From: Tom Peters (thopeter) Date: Fri, 26 Aug 2016 18:54:50 +0000 (-0400) Subject: Merge pull request #604 in SNORT/snort3 from nhttp53 to master X-Git-Tag: 3.0.0-233~277 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a67c9df960d92efb65436394a30890c9663c2acc;p=thirdparty%2Fsnort3.git Merge pull request #604 in SNORT/snort3 from nhttp53 to master Squashed commit of the following: commit acd74c3b9944b52d1cb1264b32a1f3de2a8d6b83 Author: Tom Peters Date: Mon Aug 22 17:39:50 2016 -0400 NHI becomes OHI part 2 --- diff --git a/configure.ac b/configure.ac index 2673c9dd5..1f9db1f1d 100644 --- a/configure.ac +++ b/configure.ac @@ -1179,8 +1179,8 @@ src/service_inspectors/ftp_telnet/Makefile \ src/service_inspectors/gtp/Makefile \ src/service_inspectors/imap/Makefile \ src/service_inspectors/modbus/Makefile \ -src/service_inspectors/nhttp_inspect/Makefile \ -src/service_inspectors/nhttp_inspect/test/Makefile \ +src/service_inspectors/http_inspect/Makefile \ +src/service_inspectors/http_inspect/test/Makefile \ src/service_inspectors/pop/Makefile \ src/service_inspectors/rpc_decode/Makefile \ src/service_inspectors/sip/Makefile \ diff --git a/doc/default_snort_manual.html b/doc/default_snort_manual.html index 5169ab9f8..2700f91a0 100644 --- a/doc/default_snort_manual.html +++ b/doc/default_snort_manual.html @@ -1033,9 +1033,9 @@ HTTP inspector. You can configure it by adding:

to your snort.lua configuration file. Or you can read it in the source code under src/service_inspectors/http_inspect.

-

The classic HTTP preprocessor is still available in the alpha release -under extra/src/inspectors/http_server. Be sure not to configure both old and new HTTP inspectors -at the same time.

+

The classic HTTP preprocessor is still available in the alpha release under +extra. It has been renamed http_server. Be sure not to configure both old +and new HTTP inspectors at the same time.

So why a new HTTP inspector?

For starters it is object-oriented. That’s good for us because we maintain this software. But it should also be really nice for open-source @@ -1044,20 +1044,20 @@ processing without having to understand the whole thing. In fact much of the new HTTP inspector’s knowledge of HTTP is centralized in a series of tables where it can be easily reviewed and modified. Many significant changes can be made just by updating these tables.

-

The new http_inspect is the first inspector written specifically for the new +

Http_inspect is the first inspector written specifically for the new Snort 3.0 architecture. That provides access to one of the very best -features of Snort 3.0: purely PDU-based inspection. Classic http_inspect +features of Snort 3.0: purely PDU-based inspection. The classic preprocessor processes HTTP messages, but even while doing so it is constantly aware of IP packets and how they divide up the TCP data stream. The same HTTP message might be processed differently depending on how the sender (bad guy) divided it up into IP packets.

-

The new http_inspect is free of this burden and can focus exclusively on -HTTP. That makes it much more simple, easier to test, and less prone to false +

Http_inspect is free of this burden and can focus exclusively on HTTP. +That makes it much simpler, easier to test, and less prone to false positives. It also greatly reduces the opportunity for adversaries to probe the inspector for weak spots by adjusting packet boundaries to disguise bad behavior.

Dealing solely with HTTP messages also opens the door for developing major -new features. The new http_inspect design supports true stateful +new features. The http_inspect design supports true stateful processing. Want to ask questions that involve both the client request and the server response? Or different requests in the same session? These things are possible.

@@ -1067,9 +1067,9 @@ the name, it is better to think of HTTP/2 not as a newer version of HTTP/1.1, but rather a separate protocol layer that runs under HTTP/1.1 and on top of TLS or TCP. It’s a perfect fit for the new Snort 3.0 architecture because a new HTTP/2 inspector would naturally output HTTP/1.1 messages but -not any underlying packets. Exactly what the new http_inspect wants to input.

-

The new http_inspect is taking a very different approach to HTTP header fields. -Classic http_inspect divides all the HTTP headers following the start line +not any underlying packets. Exactly what http_inspect wants to input.

+

Http_inspect is taking a very different approach to HTTP header fields. +The classic preprocessor divides all the HTTP headers following the start line into cookies and everything else. It normalizes the two pieces using a generic process and puts them in buffers that one can write rules against. There is some limited support for examining individual headers within the @@ -1081,7 +1081,9 @@ normalization means put that date in a standard format.

Binder and Wizard

-

One of the fundamental differences between Snort and Snort++ concerns configuration related to networks and ports. Here is a brief review of Snort’s configuration for network and service related components:

+

One of the fundamental differences between Snort and Snort++ concerns configuration +related to networks and ports. Here is a brief review of Snort’s configuration for +network and service related components:

  • @@ -2476,7 +2478,7 @@ bool daq.no_promisc = false: whether to put DAQ device into pro

  • -116:468 (decode) too many protocols present +116:472 (decode) too many protocols present

@@ -3656,6 +3658,11 @@ bit_list side_channel.ports: side channel message port list { 6 string side_channel.connectors[].connector: connector handle

+
  • +

    +string side_channel.connector: connector handle +

    +

    • Peg counts:

    @@ -4390,6 +4397,34 @@ protocol decoding, anomaly detection, and construction of active responses.

    <
    +

    ciscometadata

    +

    What: support for cisco metadata

    +

    Type: codec

    +

    Rules:

    +
      +
    • +

      +116:468 (ciscometadata) truncated Cisco Metadata header +

      +
      • +
    • +

      +116:469 (ciscometadata) invalid Cisco Metadata option length +

      +
      • +
    • +

      +116:470 (ciscometadata) invalid Cisco Metadata option type +

      +
      • +
    • +

      +116:471 (ciscometadata) invalid Cisco Metadata SGT +

      +
      • +
    +
    +

    erspan2

    What: support for encapsulated remote switched port analyzer - type 2

    Type: codec

    @@ -5508,6 +5543,11 @@ string appid.thirdparty_appid_dir: directory to load thirdparty

  • +appid.rsync_flows: count of rsync service flows discovered by appid +

    +
    • +
  • +

    appid.smtp_flows: count of smtp flows discovered by appid

    • @@ -6940,6 +6980,11 @@ bool http_inspect.unzip = true: decompress gzip and deflate mes

  • +bool http_inspect.normalize_utf = true: normalize charset utf encodings +

    +
    • +
  • +

    bit_list http_inspect.bad_characters: alert when any of specified bytes are present in URI after percent decoding { 255 }

    • @@ -7401,6 +7446,21 @@ bool http_inspect.show_pegs = true: display peg counts with tes 119:75 (http_inspect) Misformatted HTTP traffic

    +
  • +

    +119:76 (http_inspect) Unsupported Transfer-Encoding or Content-Encoding used +

    +
    • +
  • +

    +119:77 (http_inspect) Unknown Transfer-Encoding or Content-Encoding used +

    +
    • +
  • +

    +119:78 (http_inspect) Multiple layers of compression encodings applied +

    +

    • Peg counts:

      @@ -12178,17 +12238,17 @@ int rev.~: revision { 1: }

      • -string rpc.~app: application number +int rpc.~app: application number

      • -string rpc.~ver: version number or * for any +int rpc.ver: version number or * for any

      • -string rpc.~proc: procedure number or * for any +int rpc.proc: procedure number or * for any

      @@ -12723,6 +12783,29 @@ enum alert_full.units = B: limit is in bytes | KB | MB | GB { B
    +

    alert_sfsocket

    +

    What: output event over socket

    +

    Type: logger

    +

    Configuration:

    +
      +
    • +

      +string alert_sfsocket.file: name of unix socket file +

      +
      • +
    • +

      +int alert_sfsocket.rules[].gid = 1: rule generator ID { 1: } +

      +
      • +
    • +

      +int alert_sfsocket.rules[].sid = 1: rule signature ID { 1: } +

      +
      • +
    +
    +

    alert_syslog

    What: output event to syslog

    Type: logger

    @@ -17046,6 +17129,16 @@ libraries see the Getting Started section of the manual.

  • +-A <mode> set alert mode: none, cmg, or alert_* +

    +
    • +
  • +

    +-B <mask> obfuscated IP addresses in alerts and packet dumps using CIDR mask +

    +
    • +
  • +

    --bpf <filter options> are standard BPF options, as seen in TCPDump

    • @@ -17061,12 +17154,17 @@ libraries see the Getting Started section of the manual.

  • ---create-pidfile create PID file, even when not in Daemon mode +-c <conf> use this configuration

  • ---daq <type> select packet acquisition module (default is pcap) +-C print out payloads with character data only (no hex) +

    +
    • +
  • +

    +--create-pidfile create PID file, even when not in Daemon mode

  • @@ -17081,16 +17179,31 @@ libraries see the Getting Started section of the manual.

  • +--daq <type> select packet acquisition module (default is pcap) +

    +
    • +
  • +

    --daq-var <name=value> specify extra DAQ configuration variable

  • +-d dump the Application Layer +

    +
    • +
  • +

    --dirty-pig don’t flush packets on shutdown

  • +-D run Snort in background (daemon) mode +

    +
    • +
  • +

    --dump-builtin-rules [<module prefix>] output stub rules for selected modules

    • @@ -17111,12 +17224,27 @@ libraries see the Getting Started section of the manual.

  • +-e display the second layer header info +

    +
    • +
  • +

    --enable-inline-test enable Inline-Test Mode Operation

  • ---help list command line options +-f turn off fflush() calls after binary log writes +

    +
    • +
  • +

    +-G <0xid> (same as --logid) (0:65535) +

    +
    • +
  • +

    +-g <gname> run snort gid as <gname> group (or gid) after initialization

  • @@ -17136,6 +17264,11 @@ libraries see the Getting Started section of the manual.

  • +--help list command line options +

    +
    • +
  • +

    --help-module <module> output description of given module

    • @@ -17161,6 +17294,11 @@ libraries see the Getting Started section of the manual.

