directory. This makes it clear exactly what is included and
- avoids the primordial soup that results from using -I this -I
- that -I the_other_thing … .
- // given:
- src/foo/foo.cc
- src/bar/bar.cc
- src/bar/baz.cc
+16.14. Signals
- // in baz.cc
- #include "bar.h"
+------------
- // in foo.cc
- #include "bar/bar.h"
+Important
- * Just because it is a #define doesn’t mean it goes in a header.
- Everything should be scoped as tightly as possible. Shared
- implementation declarations should go in a separate header from
- the interface. And so on.
- * A .cc should include its own .h before any others (including
- system headers). This ensures that the header stands on its own
- and can be used by clients without include prerequisites.
- * Include required headers, all required headers, and nothing but
- required headers. Don’t just clone a bunch of headers because it
- is convenient.
- * Any file depending of #ifdefs should include config.h as shown
- below. A .h should include it before any other includes, and a
- .cc should include it immediately after the include of its own
- .h.
+Signal numbers are for the system that generated this documentation
+and are not applicable elsewhere.
- #ifdef HAVE_CONFIG_H
- #include "config.h"
- #endif
+ * hosts(16): reload hosts file
+ * int(2): shutdown normally
+ * quit(3): shutdown as if started with --dirty-pig
+ * reload(1): reload config file
+ * rotate(31): rotate stats files
+ * stats(30): dump stats to stdout
+ * term(15): shutdown normally
- * Do not put using statements in headers.
-14.17.6.9. Warnings
+16.15. Configuration Changes
- * With g++, use at least these compiler flags:
+------------
- -Wall -Wextra -pedantic -Wformat -Wformat-security
- -Wunused-but-set-variable -Wno-deprecated-declarations
+change -> dynamicdetection ==> 'snort.--plugin_path=<path>'
+change -> dynamicengine ==> 'snort.--plugin_path=<path>'
+change -> dynamicpreprocessor ==> 'snort.--plugin_path=<path>'
+change -> dynamicsidechannel ==> 'snort.--plugin_path=<path>'
+change -> alertfile: 'config alertfile:' ==> 'alert_fast.file'
+change -> alertfile: 'config alertfile:' ==> 'alert_full.file'
+change -> attribute_table: 'STREAM_POLICY' ==> 'hosts: tcp_policy'
+change -> attribute_table: 'filename <file_name>' ==> 'hosts[]'
+change -> config ' addressspace_agnostic' ==> ' packets. address_space_agnostic'
+change -> config ' checksum_mode' ==> ' network. checksum_eval'
+change -> config ' daq' ==> ' daq. type'
+change -> config ' daq_dir' ==> ' daq. dir'
+change -> config ' daq_mode' ==> ' daq. mode'
+change -> config ' daq_var' ==> ' daq. var'
+change -> config ' detection_filter' ==> ' alerts. detection_filter_memcap'
+change -> config ' enable_deep_teredo_inspection' ==> ' udp. deep_teredo_inspection'
+change -> config ' event_filter' ==> ' alerts. event_filter_memcap'
+change -> config ' max_attribute_hosts' ==> ' attribute_table. max_hosts'
+change -> config ' max_attribute_services_per_host' ==> ' attribute_table. max_services_per_host'
+change -> config ' nopcre' ==> ' detection. pcre_enable'
+change -> config ' pkt_count' ==> ' packets. limit'
+change -> config ' rate_filter' ==> ' alerts. rate_filter_memcap'
+change -> config ' react' ==> ' react. page'
+change -> config ' threshold' ==> ' alerts. event_filter_memcap'
+change -> csv: 'dgmlen' ==> 'dgm_len'
+change -> csv: 'dst' ==> 'dst_addr'
+change -> csv: 'dstport' ==> 'dst_port'
+change -> csv: 'ethdst' ==> 'eth_dst'
+change -> csv: 'ethlen' ==> 'eth_len'
+change -> csv: 'ethsrc' ==> 'eth_src'
+change -> csv: 'ethtype' ==> 'eth_type'
+change -> csv: 'icmpcode' ==> 'icmp_code'
+change -> csv: 'icmpid' ==> 'icmp_id'
+change -> csv: 'icmpseq' ==> 'icmp_seq'
+change -> csv: 'icmptype' ==> 'icmp_type'
+change -> csv: 'iplen' ==> 'ip_len'
+change -> csv: 'sig_generator' ==> 'gid'
+change -> csv: 'sig_id' ==> 'sid'
+change -> csv: 'sig_rev' ==> 'rev'
+change -> csv: 'src' ==> 'src_addr'
+change -> csv: 'srcport' ==> 'src_port'
+change -> csv: 'tcpack' ==> 'tcp_ack'
+change -> csv: 'tcpflags' ==> 'tcp_flags'
+change -> csv: 'tcplen' ==> 'tcp_len'
+change -> csv: 'tcpseq' ==> 'tcp_seq'
+change -> csv: 'tcpwindow' ==> 'tcp_win'
+change -> csv: 'udplength' ==> 'udp_len'
+change -> detection: 'ac' ==> 'ac_full_q'
+change -> detection: 'ac-banded' ==> 'ac_banded'
+change -> detection: 'ac-bnfa' ==> 'ac_bnfa_q'
+change -> detection: 'ac-bnfa-nq' ==> 'ac_bnfa'
+change -> detection: 'ac-bnfa-q' ==> 'ac_bnfa_q'
+change -> detection: 'ac-nq' ==> 'ac_full'
+change -> detection: 'ac-q' ==> 'ac_full_q'
+change -> detection: 'ac-sparsebands' ==> 'ac_sparse_bands'
+change -> detection: 'ac-split' ==> 'ac_full_q'
+change -> detection: 'ac-split' ==> 'split_any_any'
+change -> detection: 'ac-std' ==> 'ac_std'
+change -> detection: 'acs' ==> 'ac_sparse'
+change -> detection: 'bleedover-port-limit' ==> 'bleedover_port_limit'
+change -> detection: 'intel-cpm' ==> 'intel_cpm'
+change -> detection: 'lowmem' ==> 'lowmem_q'
+change -> detection: 'lowmem-nq' ==> 'lowmem'
+change -> detection: 'lowmem-q' ==> 'lowmem_q'
+change -> detection: 'max-pattern-len' ==> 'max_pattern_len'
+change -> detection: 'search-method' ==> 'search_method'
+change -> detection: 'search-optimize' ==> 'search_optimize'
+change -> detection: 'split-any-any' ==> 'split_any_any'
+change -> dns: 'ports' ==> 'bindings'
+change -> event_filter: 'gen_id' ==> 'gid'
+change -> event_filter: 'sig_id' ==> 'sid'
+change -> event_filter: 'threshold' ==> 'event_filter'
+change -> file: 'config file: file_block_timeout' ==> 'block_timeout'
+change -> file: 'config file: file_type_depth' ==> 'type_depth'
+change -> file: 'config file: signature' ==> 'enable_signature'
+change -> file: 'config file: type_id' ==> 'enable_type'
+change -> frag3_engine: 'min_fragment_length' ==> 'min_frag_length'
+change -> frag3_engine: 'overlap_limit' ==> 'max_overlaps'
+change -> frag3_engine: 'policy bsd-right' ==> 'policy = bsd_right'
+change -> frag3_engine: 'timeout' ==> 'session_timeout'
+change -> ftp_telnet_protocol: 'alt_max_param_len' ==> 'cmd_validity'
+change -> ftp_telnet_protocol: 'data_chan' ==> 'ignore_data_chan'
+change -> ftp_telnet_protocol: 'ports' ==> 'bindings'
+change -> gtp: 'ports' ==> 'gtp_ports'
+change -> http_inspect: 'http_inspect' ==> 'http_global'
+change -> http_inspect_server: 'apache_whitespace' ==> 'profile.apache_whitespace'
+change -> http_inspect_server: 'ascii' ==> 'profile.ascii'
+change -> http_inspect_server: 'bare_byte' ==> 'profile.bare_byte'
+change -> http_inspect_server: 'chunk_length' ==> 'profile.chunk_length'
+change -> http_inspect_server: 'client_flow_depth' ==> 'profile.client_flow_depth'
+change -> http_inspect_server: 'directory' ==> 'profile.directory'
+change -> http_inspect_server: 'double_decode' ==> 'profile.double_decode'
+change -> http_inspect_server: 'enable_cookie' ==> 'enable_cookies'
+change -> http_inspect_server: 'flow_depth' ==> 'server_flow_depth'
+change -> http_inspect_server: 'http_inspect_server' ==> 'http_inspect'
+change -> http_inspect_server: 'iis_backslash' ==> 'profile.iis_backslash'
+change -> http_inspect_server: 'iis_delimiter' ==> 'profile.iis_delimiter'
+change -> http_inspect_server: 'iis_unicode' ==> 'profile.iis_unicode'
+change -> http_inspect_server: 'max_header_length' ==> 'profile.max_header_length'
+change -> http_inspect_server: 'max_headers' ==> 'profile.max_headers'
+change -> http_inspect_server: 'max_spaces' ==> 'profile.max_spaces'
+change -> http_inspect_server: 'multi_slash' ==> 'profile.multi_slash'
+change -> http_inspect_server: 'non_rfc_char' ==> 'non_rfc_chars'
+change -> http_inspect_server: 'non_strict' ==> 'profile.non_strict'
+change -> http_inspect_server: 'normalize_utf' ==> 'profile.normalize_utf'
+change -> http_inspect_server: 'ports' ==> 'bindings'
+change -> http_inspect_server: 'u_encode' ==> 'profile.u_encode'
+change -> http_inspect_server: 'utf_8' ==> 'profile.utf_8'
+change -> http_inspect_server: 'webroot' ==> 'profile.webroot'
+change -> http_inspect_server: 'whitespace_chars' ==> 'profile.whitespace_chars'
+change -> imap: 'ports' ==> 'bindings'
+change -> paf_max: 'paf_max [0:63780]' ==> 'max_pdu [1460:63780]'
+change -> perfmonitor: 'accumulate' ==> 'reset = false'
+change -> perfmonitor: 'flow-file' ==> 'flow_file = true'
+change -> perfmonitor: 'flow-ip' ==> 'flow_ip'
+change -> perfmonitor: 'flow-ip-file' ==> 'flow_ip_file = true'
+change -> perfmonitor: 'flow-ip-memcap' ==> 'flow_ip_memcap'
+change -> perfmonitor: 'flow-ports' ==> 'flow_ports'
+change -> perfmonitor: 'pktcnt' ==> 'packets'
+change -> perfmonitor: 'snortfile' ==> 'file = true'