  • +-H make hash tables deterministic +

    +
    • +
  • +

    --id-subdir create/use instance subdirectories in logdir instead of instance filename prefix

    • @@ -17171,6 +17309,21 @@ libraries see the Getting Started section of the manual.

  • +-i <iface>… list of interfaces +

    +
    • +
  • +

    +-j <port> to listen for telnet connections +

    +
    • +
  • +

    +-k <mode> checksum mode; default is all (all|noip|notcp|noudp|noicmp|none) +

    +
    • +
  • +

    --list-buffers output available inspection buffers

    • @@ -17196,6 +17349,16 @@ libraries see the Getting Started section of the manual.

  • +-l <logdir> log to this directory instead of current directory +

    +
    • +
  • +

    +-L <mode> logging mode (none, dump, pcap, or log_*) +

    +
    • +
  • +

    --logid <0xid> log Identifier to uniquely id events for multiple snorts (same as -G) (0:65535)

    • @@ -17216,6 +17379,21 @@ libraries see the Getting Started section of the manual.

  • +-M log messages to syslog (not alerts) +

    +
    • +
  • +

    +-m <umask> set umask = <umask> (0:) +

    +
    • +
  • +

    +-n <count> stop after count packets (0:) +

    +
    • +
  • +

    --nolock-pidfile do not try to lock Snort PID file

    • @@ -17226,6 +17404,16 @@ libraries see the Getting Started section of the manual.

  • +-O obfuscate the logged IP addresses +

    +
    • +
  • +

    +-? <option prefix> output matching command line option quick help (same as --help-options) (optional) +

    +
    • +
  • +

    --pause wait for resume/quit command before processing packets/terminating

    • @@ -17291,6 +17479,26 @@ libraries see the Getting Started section of the manual.

  • +-Q enable inline mode operation +

    +
    • +
  • +

    +-q quiet mode - Don’t show banner and status report +

    +
    • +
  • +

    +-r <pcap>… (same as --pcap-list) +

    +
    • +
  • +

    +-R <rules> include this rules file in the default policy +

    +
    • +
  • +

    --rule <rules> to be added to configuration; may be repeated

    • @@ -17336,277 +17544,152 @@ libraries see the Getting Started section of the manual.

  • ---stdin-rules read rules from stdin until EOF or a line starting with END is read +-s <snap> (same as --snaplen); default is 1514 (68:65535)

  • ---treat-drop-as-alert converts drop, sdrop, and reject rules into alert rules during startup +--stdin-rules read rules from stdin until EOF or a line starting with END is read

  • ---treat-drop-as-ignore use drop, sdrop, and reject rules to ignore session traffic when not inline +-S <x=v> set config variable x equal to value v

  • ---version show version number (same as -V) +-t <dir> chroots process to <dir> after initialization

  • ---warn-all enable all warnings +--treat-drop-as-alert converts drop, sdrop, and reject rules into alert rules during startup

  • ---warn-conf warn about configuration issues +--treat-drop-as-ignore use drop, sdrop, and reject rules to ignore session traffic when not inline

  • ---warn-daq warn about DAQ issues, usually related to mode +-T test and report on the current Snort configuration

  • ---warn-flowbits warn about flowbits that are checked but not set and vice-versa +-u <uname> run snort as <uname> or <uid> after initialization

  • ---warn-hosts warn about host table issues +-U use UTC for timestamps

  • ---warn-plugins warn about issues that prevent plugins from loading +-v be verbose

  • ---warn-rules warn about duplicate rules and rule parsing issues +--version show version number (same as -V)

  • ---warn-scripts warn about issues discovered while processing Lua scripts +-V (same as --version)

  • ---warn-symbols warn about unknown symbols in your Lua config +--warn-all enable all warnings

  • ---warn-vars warn about variable definition and usage issues +--warn-conf warn about configuration issues

  • ---x2c output ASCII char for given hex (see also --c2x) +--warn-daq warn about DAQ issues, usually related to mode

  • ---x2s output ASCII string for given byte code (see also --x2c) +--warn-flowbits warn about flowbits that are checked but not set and vice-versa

  • --? <option prefix> output matching command line option quick help (same as --help-options) (optional) +--warn-hosts warn about host table issues

  • --A <mode> set alert mode: none, cmg, or alert_* +--warn-plugins warn about issues that prevent plugins from loading

  • --B <mask> obfuscated IP addresses in alerts and packet dumps using CIDR mask +--warn-rules warn about duplicate rules and rule parsing issues

  • --C print out payloads with character data only (no hex) +--warn-scripts warn about issues discovered while processing Lua scripts

  • --D run Snort in background (daemon) mode +--warn-symbols warn about unknown symbols in your Lua config

  • --G <0xid> (same as --logid) (0:65535) +--warn-vars warn about variable definition and usage issues

  • --H make hash tables deterministic +-w dump 802.11 management and control frames

  • --L <mode> logging mode (none, dump, pcap, or log_*) +-W lists available interfaces

  • --M log messages to syslog (not alerts) +--x2c output ASCII char for given hex (see also --c2x)

  • --O obfuscate the logged IP addresses +--x2s output ASCII string for given byte code (see also --x2c)

  • --Q enable inline mode operation +-X dump the raw packet data starting at the link layer

  • --R <rules> include this rules file in the default policy +-x same as --pedantic

  • --S <x=v> set config variable x equal to value v +-y include year in timestamp in the alert and log files

  • --T test and report on the current Snort configuration -

    -
    • -
  • -

    --U use UTC for timestamps -

    -
    • -
  • -

    --V (same as --version) -

    -
    • -
  • -

    --W lists available interfaces -

    -
    • -
  • -

    --X dump the raw packet data starting at the link layer -

    -
    • -
  • -

    --c <conf> use this configuration -

    -
    • -
  • -

    --d dump the Application Layer -

    -
    • -
  • -

    --e display the second layer header info -

    -
    • -
  • -

    --f turn off fflush() calls after binary log writes -

    -
    • -
  • -

    --g <gname> run snort gid as <gname> group (or gid) after initialization -

    -
    • -
  • -

    --i <iface>… list of interfaces -

    -
    • -
  • -

    --j <port> to listen for telnet connections -

    -
    • -
  • -

    --k <mode> checksum mode; default is all (all|noip|notcp|noudp|noicmp|none) -

    -
    • -
  • -

    --l <logdir> log to this directory instead of current directory -

    -
    • -
  • -

    --m <umask> set umask = <umask> (0:) -

    -
    • -
  • -

    --n <count> stop after count packets (0:) -

    -
    • -
  • -

    --q quiet mode - Don’t show banner and status report -

    -
    • -
  • -

    --r <pcap>… (same as --pcap-list) -

    -
    • -
  • -

    --s <snap> (same as --snaplen); default is 1514 (68:65535) -

    -
    • -
  • -

    --t <dir> chroots process to <dir> after initialization -

    -
    • -
  • -

    --u <uname> run snort as <uname> or <uid> after initialization -

    -
    • -
  • -

    --v be verbose -

    -
    • -
  • -

    --w dump 802.11 management and control frames -

    -
    • -
  • -

    --x same as --pedantic -

    -
    • -
  • -

    --y include year in timestamp in the alert and log files -

    -
    • -
  • -

    --z <count> maximum number of packet threads (same as --max-packet-threads); 0 gets the number of CPU cores reported by the system; default is 1 (0:) +-z <count> maximum number of packet threads (same as --max-packet-threads); 0 gets the number of CPU cores reported by the system; default is 1 (0:)

    • @@ -17852,37 +17935,37 @@ enum alert_full.units = B: limit is in bytes | KB | MB | GB { B

  • -enum alert_syslog.facility = auth: part of priority applied to each message { auth | authpriv | daemon | user | local0 | local1 | local2 | local3 | local4 | local5 | local6 | local7 } +bool alerts.alert_with_interface_name = false: include interface in alert info (fast, full, or syslog only)

  • -enum alert_syslog.level = info: part of priority applied to each message { emerg | alert | crit | err | warning | notice | info | debug } +bool alerts.default_rule_state = true: enable or disable ips rules

  • -multi alert_syslog.options: used to open the syslog connection { cons | ndelay | perror | pid } +int alerts.detection_filter_memcap = 1048576: set available memory for filters { 0: }

  • -bool alerts.alert_with_interface_name = false: include interface in alert info (fast, full, or syslog only) +int alerts.event_filter_memcap = 1048576: set available memory for filters { 0: }

  • -bool alerts.default_rule_state = true: enable or disable ips rules +string alert_sfsocket.file: name of unix socket file

  • -int alerts.detection_filter_memcap = 1048576: set available memory for filters { 0: } +int alert_sfsocket.rules[].gid = 1: rule generator ID { 1: }

  • -int alerts.event_filter_memcap = 1048576: set available memory for filters { 0: } +int alert_sfsocket.rules[].sid = 1: rule signature ID { 1: }

  • @@ -17912,6 +17995,21 @@ string alerts.tunnel_verdicts: let DAQ handle non-allow verdict

  • +enum alert_syslog.facility = auth: part of priority applied to each message { auth | authpriv | daemon | user | local0 | local1 | local2 | local3 | local4 | local5 | local6 | local7 } +

    +
    • +
  • +

    +enum alert_syslog.level = info: part of priority applied to each message { emerg | alert | crit | err | warning | notice | info | debug } +

    +
    • +
  • +

    +multi alert_syslog.options: used to open the syslog connection { cons | ndelay | perror | pid } +

    +
    • +
  • +

    string appid.app_detector_dir: directory to load AppId detectors from

    • @@ -17962,12 +18060,12 @@ int appid.memcap = 268435456: time period for collecting and lo

  • -string appid.thirdparty_appid_dir: directory to load thirdparty AppId detectors from +string appids.~: appid option

  • -string appids.~: appid option +string appid.thirdparty_appid_dir: directory to load thirdparty AppId detectors from

  • @@ -18122,6 +18220,11 @@ implied byte_extract.big: big endian

  • +int byte_extract.~count: number of bytes to pick up from the buffer { 1:10 } +

    +
    • +
  • +

    implied byte_extract.dce: dcerpc2 determines endianness

    • @@ -18147,42 +18250,42 @@ int byte_extract.multiplier = 1: scale extracted value by given