+change -> perfmonitor: 'time' ==> 'seconds'
+change -> policy_mode: 'inline_test' ==> 'inline-test'
+change -> pop: 'ports' ==> 'bindings'
+change -> ppm: 'max-pkt-time' ==> 'max_pkt_time'
+change -> ppm: 'max-rule-time' ==> 'max_rule_time'
+change -> ppm: 'pkt-log' ==> 'pkt_log'
+change -> ppm: 'rule-log' ==> 'rule_log'
+change -> ppm: 'suspend-timeout' ==> 'suspend_timeout'
+change -> preprocessor 'normalize_ icmp4' ==> 'normalize. icmp4'
+change -> preprocessor 'normalize_ icmp6' ==> 'normalize. icmp6'
+change -> preprocessor 'normalize_ ip6' ==> 'normalize. ip6'
+change -> profile: 'print' ==> 'count'
+change -> rate_filter: 'gen_id' ==> 'gid'
+change -> rate_filter: 'sig_id' ==> 'sid'
+change -> rule_state: 'disabled' ==> 'enable'
+change -> rule_state: 'enabled' ==> 'enable'
+change -> sfportscan: 'proto' ==> 'protos'
+change -> sfportscan: 'scan_type' ==> 'scan_types'
+change -> sip: 'ports' ==> 'bindings'
+change -> smtp: 'ports' ==> 'bindings'
+change -> ssh: 'server_ports' ==> 'bindings'
+change -> ssl: 'ports' ==> 'bindings'
+change -> stream5_global: 'max_active_responses' ==> 'max_responses'
+change -> stream5_global: 'max_icmp' ==> 'max_sessions'
+change -> stream5_global: 'max_ip' ==> 'max_sessions'
+change -> stream5_global: 'max_tcp' ==> 'max_sessions'
+change -> stream5_global: 'max_udp' ==> 'max_sessions'
+change -> stream5_global: 'min_response_seconds' ==> 'min_interval'
+change -> stream5_global: 'prune_log_max' ==> 'histogram'
+change -> stream5_global: 'tcp_cache_nominal_timeout' ==> 'pruning_timeout'
+change -> stream5_global: 'tcp_cache_pruning_timeout' ==> 'idle_timeout'
+change -> stream5_global: 'udp_cache_nominal_timeout' ==> 'idle_timeout'
+change -> stream5_global: 'udp_cache_pruning_timeout' ==> 'pruning_timeout'
+change -> stream5_ip: 'timeout' ==> 'session_timeout'
+change -> stream5_tcp: 'bind_to' ==> 'bindings'
+change -> stream5_tcp: 'dont_reassemble_async' ==> 'reassemble_async'
+change -> stream5_tcp: 'max_queued_bytes' ==> 'queue_limit.max_bytes'
+change -> stream5_tcp: 'max_queued_segs' ==> 'queue_limit.max_segments'
+change -> stream5_tcp: 'policy hpux' ==> 'stream_tcp.policy = hpux11'
+change -> stream5_tcp: 'timeout' ==> 'session_timeout'
+change -> stream5_tcp: 'use_static_footprint_sizes' ==> 'footprint'
+change -> stream5_udp: 'timeout' ==> 'session_timeout'
+change -> suppress: 'gen_id' ==> 'gid'
+change -> suppress: 'sig_id' ==> 'sid'
+change -> syslog: 'log_alert' ==> 'level = alert'
+change -> syslog: 'log_auth' ==> 'facility = auth'
+change -> syslog: 'log_authpriv' ==> 'facility = authpriv'
+change -> syslog: 'log_cons' ==> 'options = cons'
+change -> syslog: 'log_crit' ==> 'level = crit'
+change -> syslog: 'log_daemon' ==> 'facility = daemon'
+change -> syslog: 'log_debug' ==> 'level = debug'
+change -> syslog: 'log_emerg' ==> 'level = emerg'
+change -> syslog: 'log_err' ==> 'level = err'
+change -> syslog: 'log_info' ==> 'level = info'
+change -> syslog: 'log_local0' ==> 'facility = local0'
+change -> syslog: 'log_local1' ==> 'facility = local1'
+change -> syslog: 'log_local2' ==> 'facility = local2'
+change -> syslog: 'log_local3' ==> 'facility = local3'
+change -> syslog: 'log_local4' ==> 'facility = local4'
+change -> syslog: 'log_local5' ==> 'facility = local5'
+change -> syslog: 'log_local6' ==> 'facility = local6'
+change -> syslog: 'log_local7' ==> 'facility = local7'
+change -> syslog: 'log_ndelay' ==> 'options = ndelay'
+change -> syslog: 'log_notice' ==> 'level = notice'
+change -> syslog: 'log_perror' ==> 'options = perror'
+change -> syslog: 'log_pid' ==> 'options = pid'
+change -> syslog: 'log_user' ==> 'facility = user'
+change -> syslog: 'log_warning' ==> 'level = warning'
+change -> threshold: 'ips_option: threshold' ==> 'event_filter'
+change -> unified2: ' alert_unified2' ==> 'unified2'
+change -> unified2: ' log_unified2' ==> 'unified2'
+change -> unified2: ' unified2' ==> 'unified2'
+deleted -> arpspoof: 'unicast'
+deleted -> attribute_table: '<FRAG_POLICY>hpux</FRAG_POLICY>'
+deleted -> attribute_table: '<FRAG_POLICY>irix</FRAG_POLICY>'
+deleted -> attribute_table: '<FRAG_POLICY>old-linux</FRAG_POLICY>'
+deleted -> attribute_table: '<FRAG_POLICY>unknown</FRAG_POLICY>'
+deleted -> attribute_table: '<STREAM_POLICY>noack</STREAM_POLICY>'
+deleted -> attribute_table: '<STREAM_POLICY>unknown</STREAM_POLICY>'
+deleted -> config ' cs_dir'
+deleted -> config ' disable_attribute_reload_thread'
+deleted -> config ' disable_decode_alerts'
+deleted -> config ' disable_decode_drops'
+deleted -> config ' disable_ipopt_alerts'
+deleted -> config ' disable_ipopt_drops'
+deleted -> config ' disable_tcpopt_alerts'
+deleted -> config ' disable_tcpopt_drops'
+deleted -> config ' disable_tcpopt_experimental_alerts'
+deleted -> config ' disable_tcpopt_experimental_drops'
+deleted -> config ' disable_tcpopt_obsolete_alerts'
+deleted -> config ' disable_tcpopt_obsolete_drops'
+deleted -> config ' disable_tcpopt_ttcp_alerts'
+deleted -> config ' disable_ttcp_alerts'
+deleted -> config ' disable_ttcp_drops'
+deleted -> config ' dump_dynamic_rules_path'
+deleted -> config ' enable_decode_drops'
+deleted -> config ' enable_decode_oversized_alerts'
+deleted -> config ' enable_decode_oversized_drops'
+deleted -> config ' enable_ipopt_drops'
+deleted -> config ' enable_tcpopt_drops'
+deleted -> config ' enable_tcpopt_experimental_drops'
+deleted -> config ' enable_tcpopt_obsolete_drops'
+deleted -> config ' enable_tcpopt_ttcp_drops'
+deleted -> config ' enable_ttcp_drops'
+deleted -> config ' flexresp2_attempts'
+deleted -> config ' flexresp2_interface'
+deleted -> config ' flexresp2_memcap'
+deleted -> config ' flexresp2_rows'
+deleted -> config ' flowbits_size'
+deleted -> config ' include_vlan_in_alerts'
+deleted -> config ' interface'
+deleted -> config ' layer2resets'
+deleted -> config ' policy_version'
+deleted -> config ' so_rule_memcap'
+deleted -> csv: '<filename> can no longer be specific'
+deleted -> csv: 'default'
+deleted -> csv: 'trheader'
+deleted -> detection: 'mwm'
+deleted -> dns: 'enable_experimental_types'
+deleted -> dns: 'enable_obsolete_types'
+deleted -> dns: 'enable_rdata_overflow'
+deleted -> fast: '<filename> can no longer be specific'
+deleted -> frag3_engine: 'detect_anomalies'
+deleted -> frag3_global: 'disabled'
+deleted -> ftp_telnet_protocol: 'detect_anomalies'
+deleted -> full: '<filename> can no longer be specific'
+deleted -> http_inspect: 'disabled'
+deleted -> http_inspect_server: 'no_alerts'
+deleted -> imap: 'disabled'
+deleted -> imap: 'max_mime_mem'
+deleted -> imap: 'memcap'
+deleted -> perfmonitor: 'atexitonly'
+deleted -> perfmonitor: 'atexitonly: base-stats'
+deleted -> perfmonitor: 'atexitonly: events-stats'
+deleted -> perfmonitor: 'atexitonly: flow-ip-stats'
+deleted -> perfmonitor: 'atexitonly: flow-stats'
+deleted -> pop: 'disabled'
+deleted -> pop: 'max_mime_mem'
+deleted -> pop: 'memcap'
+deleted -> ppm: 'debug-pkts'
+deleted -> react: 'block'
+deleted -> react: 'warn'
+deleted -> rpc_decode: 'alert_fragments'
+deleted -> rpc_decode: 'no_alert_incomplete'
+deleted -> rpc_decode: 'no_alert_large_fragments'
+deleted -> rpc_decode: 'no_alert_multiple_requests'
+deleted -> rule_state: 'action'
+deleted -> sfportscan: 'detect_ack_scans'
+deleted -> sfportscan: 'disabled'
+deleted -> sfportscan: 'logfile'
+deleted -> sip: 'disabled'
+deleted -> smtp: 'alert_unknown_cmds'
+deleted -> smtp: 'disabled'
+deleted -> smtp: 'enable_mime_decoding'
+deleted -> smtp: 'inspection_type'
+deleted -> smtp: 'max_mime_depth'
+deleted -> smtp: 'max_mime_mem'
+deleted -> smtp: 'memcap'
+deleted -> smtp: 'no_alerts'
+deleted -> smtp: 'print_cmds'
+deleted -> ssh: 'autodetect'
+deleted -> ssh: 'enable_badmsgdir'
+deleted -> ssh: 'enable_paysize'
+deleted -> ssh: 'enable_protomismatch'
+deleted -> ssh: 'enable_recognition'
+deleted -> ssh: 'enable_respoverflow'
+deleted -> ssh: 'enable_srvoverflow'
+deleted -> ssh: 'enable_ssh1crc32'
+deleted -> ssl: 'noinspect_encrypted'
+deleted -> stream5_global: 'disabled'
+deleted -> stream5_global: 'flush_on_alert'
+deleted -> stream5_global: 'no_midstream_drop_alerts'
+deleted -> stream5_tcp: 'check_session_hijacking'
+deleted -> stream5_tcp: 'detect_anomalies'
+deleted -> stream5_tcp: 'dont_store_large_packets'
+deleted -> stream5_tcp: 'policy noack'
+deleted -> stream5_tcp: 'policy unknown'
+deleted -> tcpdump: '<filename> can no longer be specific'
+deleted -> test: 'file'
+deleted -> test: 'stdout'
+deleted -> unified2: 'filename'
- * Then Fix All Warnings. None Allowed.
-14.17.6.10. Other
+16.16. Module Listing
- * Prefer and over && and or over || for new source files.