  • -implied byte_extract.oct: convert from octal string +string byte_extract.~name: name of the variable that will be used in other rule options

  • -implied byte_extract.relative: offset from cursor instead of start of buffer +implied byte_extract.oct: convert from octal string

  • -implied byte_extract.string: convert from string +int byte_extract.~offset: number of bytes into the buffer to start processing { -65535:65535 }

  • -int byte_extract.~count: number of bytes to pick up from the buffer { 1:10 } +implied byte_extract.relative: offset from cursor instead of start of buffer

  • -string byte_extract.~name: name of the variable that will be used in other rule options +implied byte_extract.string: convert from string

  • -int byte_extract.~offset: number of bytes into the buffer to start processing { -65535:65535 } +int byte_jump.align = 0: round the number of converted bytes up to the next 2- or 4-byte boundary { 0:4 }

  • -int byte_jump.align = 0: round the number of converted bytes up to the next 2- or 4-byte boundary { 0:4 } +implied byte_jump.big: big endian

  • -implied byte_jump.big: big endian +int byte_jump.~count: number of bytes to pick up from the buffer { 1:10 }

  • @@ -18222,6 +18325,11 @@ implied byte_jump.oct: convert from octal string

  • +string byte_jump.~offset: variable name or number of bytes into the buffer to start processing +

    +
    • +
  • +

    int byte_jump.post_offset = 0: also skip forward or backwards (positive of negative value) this number of bytes { -65535:65535 }

    • @@ -18237,17 +18345,17 @@ implied byte_jump.string: convert from string

  • -int byte_jump.~count: number of bytes to pick up from the buffer { 1:10 } +implied byte_test.big: big endian

  • -string byte_jump.~offset: variable name or number of bytes into the buffer to start processing +string byte_test.~compare: variable name or value to test the converted result against

  • -implied byte_test.big: big endian +int byte_test.~count: number of bytes to pick up from the buffer { 1:10 }

  • @@ -18277,32 +18385,22 @@ implied byte_test.oct: convert from octal string

  • -implied byte_test.relative: offset from cursor instead of start of buffer -

    -
    • -
  • -

    -implied byte_test.string: convert from string -

    -
    • -
  • -

    -string byte_test.~compare: variable name or value to test the converted result against +string byte_test.~offset: variable name or number of bytes into the payload to start processing

  • -int byte_test.~count: number of bytes to pick up from the buffer { 1:10 } +string byte_test.~operator: variable name or number of bytes into the buffer to start processing

  • -string byte_test.~offset: variable name or number of bytes into the payload to start processing +implied byte_test.relative: offset from cursor instead of start of buffer

  • -string byte_test.~operator: variable name or number of bytes into the buffer to start processing +implied byte_test.string: convert from string

  • @@ -18327,17 +18425,17 @@ string classtype.~: classification for this rule

  • -string content.depth: var or maximum number of bytes to search from beginning of buffer +string content.~data: data to match

  • -string content.distance: var or number of bytes from cursor to start search +string content.depth: var or maximum number of bytes to search from beginning of buffer

  • -implied content.fast_pattern: use this content in the fast pattern matcher instead of the content selected by default +string content.distance: var or number of bytes from cursor to start search

  • @@ -18352,22 +18450,22 @@ int content.fast_pattern_offset = 0: number of leading characte

  • -implied content.nocase: case insensitive match +implied content.fast_pattern: use this content in the fast pattern matcher instead of the content selected by default

  • -string content.offset: var or number of bytes from start of buffer to start search +implied content.nocase: case insensitive match

  • -string content.within: var or maximum number of bytes to search from cursor +string content.offset: var or number of bytes from start of buffer to start search

  • -string content.~data: data to match +string content.within: var or maximum number of bytes to search from cursor

  • @@ -18522,32 +18620,32 @@ int detection.asn1 = 256: maximum decode nodes { 1: }

  • -bool detection.pcre_enable = true: disable pcre pattern matching +int detection_filter.count: hits in interval before allowing the rule to fire { 1: }

  • -int detection.pcre_match_limit = 1500: limit pcre backtracking, -1 = max, 0 = off { -1:1000000 } +int detection_filter.seconds: length of interval to count hits { 1: }

  • -int detection.pcre_match_limit_recursion = 1500: limit pcre stack consumption, -1 = max, 0 = off { -1:10000 } +enum detection_filter.track: track hits by source or destination IP address { by_src | by_dst }

  • -int detection_filter.count: hits in interval before allowing the rule to fire { 1: } +bool detection.pcre_enable = true: disable pcre pattern matching

  • -int detection_filter.seconds: length of interval to count hits { 1: } +int detection.pcre_match_limit = 1500: limit pcre backtracking, -1 = max, 0 = off { -1:1000000 }

  • -enum detection_filter.track: track hits by source or destination IP address { by_src | by_dst } +int detection.pcre_match_limit_recursion = 1500: limit pcre stack consumption, -1 = max, 0 = off { -1:10000 }

  • @@ -18837,6 +18935,21 @@ string flags.~test_flags: these flags are tested

  • +string flowbits.~arg1: bits or group +

    +
    • +
  • +

    +string flowbits.~arg2: group if arg1 is bits +

    +
    • +
  • +

    +string flowbits.~command: set|reset|isset|etc. +

    +
    • +
  • +

    implied flow.established: match only during data transfer phase

    • @@ -18892,42 +19005,27 @@ implied flow.to_server: match on client requests

  • -string flowbits.~arg1: bits or group +string fragbits.~flags: these flags are tested

  • -string flowbits.~arg2: group if arg1 is bits +string fragoffset.~range: check if ip fragment offset value is value | min<>max | <max | >min

  • -string flowbits.~command: set|reset|isset|etc. +bool ftp_client.bounce = false: check for bounces

  • -string fragbits.~flags: these flags are tested +addr ftp_client.bounce_to[].address = 1.0.0.0/32: allowed ip address in CIDR format

  • -string fragoffset.~range: check if ip fragment offset value is value | min<>max | <max | >min -

    -
    • -
  • -

    -bool ftp_client.bounce = false: check for bounces -

    -
    • -
  • -

    -addr ftp_client.bounce_to[].address = 1.0.0.0/32: allowed ip address in CIDR format -

    -
    • -
  • -

    -port ftp_client.bounce_to[].last_port: optional allowed range from port to last_port inclusive { 0: } +port ftp_client.bounce_to[].last_port: optional allowed range from port to last_port inclusive { 0: }

  • @@ -19132,62 +19230,62 @@ int host_cache[].size: size of host cache

  • -enum host_tracker[].frag_policy: defragmentation policy { first | linux | bsd | bsd_right | last | windows | solaris } +enum hosts[].frag_policy: defragmentation policy { first | linux | bsd | bsd_right | last | windows | solaris }

  • -addr host_tracker[].ip = 0.0.0.0/32: hosts address / cidr +addr hosts[].ip = 0.0.0.0/32: hosts address / cidr

  • -string host_tracker[].services[].name: service identifier +string hosts[].services[].name: service identifier

  • -port host_tracker[].services[].port: port number +port hosts[].services[].port: port number

  • -enum host_tracker[].services[].proto = tcp: ip protocol { tcp | udp } +enum hosts[].services[].proto = tcp: ip protocol { tcp | udp }

  • -enum host_tracker[].tcp_policy: tcp reassembly policy { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy } +enum hosts[].tcp_policy: tcp reassembly policy { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy }

  • -enum hosts[].frag_policy: defragmentation policy { first | linux | bsd | bsd_right | last | windows | solaris } +enum host_tracker[].frag_policy: defragmentation policy { first | linux | bsd | bsd_right | last | windows | solaris }

  • -addr hosts[].ip = 0.0.0.0/32: hosts address / cidr +addr host_tracker[].ip = 0.0.0.0/32: hosts address / cidr

  • -string hosts[].services[].name: service identifier +string host_tracker[].services[].name: service identifier

  • -port hosts[].services[].port: port number +port host_tracker[].services[].port: port number

  • -enum hosts[].services[].proto = tcp: ip protocol { tcp | udp } +enum host_tracker[].services[].proto = tcp: ip protocol { tcp | udp }

  • -enum hosts[].tcp_policy: tcp reassembly policy { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy } +enum host_tracker[].tcp_policy: tcp reassembly policy { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy }

  • @@ -19247,12 +19345,12 @@ bool http_inspect.iis_double_decode = false: perform double dec

  • -bool http_inspect.iis_unicode = false: use IIS unicode code point mapping to normalize characters +int http_inspect.iis_unicode_code_page = 1252: code page to use from the IIS unicode map file { 0:65535 }

  • -int http_inspect.iis_unicode_code_page = 1252: code page to use from the IIS unicode map file { 0:65535 } +bool http_inspect.iis_unicode = false: use IIS unicode code point mapping to normalize characters

  • @@ -19262,6 +19360,11 @@ string http_inspect.iis_unicode_map_file: file containing code

  • +bool http_inspect.normalize_utf = true: normalize charset utf encodings +

    +
    • +
  • +

    int http_inspect.oversize_dir_length = 300: maximum length for URL directory { 1:65535 }

    • @@ -19322,12 +19425,12 @@ bool http_inspect.unzip = true: decompress gzip and deflate mes

  • -bool http_inspect.utf8 = true: normalize 2-byte and 3-byte UTF-8 characters to a single byte +bool http_inspect.utf8_bare_byte = false: when doing UTF-8 character normalization include bytes that were not percent encoded

  • -bool http_inspect.utf8_bare_byte = false: when doing UTF-8 character normalization include bytes that were not percent encoded +bool http_inspect.utf8 = true: normalize 2-byte and 3-byte UTF-8 characters to a single byte

  • @@ -19582,12 +19685,12 @@ int imap.uu_decode_depth = 1460: Unix-to-Unix decoding depth {

  • -string ip_proto.~proto: [!|>|<] name or number +select ipopts.~opt: output format { rr|eol|nop|ts|sec|esec|lsrr|lsrre|ssrr|satid|any }