+------------
-14.17.6.11. Uncrustify
+ * ack (ips_option): rule option to match on TCP ack numbers
+ * active (basic): configure responses
+ * alert_csv (logger): output event in csv format
+ * alert_ex (logger): output gid:sid:rev for alerts
+ * alert_fast (logger): output event with brief text format
+ * alert_full (logger): output event with full packet dump
+ * alert_syslog (logger): output event to syslog
+ * alert_unixsock (logger): output event over unix socket
+ * alerts (basic): configure alerts
+ * arp (codec): support for address resolution protocol
+ * arp_spoof (inspector): detect ARP attacks and anomalies
+ * asn1 (ips_option): rule option for asn1 detection
+ * attribute_table (basic): configure hosts loading
+ * auth (codec): support for IP authentication header
+ * back_orifice (inspector): back orifice detection
+ * base64_decode (ips_option): rule option to decode base64 data -
+ must be used with base64_data option
+ * binder (inspector): configure processing based on CIDRs, ports,
+ services, etc.
+ * bufferlen (ips_option): rule option to check length of current
+ buffer
+ * byte_extract (ips_option): rule option to convert data to an
+ integer variable
+ * byte_jump (ips_option): rule option to move the detection cursor
+ * byte_test (ips_option): rule option to convert data to integer
+ and compare
+ * classifications (basic): define rule categories with priority
+ * classtype (ips_option): general rule option for rule
+ classification
+ * content (ips_option): payload rule option for basic pattern
+ matching
+ * cvs (ips_option): payload rule option for detecting specific
+ attacks
+ * daq (basic): configure packet acquisition interface
+ * data_log (inspector): log selected published data to data.log
+ * decode (basic): general decoder rules
+ * detection (basic): configure general IPS rule processing
+ parameters
+ * detection_filter (ips_option): rule option to require multiple
+ hits before a rule generates an event
+ * dns (inspector): dns inspection
+ * dpx (inspector): dynamic inspector example
+ * dsize (ips_option): rule option to test payload size
+ * eapol (codec): support for extensible authentication protocol
+ over LAN
+ * erspan2 (codec): support for encapsulated remote switched port
+ analyzer - type 2
+ * erspan3 (codec): support for encapsulated remote switched port
+ analyzer - type 3
+ * esp (codec): support for encapsulating security payload
+ * eth (codec): support for ethernet protocol (DLT 1) (DLT 51)
+ * event_filter (basic): configure thresholding of events
+ * event_queue (basic): configure event queue parameters
+ * fabricpath (codec): support for fabricpath
+ * file_data (ips_option): rule option to set detection cursor to
+ file data
+ * file_id (basic): configure file identification
+ * flags (ips_option): rule option to test TCP control flags
+ * flow (ips_option): rule option to check session properties
+ * flowbits (ips_option): rule option to set and test arbitrary
+ boolean flags
+ * fragbits (ips_option): rule option to test IP frag flags
+ * fragoffset (ips_option): rule option to test IP frag offset
+ * ftp_client (inspector): FTP client configuration module for use
+ with ftp_server
+ * ftp_data (inspector): FTP data channel handler
+ * ftp_server (inspector): main FTP module; ftp_client should also
+ be configured
+ * gid (ips_option): rule option specifying rule generator
+ * gre (codec): support for generic routing encapsulation
+ * gtp (codec): support for general-packet-radio-service tunnelling
+ protocol
+ * hosts (basic): configure hosts
+ * http_client_body (ips_option): rule option to set the detection
+ cursor to the request body
+ * http_cookie (ips_option): rule option to set the detection cursor
+ to the HTTP cookie
+ * http_global (inspector): http inspector global configuration and
+ client rules for use with http_server
+ * http_header (ips_option): rule option to set the detection cursor
+ to the normalized header(s)
+ * http_inspect (inspector): http inspection and server rules; also
+ configure http_inspect
+ * http_method (ips_option): rule option to set the detection cursor
+ to the HTTP request method
+ * http_raw_cookie (ips_option): rule option to set the detection
+ cursor to the unnormalized cookie
+ * http_raw_header (ips_option): rule option to set the detection
+ cursor to the unnormalized headers
+ * http_raw_uri (ips_option): rule option to set the detection
+ cursor to the unnormalized URI
+ * http_stat_code (ips_option): rule option to set the detection
+ cursor to the HTTP status code
+ * http_stat_msg (ips_option): rule option to set the detection
+ cursor to the HTTP status message
+ * http_uri (ips_option): rule option to set the detection cursor to
+ the normalized URI buffer
+ * icmp4 (codec): support for Internet control message protocol v4
+ * icmp6 (codec): support for Internet control message protocol v6
+ * icmp_id (ips_option): rule option to check ICMP ID
+ * icmp_seq (ips_option): rule option to check ICMP sequence number
+ * icode (ips_option): rule option to check ICMP code
+ * id (ips_option): rule option to check the IP ID field
+ * igmp (codec): support for Internet group management protocol
+ * imap (inspector): imap inspection
+ * ip_proto (ips_option): rule option to check the IP protocol
+ number
+ * ipopts (ips_option): rule option to check for IP options
+ * ips (basic): configure IPS rule processing
+ * ipv4 (codec): support for Internet protocol v4
+ * ipv6 (codec): support for Internet protocol v6
+ * isdataat (ips_option): rule option to check for the presence of
+ payload data
+ * itype (ips_option): rule option to check ICMP type
+ * log_codecs (logger): log protocols in packet by layer