  • -select ipopts.~opt: output format { rr|eol|nop|ts|sec|esec|lsrr|lsrre|ssrr|satid|any } +string ip_proto.~proto: [!|>|<] name or number

  • @@ -19617,12 +19720,12 @@ string ips.rules: snort rules and includes

  • -implied isdataat.relative: offset from cursor instead of start of buffer +string isdataat.~length: num | !num

  • -string isdataat.~length: num | !num +implied isdataat.relative: offset from cursor instead of start of buffer

  • @@ -19717,22 +19820,22 @@ enum log_pcap.units = B: bytes | KB | MB | GB { B | K | M | G }

  • -int md5.length: number of octets in plain text { 1:65535 } +string md5.~hash: data to match

  • -string md5.offset: var or number of bytes from start of buffer to start search +int md5.length: number of octets in plain text { 1:65535 }

  • -implied md5.relative = false: offset from cursor instead of start of buffer +string md5.offset: var or number of bytes from start of buffer to start search

  • -string md5.~hash: data to match +implied md5.relative = false: offset from cursor instead of start of buffer

  • @@ -19992,12 +20095,12 @@ int output.event_trace.max_data = 0: maximum amount of packet d

  • -bool output.log_ipv6_extra_data = false: log IPv6 source and destination addresses as unified2 extra data records +string output.logdir = .: where to put log files (same as -l)

  • -string output.logdir = .: where to put log files (same as -l) +bool output.log_ipv6_extra_data = false: log IPv6 source and destination addresses as unified2 extra data records

  • @@ -20162,6 +20265,11 @@ int pop.uu_decode_depth = 1460: Unix-to-Unix decoding depth {

  • +int port_scan_global.memcap = 1048576: maximum tracker memory { 1: } +

    +
    • +
  • +

    string port_scan.ignore_scanned: list of CIDRs with optional ports to ignore if the destination of scan alerts

    • @@ -20202,11 +20310,6 @@ string port_scan.watch_ip: list of CIDRs with optional ports to

  • -int port_scan_global.memcap = 1048576: maximum tracker memory { 1: } -

    -
    • -
  • -

    int priority.~: relative severity level; 1 is highest priority { 1: }

    • @@ -20397,12 +20500,12 @@ implied regex.nocase: case insensitive match

  • -implied regex.relative: start search from end of last match instead of start of buffer +string regex.~re: hyperscan regular expression

  • -string regex.~re: hyperscan regular expression +implied regex.relative: start search from end of last match instead of start of buffer

  • @@ -20452,12 +20555,12 @@ bool reputation.scan_local = false: inspect local address defin

  • -enum reputation.white = unblack: specify the meaning of whitelist { unblack|trust } +string reputation.whitelist: whitelist file name with ip lists

  • -string reputation.whitelist: whitelist file name with ip lists +enum reputation.white = unblack: specify the meaning of whitelist { unblack|trust }

  • @@ -20467,17 +20570,17 @@ int rev.~: revision { 1: }

  • -string rpc.~app: application number +int rpc.~app: application number

  • -string rpc.~proc: procedure number or * for any +int rpc.proc: procedure number or * for any

  • -string rpc.~ver: version number or * for any +int rpc.ver: version number or * for any

  • @@ -20497,12 +20600,12 @@ int rule_state.sid = 0: rule signature ID { 0: }

  • -int sd_pattern.threshold: number of matches before alerting { 1 } +string sd_pattern.~pattern: The pattern to search for

  • -string sd_pattern.~pattern: The pattern to search for +int sd_pattern.threshold: number of matches before alerting { 1 }

  • @@ -20592,6 +20695,11 @@ enum session.~mode: output format { printable|binary|all }

  • +string sha256.~hash: data to match +

    +
    • +
  • +

    int sha256.length: number of octets in plain text { 1:65535 }

    • @@ -20607,7 +20715,7 @@ implied sha256.relative = false: offset from cursor instead of

  • -string sha256.~hash: data to match +string sha512.~hash: data to match

  • @@ -20627,22 +20735,22 @@ implied sha512.relative = false: offset from cursor instead of

  • -string sha512.~hash: data to match +string side_channel.connector: connector handle

  • -int sid.~: signature id { 1: } +string side_channel.connectors[].connector: connector handle

  • -string side_channel.connectors[].connector: connector handle +bit_list side_channel.ports: side channel message port list { 65535 }

  • -bit_list side_channel.ports: side channel message port list { 65535 } +int sid.~: signature id { 1: }

  • @@ -20702,12 +20810,12 @@ int sip.max_via_len = 1024: maximum via field size { 0:65535 }

  • -string sip.methods = invite cancel ack bye register options: list of methods to check in sip messages +string sip_method.*method: sip method

  • -string sip_method.*method: sip method +string sip.methods = invite cancel ack bye register options: list of methods to check in sip messages

  • @@ -20812,12 +20920,12 @@ int smtp.max_response_line_len = 0: max SMTP response line { 0:

  • -enum smtp.normalize = none: turns on/off normalization { none | cmds | all } +string smtp.normalize_cmds: list of commands to normalize

  • -string smtp.normalize_cmds: list of commands to normalize +enum smtp.normalize = none: turns on/off normalization { none | cmds | all }

  • @@ -20847,552 +20955,552 @@ implied snort.--alert-before-pass: process alert, drop, sdrop,

  • -string snort.--bpf: <filter options> are standard BPF options, as seen in TCPDump +string snort.-A: <mode> set alert mode: none, cmg, or alert_*

  • -string snort.--c2x: output hex for given char (see also --x2c) +addr snort.-B = 255.255.255.255/32: <mask> obfuscated IP addresses in alerts and packet dumps using CIDR mask

  • -string snort.--catch-test: comma separated list of cat unit test tags or all +string snort.--bpf: <filter options> are standard BPF options, as seen in TCPDump

  • -implied snort.--create-pidfile: create PID file, even when not in Daemon mode +string snort.--c2x: output hex for given char (see also --x2c)

  • -string snort.--daq: <type> select packet acquisition module (default is pcap) +string snort.--catch-test: comma separated list of cat unit test tags or all

  • -string snort.--daq-dir: <dir> tell snort where to find desired DAQ +string snort.-c: <conf> use this configuration

  • -implied snort.--daq-list: list packet acquisition modules available in optional dir, default is static modules only +implied snort.-C: print out payloads with character data only (no hex)

  • -string snort.--daq-var: <name=value> specify extra DAQ configuration variable +implied snort.--create-pidfile: create PID file, even when not in Daemon mode

  • -implied snort.--dirty-pig: don’t flush packets on shutdown +string snort.--daq-dir: <dir> tell snort where to find desired DAQ

  • -implied snort.--dump-builtin-rules: [<module prefix>] output stub rules for selected modules +implied snort.--daq-list: list packet acquisition modules available in optional dir, default is static modules only

  • -string snort.--dump-defaults: [<module prefix>] output module defaults in Lua format { (optional) } +string snort.--daq: <type> select packet acquisition module (default is pcap)

  • -implied snort.--dump-dynamic-rules: output stub rules for all loaded rules libraries +string snort.--daq-var: <name=value> specify extra DAQ configuration variable

  • -implied snort.--dump-version: output the version, the whole version, and only the version +implied snort.-d: dump the Application Layer

  • -implied snort.--enable-inline-test: enable Inline-Test Mode Operation +implied snort.--dirty-pig: don’t flush packets on shutdown

  • -implied snort.--help: list command line options +implied snort.-D: run Snort in background (daemon) mode

  • -string snort.--help-commands: [<module prefix>] output matching commands { (optional) } +implied snort.--dump-builtin-rules: [<module prefix>] output stub rules for selected modules

  • -string snort.--help-config: [<module prefix>] output matching config options { (optional) } +string snort.--dump-defaults: [<module prefix>] output module defaults in Lua format { (optional) }

  • -string snort.--help-counts: [<module prefix>] output matching peg counts { (optional) } +implied snort.--dump-dynamic-rules: output stub rules for all loaded rules libraries

  • -string snort.--help-module: <module> output description of given module +implied snort.--dump-version: output the version, the whole version, and only the version

  • -implied snort.--help-modules: list all available modules with brief help +implied snort.-e: display the second layer header info

  • -string snort.--help-options: <option prefix> output matching command line option quick help (same as -?) { (optional) } +implied snort.--enable-inline-test: enable Inline-Test Mode Operation

  • -implied snort.--help-plugins: list all available plugins with brief help +implied snort.-f: turn off fflush() calls after binary log writes

  • -implied snort.--help-signals: dump available control signals +int snort.-G: <0xid> (same as --logid) { 0:65535 }

  • -implied snort.--id-subdir: create/use instance subdirectories in logdir instead of instance filename prefix +string snort.-g: <gname> run snort gid as <gname> group (or gid) after initialization

  • -implied snort.--id-zero: use id prefix / subdirectory even with one packet thread +string snort.--help-commands: [<module prefix>] output matching commands { (optional) }

  • -implied snort.--list-buffers: output available inspection buffers +string snort.--help-config: [<module prefix>] output matching config options { (optional) }

  • -string snort.--list-builtin: <module prefix> output matching builtin rules { (optional) } +string snort.--help-counts: [<module prefix>] output matching peg counts { (optional) }

  • -string snort.--list-gids: [<module prefix>] output matching generators { (optional) } +implied snort.--help: list command line options

  • -string snort.--list-modules: [<module type>] list all known modules of given type { (optional) } +string snort.--help-module: <module> output description of given module

  • -implied snort.--list-plugins: list all known plugins +implied snort.--help-modules: list all available modules with brief help

  • -int snort.--logid: <0xid> log Identifier to uniquely id events for multiple snorts (same as -G) { 0:65535 } +string snort.--help-options: <option prefix> output matching command line option quick help (same as -?) { (optional) }

  • -string snort.--lua: <chunk> extend/override conf with chunk; may be repeated +implied snort.--help-plugins: list all available plugins with brief help

  • -implied snort.--markup: output help in asciidoc compatible format +implied snort.--help-signals: dump available control signals

  • -int snort.--max-packet-threads = 1: <count> configure maximum number of packet threads (same as -z) { 0: } +implied snort.-H: make hash tables deterministic