+ * log_hext (logger): output payload suitable for daq hext
+ * log_pcap (logger): log packet in pcap format
+ * lowmem_q (search_engine): MPSE that minimizes memory used
+ * md5 (ips_option): payload rule option for hash matching
+ * metadata (ips_option): rule option for conveying arbitrary name,
+ value data within the rule text
+ * mpls (codec): support for multiprotocol label switching
+ * msg (ips_option): rule option summarizing rule purpose output
+ with events
+ * network (basic): configure basic network parameters
+ * new_http_inspect (inspector): new HTTP inspector
+ * normalizer (inspector): packet scrubbing for inline mode
+ * output (basic): configure general output parameters
+ * packets (basic): configure basic packet handling
+ * pcre (ips_option): rule option for matching payload data with
+ regex
+ * perf_monitor (inspector): performance monitoring and flow
+ statistics collection
+ * pgm (codec): support for pragmatic general multicast
+ * pkt_data (ips_option): rule option to set the detection cursor to
+ the normalized packet data
+ * pop (inspector): pop inspection
+ * port_scan (inspector): port scan inspector; also configure
+ port_scan_global
+ * port_scan_global (inspector): shared settings for port_scan
+ inspectors for use with port_scan
+ * ppm (basic): packet and rule latency monitoring and control
+ (requires --enable-ppm)
+ * pppoe (codec): support for point-to-point protocol over ethernet
+ * priority (ips_option): rule option for prioritizing events
+ * process (basic): configure basic process setup
+ * profile (basic): configure profiling of rules and/or modules
+ (requires --enable-perf-profiling)
+ * rate_filter (basic): configure rate filters (which change rule
+ actions)
+ * raw_data (ips_option): rule option to set the detection cursor to
+ the raw packet data
+ * react (ips_action): send response to client and terminate session
+ * reference (ips_option): rule option to indicate relevant attack
+ identification system
+ * references (basic): define reference systems used in rules
+ * reject (ips_action): terminate session with TCP reset or ICMP
+ unreachable
+ * rem (ips_option): rule option to convey an arbitrary comment in
+ the rule body
+ * replace (ips_option): rule option to overwrite payload data; use
+ with rewrite action
+ * rev (ips_option): rule option to indicate current revision of
+ signature
+ * rewrite (ips_action): overwrite packet contents
+ * rpc (ips_option): rule option to check SUNRPC CALL parameters
+ * rpc_decode (inspector): RPC inspector
+ * rule_state (basic): enable/disable specific IPS rules
+ * search_engine (basic): configure fast pattern matcher
+ * seq (ips_option): rule option to check TCP sequence number
+ * session (ips_option): rule option to check user data from TCP
+ sessions
+ * sha256 (ips_option): payload rule option for hash matching
+ * sha512 (ips_option): payload rule option for hash matching
+ * sid (ips_option): rule option to indicate signature number
+ * sip (inspector): sip inspection
+ * sip_body (ips_option): rule option to set the detection cursor to
+ the request body
+ * sip_header (ips_option): rule option to set the detection cursor
+ to the SIP header buffer
+ * sip_method (ips_option): detection option for sip stat code
+ * sip_stat_code (ips_option): detection option for sip stat code
+ * smtp (inspector): smtp inspection
+ * snort (basic): command line configuration and shell commands
+ * so (ips_option): rule option to call custom eval function
+ * soid (ips_option): rule option to specify a shared object rule ID
+ * ssh (inspector): ssh inspection
+ * ssl (inspector): ssl inspection
+ * ssl_state (ips_option): detection option for ssl state
+ * ssl_version (ips_option): detection option for ssl version
+ * stream (inspector): common flow tracking
+ * stream_file (inspector): stream inspector for file flow tracking
+ and processing
+ * stream_icmp (inspector): stream inspector for ICMP flow tracking
+ * stream_ip (inspector): stream inspector for IP flow tracking and
+ defragmentation
+ * stream_reassemble (ips_option): detection option for stream
+ reassembly control
+ * stream_size (ips_option): detection option for stream size
+ checking
+ * stream_tcp (inspector): stream inspector for TCP flow tracking
+ and stream normalization and reassembly
+ * stream_udp (inspector): stream inspector for UDP flow tracking
+ * stream_user (inspector): stream inspector for user flow tracking
+ and reassembly
+ * suppress (basic): configure event suppressions
+ * tag (ips_option): rule option to log additional packets
+ * tcp (codec): support for transmission control protocol
+ * telnet (inspector): telnet inspection and normalization
+ * token_ring (codec): support for token ring decoding
+ * tos (ips_option): rule option to check type of service field
+ * ttl (ips_option): rule option to check time to live field
+ * udp (codec): support for user datagram protocol
+ * unified2 (logger): output event and packet in unified2 format
+ file
+ * urg (ips_option): detection for TCP urgent pointer
+ * vlan (codec): support for local area network
+ * window (ips_option): rule option to check TCP window field
+ * wizard (inspector): inspector that implements port-independent
+ protocol identification
+ * wlan (codec): support for wireless local area network protocol
+ (DLT 105) :leveloffset: 0
-Currently using uncrustify from at https://github.com/bengardner/
-uncrustify to reformat legacy code and anything that happens to need
-a makeover at some point.
+16.16.1. Plugin Listing
-The working config is crusty.cfg in the top level directory. It does
-well but will munge some things. Specially formatted INDENT-OFF
-comments were added in 2 places to avoid a real mess.
+ * codec::arp: support for address resolution protocol
+ * codec::auth: support for IP authentication header
+ * codec::eapol: support for extensible authentication protocol over
+ LAN
+ * codec::erspan2: support for encapsulated remote switched port
+ analyzer - type 2
+ * codec::erspan3: support for encapsulated remote switched port
+ analyzer - type 3
+ * codec::esp: support for encapsulating security payload
+ * codec::eth: support for ethernet protocol (DLT 1) (DLT 51)
+ * codec::fabricpath: support for fabricpath
+ * codec::gre: support for generic routing encapsulation
+ * codec::gtp: support for general-packet-radio-service tunnelling
+ protocol
+ * codec::i4l_rawip: support for I4L IP
+ * codec::icmp4: support for Internet control message protocol v4
+ * codec::icmp4_ip: support for IP in ICMPv4
+ * codec::icmp6: support for Internet control message protocol v6
+ * codec::icmp6_ip: support for IP in ICMPv6
+ * codec::igmp: support for Internet group management protocol
+ * codec::ipv4: support for Internet protocol v4
+ * codec::ipv6: support for Internet protocol v6
+ * codec::ipv6_dst_opts: support for ipv6 destination options
+ * codec::ipv6_frag: support for IPv6 fragment decoding
+ * codec::ipv6_hop_opts: support for IPv6 hop options
+ * codec::ipv6_mobility: support for mobility
+ * codec::ipv6_no_next: sentinel codec
+ * codec::ipv6_routing: support for IPv6 routing extension
+ * codec::linux_sll: support for Linux SLL (DLT 113)
+ * codec::llc: support for logical link control
+ * codec::mpls: support for multiprotocol label switching
+ * codec::null: support for null encapsulation (DLT 0)
+ * codec::pflog: support for OpenBSD PF log (DLT 117)
+ * codec::pgm: support for pragmatic general multicast
+ * codec::pim: support for protocol independent multicast
+ * codec::ppp: support for point-to-point encapsulation (DLT
+ DLT_PPP)
+ * codec::ppp_encap: support for point-to-point encapsulation
+ * codec::pppoe_disc: support for point-to-point discovery
+ * codec::pppoe_sess: support for point-to-point session
+ * codec::raw4: support for unencapsulated IPv4 (DLT 12) (DLT 228)
+ * codec::raw6: support for unencapsulated IPv6 (DLT 229)
+ * codec::socket: support for sockets / proxied sessions (DLT 230)
+ * codec::sun_nd: support for Sun ND
+ * codec::swipe: support for Swipe
+ * codec::tcp: support for transmission control protocol
+ * codec::teredo: support for teredo
+ * codec::token_ring: support for token ring decoding
+ * codec::trans_bridge: support for trans-bridging
+ * codec::udp: support for user datagram protocol
+ * codec::vlan: support for local area network
+ * codec::wlan: support for wireless local area network protocol
+ (DLT 105)
+ * inspector::arp_spoof: detect ARP attacks and anomalies
+ * inspector::back_orifice: back orifice detection
+ * inspector::binder: configure processing based on CIDRs, ports,
+ services, etc.
+ * inspector::data_log: log selected published data to data.log
+ * inspector::dns: dns inspection
+ * inspector::dpx: dynamic inspector example
+ * inspector::ftp_client: FTP inspector client module
+ * inspector::ftp_data: FTP data channel handler
+ * inspector::ftp_server: FTP inspector server module
+ * inspector::http_global: shared HTTP inspector settings
+ * inspector::http_inspect: main HTTP inspector module
+ * inspector::imap: imap inspection
+ * inspector::new_http_inspect: the new HTTP inspector!
+ * inspector::normalizer: packet scrubbing for inline mode
+ * inspector::perf_monitor: performance monitoring and flow
+ statistics collection
+ * inspector::pop: pop inspection
+ * inspector::port_scan: port scan inspector; also configure
+ port_scan_global
+ * inspector::port_scan_global: shared settings for port_scan
+ inspectors for use with port_scan
+ * inspector::rpc_decode: RPC inspector
+ * inspector::sip: sip inspection
+ * inspector::smtp: smtp inspection
+ * inspector::ssh: ssh inspection
+ * inspector::ssl: ssl inspection
+ * inspector::stream: common flow tracking
+ * inspector::stream_file: stream inspector for file flow tracking
+ and processing
+ * inspector::stream_icmp: stream inspector for ICMP flow tracking
+ * inspector::stream_ip: stream inspector for IP flow tracking and
+ defragmentation
+ * inspector::stream_tcp: stream inspector for TCP flow tracking and
+ stream normalization and reassembly
+ * inspector::stream_udp: stream inspector for UDP flow tracking
+ * inspector::stream_user: stream inspector for user flow tracking
+ and reassembly
+ * inspector::telnet: telnet inspection and normalization
+ * inspector::wizard: inspector that implements port-independent
+ protocol identification
+ * ips_action::react: send response to client and terminate session
+ * ips_action::reject: terminate session with TCP reset or ICMP
+ unreachable
+ * ips_action::rewrite: overwrite packet contents
+ * ips_option::ack: rule option to match on TCP ack numbers
+ * ips_option::asn1: rule option for asn1 detection
+ * ips_option::base64_data: set detection cursor to decoded Base64
+ data
+ * ips_option::base64_decode: rule option to decode base64 data -
+ must be used with base64_data option
+ * ips_option::bufferlen: rule option to check length of current
+ buffer
+ * ips_option::byte_extract: rule option to convert data to an
+ integer variable
+ * ips_option::byte_jump: rule option to move the detection cursor
+ * ips_option::byte_test: rule option to convert data to integer and
+ compare
+ * ips_option::classtype: general rule option for rule
+ classification
+ * ips_option::content: payload rule option for basic pattern
+ matching
+ * ips_option::cvs: payload rule option for detecting specific
+ attacks
+ * ips_option::detection_filter: rule option to require multiple
+ hits before a rule generates an event
+ * ips_option::dsize: rule option to test payload size
+ * ips_option::file_data: rule option to set detection cursor to