  • -implied snort.--nolock-pidfile: do not try to lock Snort PID file +implied snort.--id-subdir: create/use instance subdirectories in logdir instead of instance filename prefix

  • -implied snort.--nostamps: don’t include timestamps in log file names +implied snort.--id-zero: use id prefix / subdirectory even with one packet thread

  • -implied snort.--pause: wait for resume/quit command before processing packets/terminating +string snort.-i: <iface>… list of interfaces

  • -string snort.--pcap-dir: <dir> a directory to recurse to look for pcaps - read mode is implied +port snort.-j: <port> to listen for telnet connections

  • -string snort.--pcap-file: <file> file that contains a list of pcaps to read - read mode is implied +enum snort.-k = all: <mode> checksum mode; default is all { all|noip|notcp|noudp|noicmp|none }

  • -string snort.--pcap-filter: <filter> filter to apply when getting pcaps from file or directory +implied snort.--list-buffers: output available inspection buffers

  • -string snort.--pcap-list: <list> a space separated list of pcaps to read - read mode is implied +string snort.--list-builtin: <module prefix> output matching builtin rules { (optional) }

  • -int snort.--pcap-loop: <count> read all pcaps <count> times; 0 will read until Snort is terminated { -1: } +string snort.--list-gids: [<module prefix>] output matching generators { (optional) }

  • -implied snort.--pcap-no-filter: reset to use no filter when getting pcaps from file or directory +string snort.--list-modules: [<module type>] list all known modules of given type { (optional) }

  • -implied snort.--pcap-reload: if reading multiple pcaps, reload snort config between pcaps +implied snort.--list-plugins: list all known plugins

  • -implied snort.--pcap-show: print a line saying what pcap is currently being read +string snort.-l: <logdir> log to this directory instead of current directory

  • -implied snort.--pedantic: warnings are fatal +string snort.-L: <mode> logging mode (none, dump, pcap, or log_*)

  • -implied snort.--piglet: enable piglet test harness mode +int snort.--logid: <0xid> log Identifier to uniquely id events for multiple snorts (same as -G) { 0:65535 }

  • -string snort.--plugin-path: <path> where to find plugins +string snort.--lua: <chunk> extend/override conf with chunk; may be repeated

  • -implied snort.--process-all-events: process all action groups +implied snort.--markup: output help in asciidoc compatible format

  • -string snort.--rule: <rules> to be added to configuration; may be repeated +int snort.--max-packet-threads = 1: <count> configure maximum number of packet threads (same as -z) { 0: }

  • -implied snort.--rule-to-hex: output so rule header to stdout for text rule on stdin +implied snort.-M: log messages to syslog (not alerts)

  • -implied snort.--rule-to-text: output plain so rule header to stdout for text rule on stdin +int snort.-m: <umask> set umask = <umask> { 0: }

  • -string snort.--run-prefix: <pfx> prepend this to each output file +int snort.-n: <count> stop after count packets { 0: }

  • -string snort.--script-path: <path> to a luajit script or directory containing luajit scripts +implied snort.--nolock-pidfile: do not try to lock Snort PID file

  • -implied snort.--shell: enable the interactive command line +implied snort.--nostamps: don’t include timestamps in log file names

  • -implied snort.--show-plugins: list module and plugin versions +implied snort.-O: obfuscate the logged IP addresses

  • -int snort.--skip: <n> skip 1st n packets { 0: } +string snort.-?: <option prefix> output matching command line option quick help (same as --help-options) { (optional) }

  • -int snort.--snaplen = 1514: <snap> set snaplen of packet (same as -s) { 68:65535 } +implied snort.--pause: wait for resume/quit command before processing packets/terminating

  • -implied snort.--stdin-rules: read rules from stdin until EOF or a line starting with END is read +string snort.--pcap-dir: <dir> a directory to recurse to look for pcaps - read mode is implied

  • -implied snort.--treat-drop-as-alert: converts drop, sdrop, and reject rules into alert rules during startup +string snort.--pcap-file: <file> file that contains a list of pcaps to read - read mode is implied

  • -implied snort.--treat-drop-as-ignore: use drop, sdrop, and reject rules to ignore session traffic when not inline +string snort.--pcap-filter: <filter> filter to apply when getting pcaps from file or directory

  • -implied snort.--version: show version number (same as -V) +string snort.--pcap-list: <list> a space separated list of pcaps to read - read mode is implied

  • -implied snort.--warn-all: enable all warnings +int snort.--pcap-loop: <count> read all pcaps <count> times; 0 will read until Snort is terminated { -1: }

  • -implied snort.--warn-conf: warn about configuration issues +implied snort.--pcap-no-filter: reset to use no filter when getting pcaps from file or directory

  • -implied snort.--warn-daq: warn about DAQ issues, usually related to mode +implied snort.--pcap-reload: if reading multiple pcaps, reload snort config between pcaps

  • -implied snort.--warn-flowbits: warn about flowbits that are checked but not set and vice-versa +implied snort.--pcap-show: print a line saying what pcap is currently being read

  • -implied snort.--warn-hosts: warn about host table issues +implied snort.--pedantic: warnings are fatal

  • -implied snort.--warn-plugins: warn about issues that prevent plugins from loading +implied snort.--piglet: enable piglet test harness mode

  • -implied snort.--warn-rules: warn about duplicate rules and rule parsing issues +string snort.--plugin-path: <path> where to find plugins

  • -implied snort.--warn-scripts: warn about issues discovered while processing Lua scripts +implied snort.--process-all-events: process all action groups

  • -implied snort.--warn-symbols: warn about unknown symbols in your Lua config +implied snort.-Q: enable inline mode operation

  • -implied snort.--warn-vars: warn about variable definition and usage issues +implied snort.-q: quiet mode - Don’t show banner and status report

  • -int snort.--x2c: output ASCII char for given hex (see also --c2x) +string snort.-r: <pcap>… (same as --pcap-list)

  • -string snort.--x2s: output ASCII string for given byte code (see also --x2c) +string snort.-R: <rules> include this rules file in the default policy

  • -string snort.-?: <option prefix> output matching command line option quick help (same as --help-options) { (optional) } +string snort.--rule: <rules> to be added to configuration; may be repeated

  • -string snort.-A: <mode> set alert mode: none, cmg, or alert_* +implied snort.--rule-to-hex: output so rule header to stdout for text rule on stdin

  • -addr snort.-B = 255.255.255.255/32: <mask> obfuscated IP addresses in alerts and packet dumps using CIDR mask +implied snort.--rule-to-text: output plain so rule header to stdout for text rule on stdin

  • -implied snort.-C: print out payloads with character data only (no hex) +string snort.--run-prefix: <pfx> prepend this to each output file

  • -implied snort.-D: run Snort in background (daemon) mode +int snort.-s = 1514: <snap> (same as --snaplen); default is 1514 { 68:65535 }

  • -int snort.-G: <0xid> (same as --logid) { 0:65535 } +string snort.--script-path: <path> to a luajit script or directory containing luajit scripts

  • -implied snort.-H: make hash tables deterministic +implied snort.--shell: enable the interactive command line

  • -string snort.-L: <mode> logging mode (none, dump, pcap, or log_*) +implied snort.--show-plugins: list module and plugin versions

  • -implied snort.-M: log messages to syslog (not alerts) +int snort.--skip: <n> skip 1st n packets { 0: }

  • -implied snort.-O: obfuscate the logged IP addresses +int snort.--snaplen = 1514: <snap> set snaplen of packet (same as -s) { 68:65535 }

  • -implied snort.-Q: enable inline mode operation +implied snort.--stdin-rules: read rules from stdin until EOF or a line starting with END is read

  • -string snort.-R: <rules> include this rules file in the default policy +string snort.-S: <x=v> set config variable x equal to value v

  • -string snort.-S: <x=v> set config variable x equal to value v +string snort.-t: <dir> chroots process to <dir> after initialization

  • -implied snort.-T: test and report on the current Snort configuration +implied snort.--treat-drop-as-alert: converts drop, sdrop, and reject rules into alert rules during startup

  • -implied snort.-U: use UTC for timestamps +implied snort.--treat-drop-as-ignore: use drop, sdrop, and reject rules to ignore session traffic when not inline

  • -implied snort.-V: (same as --version) +implied snort.-T: test and report on the current Snort configuration

  • -implied snort.-W: lists available interfaces +string snort.-u: <uname> run snort as <uname> or <uid> after initialization

  • -implied snort.-X: dump the raw packet data starting at the link layer +implied snort.-U: use UTC for timestamps

  • -string snort.-c: <conf> use this configuration +implied snort.-v: be verbose

  • -implied snort.-d: dump the Application Layer +implied snort.--version: show version number (same as -V)

  • -implied snort.-e: display the second layer header info +implied snort.-V: (same as --version)

  • -implied snort.-f: turn off fflush() calls after binary log writes +implied snort.--warn-all: enable all warnings

  • -string snort.-g: <gname> run snort gid as <gname> group (or gid) after initialization +implied snort.--warn-conf: warn about configuration issues

  • -string snort.-i: <iface>… list of interfaces +implied snort.--warn-daq: warn about DAQ issues, usually related to mode

  • -port snort.-j: <port> to listen for telnet connections +implied snort.--warn-flowbits: warn about flowbits that are checked but not set and vice-versa

  • -enum snort.-k = all: <mode> checksum mode; default is all { all|noip|notcp|noudp|noicmp|none } +implied snort.--warn-hosts: warn about host table issues

  • -string snort.-l: <logdir> log to this directory instead of current directory +implied snort.--warn-plugins: warn about issues that prevent plugins from loading

  • -int snort.-m: <umask> set umask = <umask> { 0: } +implied snort.--warn-rules: warn about duplicate rules and rule parsing issues

  • -int snort.-n: <count> stop after count packets { 0: } +implied snort.--warn-scripts: warn about issues discovered while processing Lua scripts

  • -implied snort.-q: quiet mode - Don’t show banner and status report +implied snort.--warn-symbols: warn about unknown symbols in your Lua config

  • -string snort.-r: <pcap>… (same as --pcap-list) +implied snort.--warn-vars: warn about variable definition and usage issues

  • -int snort.-s = 1514: <snap> (same as --snaplen); default is 1514 { 68:65535 } +implied snort.-w: dump 802.11 management and control frames

  • -string snort.-t: <dir> chroots process to <dir> after initialization +implied snort.-W: lists available interfaces

  • -string snort.-u: <uname> run snort as <uname> or <uid> after initialization +int snort.--x2c: output ASCII char for given hex (see also --c2x)

  • -implied snort.-v: be verbose +string snort.--x2s: output ASCII string for given byte code (see also --x2c)

  • -implied snort.-w: dump 802.11 management and control frames +implied snort.-X: dump the raw packet data starting at the link layer

  • @@ -21442,7 +21550,7 @@ int ssl.max_heartbeat_length = 0: maximum length of heartbeat r

  • -bool ssl.trust_servers = false: disables requirement that application (encrypted) data must be observed on both sides +implied ssl_state.client_hello: check for client hello

  • @@ -21452,227 +21560,167 @@ implied ssl_state.!client_hello: check for records that are not

  • -implied ssl_state.!client_keyx: check for records that are not client keyx -

    -
    • -
  • -

    -implied ssl_state.!server_hello: check for records that are not server hello -

    -
    • -
  • -

    -implied ssl_state.!server_keyx: check for records that are not server keyx -

    -
    • -
  • -

    -implied ssl_state.!unknown: check for records that are not unknown -

    -
    • -
  • -

    -implied ssl_state.client_hello: check for client hello -

    -
    • -
  • -

    implied ssl_state.client_keyx: check for client keyx

  • -implied ssl_state.server_hello: check for server hello -

    -
    • -
  • -

    -implied ssl_state.server_keyx: check for server keyx -

    -
    • -
  • -

    -implied ssl_state.unknown: check for unknown record -

    -
    • -
  • -

    -implied ssl_version.!sslv2: check for records that are not sslv2 -

    -
    • -
  • -

    -implied ssl_version.!sslv3: check for records that are not sslv3 -

    -
    • -
  • -

    -implied ssl_version.!tls1.0: check for records that are not tls1.0 -

    -
    • -
  • -

    -implied ssl_version.!tls1.1: check for records that are not tls1.1 -

    -
    • -
  • -

    -implied ssl_version.!tls1.2: check for records that are not tls1.2 +implied ssl_state.!client_keyx: check for records that are not client keyx

  • -implied ssl_version.sslv2: check for sslv2 +implied ssl_state.!server_hello: check for records that are not server hello

  • -implied ssl_version.sslv3: check for sslv3 +implied ssl_state.server_hello: check for server hello

  • -implied ssl_version.tls1.0: check for tls1.0 +implied ssl_state.!server_keyx: check for records that are not server keyx

  • -implied ssl_version.tls1.1: check for tls1.1 +implied ssl_state.server_keyx: check for server keyx

  • -implied ssl_version.tls1.2: check for tls1.2 +implied ssl_state.!unknown: check for records that are not unknown

  • -int stream.file_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } +implied ssl_state.unknown: check for unknown record

  • -int stream.file_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } +bool ssl.trust_servers = false: disables requirement that application (encrypted) data must be observed on both sides

  • -int stream.file_cache.max_sessions = 128: maximum simultaneous sessions tracked before pruning { 2: } +implied ssl_version.!sslv2: check for records that are not sslv2

  • -int stream.file_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +implied ssl_version.sslv2: check for sslv2

  • -int stream.icmp_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } +implied ssl_version.!sslv3: check for records that are not sslv3

  • -int stream.icmp_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } +implied ssl_version.sslv3: check for sslv3

  • -int stream.icmp_cache.max_sessions = 32768: maximum simultaneous sessions tracked before pruning { 2: } +implied ssl_version.!tls1.0: check for records that are not tls1.0

  • -int stream.icmp_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +implied ssl_version.tls1.0: check for tls1.0

  • -int stream.ip_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } +implied ssl_version.!tls1.1: check for records that are not tls1.1

  • -int stream.ip_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } +implied ssl_version.tls1.1: check for tls1.1

  • -int stream.ip_cache.max_sessions = 16384: maximum simultaneous sessions tracked before pruning { 2: } +implied ssl_version.!tls1.2: check for records that are not tls1.2

  • -int stream.ip_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +implied ssl_version.tls1.2: check for tls1.2

  • -int stream.tcp_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } +int stream.file_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 }

  • -int stream.tcp_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } +int stream.file_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: }

  • -int stream.tcp_cache.max_sessions = 131072: maximum simultaneous sessions tracked before pruning { 2: } +int stream.file_cache.max_sessions = 128: maximum simultaneous sessions tracked before pruning { 2: }

  • -int stream.tcp_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +int stream.file_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: }

  • -int stream.udp_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } +bool stream_file.upload = false: indicate file transfer direction

  • -int stream.udp_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } +int stream.icmp_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 }

  • -int stream.udp_cache.max_sessions = 65536: maximum simultaneous sessions tracked before pruning { 2: } +int stream.icmp_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: }

  • -int stream.udp_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +int stream.icmp_cache.max_sessions = 32768: maximum simultaneous sessions tracked before pruning { 2: }

  • -int stream.user_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } +int stream.icmp_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: }

  • -int stream.user_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } +int stream_icmp.session_timeout = 30: session tracking timeout { 1:86400 }

  • -int stream.user_cache.max_sessions = 1024: maximum simultaneous sessions tracked before pruning { 2: } +int stream.ip_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 }

  • -int stream.user_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +int stream.ip_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: }

  • -bool stream_file.upload = false: indicate file transfer direction +int stream.ip_cache.max_sessions = 16384: maximum simultaneous sessions tracked before pruning { 2: }

  • -int stream_icmp.session_timeout = 30: session tracking timeout { 1:86400 } +int stream.ip_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: }

  • @@ -21737,6 +21785,26 @@ string stream_size.~range: size for comparison

  • +int stream.tcp_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } +

    +
    • +
  • +

    +int stream.tcp_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } +

    +
    • +
  • +

    +int stream.tcp_cache.max_sessions = 131072: maximum simultaneous sessions tracked before pruning { 2: } +

    +
    • +
  • +

    +int stream.tcp_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +

    +
    • +
  • +

    int stream_tcp.flush_factor = 0: flush upon seeing a drop in segment size after given number of non-decreasing segments { 0: }

    • @@ -21812,6 +21880,26 @@ int stream_tcp.small_segments.maximum_size = 0: limit number of

  • +int stream.udp_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } +

    +
    • +
  • +

    +int stream.udp_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } +

    +
    • +
  • +

    +int stream.udp_cache.max_sessions = 65536: maximum simultaneous sessions tracked before pruning { 2: } +

    +
    • +
  • +

    +int stream.udp_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +

    +
    • +
  • +

    bool stream_udp.ignore_any_rules = false: process udp content rules w/o ports only if rules with ports are present

    • @@ -21822,6 +21910,26 @@ int stream_udp.session_timeout = 30: session tracking timeout {

  • +int stream.user_cache.cleanup_pct = 5: percent of cache to clean when max_sessions is reached { 1:100 } +

    +
    • +
  • +

    +int stream.user_cache.idle_timeout = 180: maximum inactive time before retiring session tracker { 1: } +

    +
    • +
  • +

    +int stream.user_cache.max_sessions = 1024: maximum simultaneous sessions tracked before pruning { 2: } +

    +
    • +
  • +

    +int stream.user_cache.pruning_timeout = 30: minimum inactive time before being eligible for pruning { 1: } +

    +
    • +
  • +

    int stream_user.session_timeout = 30: session tracking timeout { 1:86400 }

    • @@ -21852,6 +21960,11 @@ int tag.bytes: tag for this many bytes { 1: }

  • +enum tag.~: log all packets in session or all packets to or from host { session|host_src|host_dst } +

    +
    • +
  • +

    int tag.packets: tag this many packets { 1: }

    • @@ -21862,7 +21975,22 @@ int tag.seconds: tag for this many seconds { 1: }

  • -enum tag.~: log all packets in session or all packets to or from host { session|host_src|host_dst } +string tcp_connector.address: address +

    +
    • +
  • +

    +port tcp_connector.base_port: base port number +

    +
    • +
  • +

    +string tcp_connector.connector: connector name +

    +
    • +
  • +

    +enum tcp_connector.setup: stream establishment { call | answer }

  • @@ -22112,6 +22240,11 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +appid.rsync_flows: count of rsync service flows discovered by appid +

    +
    • +
  • +

    appid.smtp_flows: count of smtp flows discovered by appid

    • @@ -22267,6 +22400,11 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +dce_smb.aborted sessions: total aborted sessions +

    +
    • +
  • +

    dce_smb.Alter context responses: total connection-oriented alter context responses

    • @@ -22282,6 +22420,11 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +dce_smb.bad autodetects: total bad autodetects +

    +
    • +
  • +

    dce_smb.Bind acks: total connection-oriented binds acks

    • @@ -22327,6 +22470,11 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +dce_smb.events: total events +

    +
    • +
  • +

    dce_smb.Faults: total connection-oriented faults

    • @@ -22337,12 +22485,12 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • -dce_smb.MS RPC/HTTP PDUs: total connection-oriented MS requests to send RPC over HTTP +dce_smb.Max outstanding requests: total smb maximum outstanding requests

  • -dce_smb.Max outstanding requests: total smb maximum outstanding requests +dce_smb.MS RPC/HTTP PDUs: total connection-oriented MS requests to send RPC over HTTP

  • @@ -22362,12 +22510,12 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • -dce_smb.PDUs: total connection-oriented PDUs +dce_smb.Packets: total smb packets

  • -dce_smb.Packets: total smb packets +dce_smb.PDUs: total connection-oriented PDUs

  • @@ -22432,32 +22580,27 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • -dce_smb.aborted sessions: total aborted sessions -

    -
    • -
  • -

    -dce_smb.bad autodetects: total bad autodetects +dce_tcp.aborted sessions: total aborted sessions

  • -dce_smb.events: total events +dce_tcp.Alter context responses: total connection-oriented alter context responses