+ file data
+ * ips_option::flags: rule option to test TCP control flags
+ * ips_option::flow: rule option to check session properties
+ * ips_option::flowbits: rule option to set and test arbitrary
+ boolean flags
+ * ips_option::fragbits: rule option to test IP frag flags
+ * ips_option::fragoffset: rule option to test IP frag offset
+ * ips_option::gid: rule option specifying rule generator
+ * ips_option::http_client_body: rule option to set the detection
+ cursor to the request body
+ * ips_option::http_cookie: rule option to set the detection cursor
+ to the HTTP cookie
+ * ips_option::http_header: rule option to set the detection cursor
+ to the normalized header(s)
+ * ips_option::http_method: rule option to set the detection cursor
+ to the HTTP request method
+ * ips_option::http_raw_cookie: rule option to set the detection
+ cursor to the unnormalized cookie
+ * ips_option::http_raw_header: rule option to set the detection
+ cursor to the unnormalized headers
+ * ips_option::http_raw_uri: rule option to set the detection cursor
+ to the unnormalized URI
+ * ips_option::http_stat_code: rule option to set the detection
+ cursor to the HTTP status code
+ * ips_option::http_stat_msg: rule option to set the detection
+ cursor to the HTTP status message
+ * ips_option::http_uri: rule option to set the detection cursor to
+ the normalized URI buffer
+ * ips_option::icmp_id: rule option to check ICMP ID
+ * ips_option::icmp_seq: rule option to check ICMP sequence number
+ * ips_option::icode: rule option to check ICMP code
+ * ips_option::id: rule option to check the IP ID field
+ * ips_option::ip_proto: rule option to check the IP protocol number
+ * ips_option::ipopts: rule option to check for IP options
+ * ips_option::isdataat: rule option to check for the presence of
+ payload data
+ * ips_option::itype: rule option to check ICMP type
+ * ips_option::md5: payload rule option for hash matching
+ * ips_option::metadata: rule option for conveying arbitrary name,
+ value data within the rule text
+ * ips_option::msg: rule option summarizing rule purpose output with
+ events
+ * ips_option::pcre: rule option for matching payload data with
+ regex
+ * ips_option::pkt_data: rule option to set the detection cursor to
+ the normalized packet data
+ * ips_option::priority: rule option for prioritizing events
+ * ips_option::raw_data: rule option to set the detection cursor to
+ the raw packet data
+ * ips_option::reference: rule option to indicate relevant attack
+ identification system
+ * ips_option::rem: rule option to convey an arbitrary comment in
+ the rule body
+ * ips_option::replace: rule option to overwrite payload data; use
+ with rewrite action
+ * ips_option::rev: rule option to indicate current revision of
+ signature
+ * ips_option::rpc: rule option to check SUNRPC CALL parameters
+ * ips_option::seq: rule option to check TCP sequence number
+ * ips_option::session: rule option to check user data from TCP
+ sessions
+ * ips_option::sha256: payload rule option for hash matching
+ * ips_option::sha512: payload rule option for hash matching
+ * ips_option::sid: rule option to indicate signature number
+ * ips_option::sip_body: rule option to set the detection cursor to
+ the request body
+ * ips_option::sip_header: rule option to set the detection cursor
+ to the SIP header buffer
+ * ips_option::sip_method: detection option for sip stat code
+ * ips_option::sip_stat_code: detection option for sip stat code
+ * ips_option::so: rule option to call custom eval function
+ * ips_option::soid: rule option to specify a shared object rule ID
+ * ips_option::ssl_state: detection option for ssl state
+ * ips_option::ssl_version: detection option for ssl version
+ * ips_option::stream_reassemble: detection option for stream
+ reassembly control
+ * ips_option::stream_size: detection option for stream size
+ checking
+ * ips_option::tag: rule option to log additional packets
+ * ips_option::tos: rule option to check type of service field
+ * ips_option::ttl: rule option to check time to live field
+ * ips_option::urg: detection for TCP urgent pointer
+ * ips_option::window: rule option to check TCP window field
+ * logger::alert_csv: output event in csv format
+ * logger::alert_ex: output gid:sid:rev for alerts
+ * logger::alert_fast: output event with brief text format
+ * logger::alert_full: output event with full packet dump
+ * logger::alert_syslog: output event to syslog
+ * logger::alert_unixsock: output event over unix socket
+ * logger::log_codecs: log protocols in packet by layer
+ * logger::log_hext: output payload suitable for daq hext
+ * logger::log_null: support for null encapsulation
+ * logger::log_pcap: log packet in pcap format
+ * logger::unified2: output event and packet in unified2 format file
+ * search_engine::ac_banded: Aho-Corasick Banded (high memory,
+ moderate performance)
+ * search_engine::ac_bnfa: Aho-Corasick Binary NFA (low memory, high
+ performance) MPSE
+ * search_engine::ac_bnfa_q: Aho-Corasick Binary NFA (low memory,
+ high performance) with queued events
+ * search_engine::ac_full: Aho-Corasick Full (high memory, best
+ performance), implements search_all()
+ * search_engine::ac_full_q: Aho-Corasick Full (high memory, best
+ performance) with queued events, implements search_all()
+ * search_engine::ac_sparse: Aho-Corasick Sparse (high memory,
+ moderate performance) MPSE
+ * search_engine::ac_sparse_bands: Aho-Corasick Sparse-Banded (high
+ memory, moderate performance) MPSE
+ * search_engine::ac_std: Aho-Corasick Full (high memory, best
+ performance) MPSE
+ * search_engine::lowmem: Keyword Trie (low memory, moderate
+ performance) MPSE
+ * search_engine::lowmem_q: Keyword Trie (low memory, moderate
+ performance) MPSE with queued events
+ * so_rule::3|18758: SO rule example
projects / thirdparty / snort3.git / commitdiff