  • -dce_tcp.Alter context responses: total connection-oriented alter context responses +dce_tcp.Alter contexts: total connection-oriented alter contexts

  • -dce_tcp.Alter contexts: total connection-oriented alter contexts +dce_tcp.Auth3s: total connection-oriented auth3s

  • -dce_tcp.Auth3s: total connection-oriented auth3s +dce_tcp.bad autodetects: total bad autodetects

  • @@ -22502,6 +22645,11 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +dce_tcp.events: total events +

    +
    • +
  • +

    dce_tcp.Faults: total connection-oriented faults

    • @@ -22582,21 +22730,6 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • -dce_tcp.aborted sessions: total aborted sessions -

    -
    • -
  • -

    -dce_tcp.bad autodetects: total bad autodetects -

    -
    • -
  • -

    -dce_tcp.events: total events -

    -
    • -
  • -

    dce_tcp.tcp packets: total tcp packets

    • @@ -22657,12 +22790,12 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • -detection.log limit: events queued but not logged +detection.logged: logged packets

  • -detection.logged: logged packets +detection.log limit: events queued but not logged

  • @@ -22832,102 +22965,102 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • -http_inspect.CONNECT requests: CONNECT requests inspected +http_inspect.chunked: chunked message bodies

  • -http_inspect.DELETE requests: DELETE requests inspected +http_inspect.CONNECT requests: CONNECT requests inspected

  • -http_inspect.GET requests: GET requests inspected +http_inspect.DELETE requests: DELETE requests inspected

  • -http_inspect.HEAD requests: HEAD requests inspected +http_inspect.flows: HTTP connections inspected

  • -http_inspect.OPTIONS requests: OPTIONS requests inspected +http_inspect.GET requests: GET requests inspected

  • -http_inspect.POST requests: POST requests inspected +http_inspect.HEAD requests: HEAD requests inspected

  • -http_inspect.PUT requests: PUT requests inspected +http_inspect.inspections: total message sections inspected

  • -http_inspect.TRACE requests: TRACE requests inspected +http_inspect.OPTIONS requests: OPTIONS requests inspected

  • -http_inspect.URI coding: URIs with character coding problems +http_inspect.other requests: other request methods inspected

  • -http_inspect.URI normalizations: URIs needing to be normalization +http_inspect.POST requests: POST requests inspected

  • -http_inspect.URI path: URIs with path problems +http_inspect.PUT requests: PUT requests inspected

  • -http_inspect.chunked: chunked message bodies +http_inspect.reassembles: TCP segments combined into HTTP messages

  • -http_inspect.flows: HTTP connections inspected +http_inspect.request bodies: POST, PUT, and other requests with message bodies

  • -http_inspect.inspections: total message sections inspected +http_inspect.requests: HTTP request messages inspected

  • -http_inspect.other requests: other request methods inspected +http_inspect.responses: HTTP response messages inspected

  • -http_inspect.reassembles: TCP segments combined into HTTP messages +http_inspect.scans: TCP segments scanned looking for HTTP messages

  • -http_inspect.request bodies: POST, PUT, and other requests with message bodies +http_inspect.TRACE requests: TRACE requests inspected

  • -http_inspect.requests: HTTP request messages inspected +http_inspect.URI coding: URIs with character coding problems

  • -http_inspect.responses: HTTP response messages inspected +http_inspect.URI normalizations: URIs needing to be normalization

  • -http_inspect.scans: TCP segments scanned looking for HTTP messages +http_inspect.URI path: URIs with path problems

  • @@ -23862,552 +23995,552 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • -stream.icmp excess prunes: icmp sessions pruned due to excess +stream_icmp.created: icmp session trackers created

  • -stream.icmp flows: total icmp sessions +stream.icmp excess prunes: icmp sessions pruned due to excess

  • -stream.icmp memcap prunes: icmp sessions pruned due to memcap +stream.icmp flows: total icmp sessions

  • -stream.icmp preemptive prunes: icmp sessions pruned during preemptive pruning +stream_icmp.max: max icmp sessions

  • -stream.icmp timeout prunes: icmp sessions pruned due to timeout +stream.icmp memcap prunes: icmp sessions pruned due to memcap

  • -stream.icmp total prunes: total icmp sessions pruned +stream.icmp preemptive prunes: icmp sessions pruned during preemptive pruning

  • -stream.icmp uni prunes: icmp uni sessions pruned +stream_icmp.prunes: icmp session prunes

  • -stream.icmp user prunes: icmp sessions pruned for other reasons +stream_icmp.released: icmp session trackers released

  • -stream.ip excess prunes: ip sessions pruned due to excess +stream_icmp.sessions: total icmp sessions

  • -stream.ip flows: total ip sessions +stream.icmp timeout prunes: icmp sessions pruned due to timeout

  • -stream.ip memcap prunes: ip sessions pruned due to memcap +stream_icmp.timeouts: icmp session timeouts

  • -stream.ip preemptive prunes: ip sessions pruned during preemptive pruning +stream.icmp total prunes: total icmp sessions pruned

  • -stream.ip timeout prunes: ip sessions pruned due to timeout +stream.icmp uni prunes: icmp uni sessions pruned

  • -stream.ip total prunes: total ip sessions pruned +stream.icmp user prunes: icmp sessions pruned for other reasons

  • -stream.ip uni prunes: ip uni sessions pruned +stream_ip.alerts: alerts generated

  • -stream.ip user prunes: ip sessions pruned for other reasons +stream_ip.anomalies: anomalies detected

  • -stream.tcp excess prunes: tcp sessions pruned due to excess +stream_ip.created: ip session trackers created

  • -stream.tcp flows: total tcp sessions +stream_ip.current: current fragments

  • -stream.tcp memcap prunes: tcp sessions pruned due to memcap +stream_ip.discards: fragments discarded

  • -stream.tcp preemptive prunes: tcp sessions pruned during preemptive pruning +stream_ip.drops: fragments dropped

  • -stream.tcp timeout prunes: tcp sessions pruned due to timeout +stream.ip excess prunes: ip sessions pruned due to excess

  • -stream.tcp total prunes: total tcp sessions pruned +stream.ip flows: total ip sessions

  • -stream.tcp uni prunes: tcp uni sessions pruned +stream_ip.fragmented bytes: total fragmented bytes

  • -stream.tcp user prunes: tcp sessions pruned for other reasons +stream_ip.frag timeouts: datagrams abandoned

  • -stream.udp excess prunes: udp sessions pruned due to excess +stream_ip.max frags: max fragments

  • -stream.udp flows: total udp sessions +stream_ip.max: max ip sessions

  • -stream.udp memcap prunes: udp sessions pruned due to memcap +stream.ip memcap prunes: ip sessions pruned due to memcap

  • -stream.udp preemptive prunes: udp sessions pruned during preemptive pruning +stream_ip.memory used: current memory usage in bytes

  • -stream.udp timeout prunes: udp sessions pruned due to timeout +stream_ip.nodes deleted: fragments deleted from tracker

  • -stream.udp total prunes: total udp sessions pruned +stream_ip.nodes inserted: fragments added to tracker

  • -stream.udp uni prunes: udp uni sessions pruned +stream_ip.overlaps: overlapping fragments

  • -stream.udp user prunes: udp sessions pruned for other reasons +stream.ip preemptive prunes: ip sessions pruned during preemptive pruning

  • -stream.user excess prunes: user sessions pruned due to excess +stream_ip.prunes: ip session prunes

  • -stream.user flows: total user sessions +stream_ip.reassembled bytes: total reassembled bytes

  • -stream.user memcap prunes: user sessions pruned due to memcap +stream_ip.reassembled: reassembled datagrams

  • -stream.user preemptive prunes: user sessions pruned during preemptive pruning +stream_ip.released: ip session trackers released

  • -stream.user timeout prunes: user sessions pruned due to timeout +stream_ip.sessions: total ip sessions

  • -stream.user total prunes: total user sessions pruned +stream.ip timeout prunes: ip sessions pruned due to timeout

  • -stream.user uni prunes: user uni sessions pruned +stream_ip.timeouts: ip session timeouts

  • -stream.user user prunes: user sessions pruned for other reasons +stream.ip total prunes: total ip sessions pruned

  • -stream_icmp.created: icmp session trackers created +stream_ip.total: total fragments

  • -stream_icmp.max: max icmp sessions +stream_ip.trackers added: datagram trackers created

  • -stream_icmp.prunes: icmp session prunes +stream_ip.trackers cleared: datagram trackers cleared

  • -stream_icmp.released: icmp session trackers released +stream_ip.trackers completed: datagram trackers completed

  • -stream_icmp.sessions: total icmp sessions +stream_ip.trackers freed: datagram trackers released

  • -stream_icmp.timeouts: icmp session timeouts +stream.ip uni prunes: ip uni sessions pruned

  • -stream_ip.alerts: alerts generated +stream.ip user prunes: ip sessions pruned for other reasons

  • -stream_ip.anomalies: anomalies detected +stream_tcp.3way trackers: tcp session tracking started on ack

  • -stream_ip.created: ip session trackers created +stream_tcp.client cleanups: number of times data from server was flushed when session released

  • -stream_ip.current: current fragments +stream_tcp.closing: number of sessions currently closing

  • -stream_ip.discards: fragments discarded +stream_tcp.created: tcp session trackers created

  • -stream_ip.drops: fragments dropped +stream_tcp.data trackers: tcp session tracking started on data

  • -stream_ip.frag timeouts: datagrams abandoned +stream_tcp.discards: tcp packets discarded

  • -stream_ip.fragmented bytes: total fragmented bytes +stream_tcp.established: number of sessions currently established

  • -stream_ip.max frags: max fragments +stream_tcp.events: events generated

  • -stream_ip.max: max ip sessions +stream.tcp excess prunes: tcp sessions pruned due to excess

  • -stream_ip.memory used: current memory usage in bytes +stream.tcp flows: total tcp sessions

  • -stream_ip.nodes deleted: fragments deleted from tracker +stream_tcp.gaps: missing data between PDUs

  • -stream_ip.nodes inserted: fragments added to tracker +stream_tcp.ignored: tcp packets ignored

  • -stream_ip.overlaps: overlapping fragments +stream_tcp.initializing: number of sessions currently initializing

  • -stream_ip.prunes: ip session prunes +stream_tcp.internal events: 135:X events generated

  • -stream_ip.reassembled bytes: total reassembled bytes +stream_tcp.max bytes: number of times the maximum queued byte limit was reached

  • -stream_ip.reassembled: reassembled datagrams +stream_tcp.max: max tcp sessions

  • -stream_ip.released: ip session trackers released +stream_tcp.max segs: number of times the maximum queued segment limit was reached

  • -stream_ip.sessions: total ip sessions +stream.tcp memcap prunes: tcp sessions pruned due to memcap

  • -stream_ip.timeouts: ip session timeouts +stream_tcp.memory: current memory in use

  • -stream_ip.total: total fragments +stream_tcp.overlaps: overlapping segments queued

  • -stream_ip.trackers added: datagram trackers created +stream.tcp preemptive prunes: tcp sessions pruned during preemptive pruning

  • -stream_ip.trackers cleared: datagram trackers cleared +stream_tcp.prunes: tcp session prunes

  • -stream_ip.trackers completed: datagram trackers completed +stream_tcp.rebuilt buffers: rebuilt PDU sections

  • -stream_ip.trackers freed: datagram trackers released +stream_tcp.rebuilt bytes: total rebuilt bytes

  • -stream_tcp.3way trackers: tcp session tracking started on ack +stream_tcp.rebuilt packets: total reassembled PDUs

  • -stream_tcp.client cleanups: number of times data from server was flushed when session released +stream_tcp.released: tcp session trackers released

  • -stream_tcp.closing: number of sessions currently closing +stream_tcp.resyns: SYN received on established session

  • -stream_tcp.created: tcp session trackers created +stream_tcp.segs queued: total segments queued

  • -stream_tcp.data trackers: tcp session tracking started on data +stream_tcp.segs released: total segments released

  • -stream_tcp.discards: tcp packets discarded +stream_tcp.segs split: tcp segments split when reassembling PDUs

  • -stream_tcp.established: number of sessions currently established +stream_tcp.segs used: queued tcp segments applied to reassembled PDUs

  • -stream_tcp.events: events generated +stream_tcp.server cleanups: number of times data from client was flushed when session released

  • -stream_tcp.gaps: missing data between PDUs +stream_tcp.sessions: total tcp sessions

  • -stream_tcp.ignored: tcp packets ignored +stream_tcp.syn-ack trackers: tcp session tracking started on syn-ack

  • -stream_tcp.initializing: number of sessions currently initializing +stream_tcp.syn trackers: tcp session tracking started on syn

  • -stream_tcp.internal events: 135:X events generated +stream.tcp timeout prunes: tcp sessions pruned due to timeout

  • -stream_tcp.max bytes: number of times the maximum queued byte limit was reached +stream_tcp.timeouts: tcp session timeouts

  • -stream_tcp.max segs: number of times the maximum queued segment limit was reached +stream.tcp total prunes: total tcp sessions pruned

  • -stream_tcp.max: max tcp sessions +stream.tcp uni prunes: tcp uni sessions pruned

  • -stream_tcp.memory: current memory in use +stream_tcp.untracked: tcp packets not tracked

  • -stream_tcp.overlaps: overlapping segments queued +stream.tcp user prunes: tcp sessions pruned for other reasons

  • -stream_tcp.prunes: tcp session prunes +stream_udp.created: udp session trackers created

  • -stream_tcp.rebuilt buffers: rebuilt PDU sections +stream.udp excess prunes: udp sessions pruned due to excess

  • -stream_tcp.rebuilt bytes: total rebuilt bytes +stream.udp flows: total udp sessions

  • -stream_tcp.rebuilt packets: total reassembled PDUs +stream_udp.max: max udp sessions

  • -stream_tcp.released: tcp session trackers released +stream.udp memcap prunes: udp sessions pruned due to memcap

  • -stream_tcp.resyns: SYN received on established session +stream.udp preemptive prunes: udp sessions pruned during preemptive pruning

  • -stream_tcp.segs queued: total segments queued +stream_udp.prunes: udp session prunes

  • -stream_tcp.segs released: total segments released +stream_udp.released: udp session trackers released

  • -stream_tcp.segs split: tcp segments split when reassembling PDUs +stream_udp.sessions: total udp sessions

  • -stream_tcp.segs used: queued tcp segments applied to reassembled PDUs +stream.udp timeout prunes: udp sessions pruned due to timeout

  • -stream_tcp.server cleanups: number of times data from client was flushed when session released +stream_udp.timeouts: udp session timeouts

  • -stream_tcp.sessions: total tcp sessions +stream.udp total prunes: total udp sessions pruned

  • -stream_tcp.syn trackers: tcp session tracking started on syn +stream.udp uni prunes: udp uni sessions pruned

  • -stream_tcp.syn-ack trackers: tcp session tracking started on syn-ack +stream.udp user prunes: udp sessions pruned for other reasons

  • -stream_tcp.timeouts: tcp session timeouts +stream.user excess prunes: user sessions pruned due to excess

  • -stream_tcp.untracked: tcp packets not tracked +stream.user flows: total user sessions

  • -stream_udp.created: udp session trackers created +stream.user memcap prunes: user sessions pruned due to memcap

  • -stream_udp.max: max udp sessions +stream.user preemptive prunes: user sessions pruned during preemptive pruning

  • -stream_udp.prunes: udp session prunes +stream.user timeout prunes: user sessions pruned due to timeout

  • -stream_udp.released: udp session trackers released +stream.user total prunes: total user sessions pruned

  • -stream_udp.sessions: total udp sessions +stream.user uni prunes: user uni sessions pruned

  • -stream_udp.timeouts: udp session timeouts +stream.user user prunes: user sessions pruned for other reasons

  • @@ -24422,6 +24555,11 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +tcp_connector.messages: total messages +

    +
    • +
  • +

    telnet.packets: total packets

    • @@ -24497,6 +24635,11 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +116: ciscometadata +

    +
    • +
  • +

    116: decode

    • @@ -25477,7 +25620,27 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • -116:468 (decode) too many protocols present +116:468 (ciscometadata) truncated Cisco Metadata header +

    +
    • +
  • +

    +116:469 (ciscometadata) invalid Cisco Metadata option length +

    +
    • +
  • +

    +116:470 (ciscometadata) invalid Cisco Metadata option type +

    +
    • +
  • +

    +116:471 (ciscometadata) invalid Cisco Metadata SGT +

    +
    • +
  • +

    +116:472 (decode) too many protocols present

  • @@ -25852,6 +26015,21 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +119:76 (http_inspect) Unsupported Transfer-Encoding or Content-Encoding used +

    +
    • +
  • +

    +119:77 (http_inspect) Unknown Transfer-Encoding or Content-Encoding used +

    +
    • +
  • +

    +119:78 (http_inspect) Multiple layers of compression encodings applied +

    +
    • +
  • +

    122:1 (port_scan) TCP portscan

    • @@ -26991,7 +27169,7 @@ documentation and are not applicable elsewhere.

    • -hosts(16): reload hosts file +hosts(23): reload hosts file

    • @@ -27011,12 +27189,12 @@ documentation and are not applicable elsewhere.

    • -rotate(31): rotate stats files +rotate(12): rotate stats files

    • -stats(30): dump stats to stdout +stats(10): dump stats to stdout

    • @@ -27363,6 +27541,11 @@ deleted -> unified2: 'filename'

    • +alert_sfsocket (logger): output event over socket +

      +
      • +
    • +

      alert_syslog (logger): output event to syslog

      • @@ -27443,6 +27626,11 @@ deleted -> unified2: 'filename'

    • +ciscometadata (codec): support for cisco metadata +

      +
      • +
    • +

      classifications (basic): define rule categories with priority

      • @@ -28238,6 +28426,11 @@ deleted -> unified2: 'filename'

    • +tcp_connector (connector): implement the tcp stream connector +

      +
      • +
    • +

      telnet (inspector): telnet inspection and normalization

      • @@ -28293,6 +28486,11 @@ deleted -> unified2: 'filename'

    • +codec::ciscometadata: support for cisco metadata +

      +
      • +
    • +

      codec::erspan2: support for encapsulated remote switched port analyzer - type 2

      • @@ -28468,6 +28666,11 @@ deleted -> unified2: 'filename'

    • +connector::tcp_connector: implement the tcp stream connector +

      +
      • +
    • +

      inspector::appid: application and service identification

      • @@ -29138,6 +29341,11 @@ deleted -> unified2: 'filename'

    • +logger::alert_sfsocket: output event over socket +

      +
      • +
    • +

      logger::alert_syslog: output event to syslog

      • @@ -29245,7 +29453,8 @@ deleted -> unified2: 'filename'
      diff --git a/doc/default_snort_manual.pdf b/doc/default_snort_manual.pdf index fda94c239..93149240b 100644 Binary files a/doc/default_snort_manual.pdf and b/doc/default_snort_manual.pdf differ diff --git a/doc/default_snort_manual.text b/doc/default_snort_manual.text index e4dd4e23e..792195aeb 100644 --- a/doc/default_snort_manual.text +++ b/doc/default_snort_manual.text @@ -67,24 +67,25 @@ Table of Contents 4.1. arp 4.2. auth - 4.3. erspan2 - 4.4. erspan3 - 4.5. esp - 4.6. eth - 4.7. fabricpath - 4.8. gre - 4.9. gtp - 4.10. icmp4 - 4.11. icmp6 - 4.12. igmp - 4.13. ipv4 - 4.14. ipv6 - 4.15. mpls - 4.16. pgm - 4.17. pppoe - 4.18. tcp - 4.19. udp - 4.20. vlan + 4.3. ciscometadata + 4.4. erspan2 + 4.5. erspan3 + 4.6. esp + 4.7. eth + 4.8. fabricpath + 4.9. gre + 4.10. gtp + 4.11. icmp4 + 4.12. icmp6 + 4.13. igmp + 4.14. ipv4 + 4.15. ipv6 + 4.16. mpls + 4.17. pgm + 4.18. pppoe + 4.19. tcp + 4.20. udp + 4.21. vlan 5. Inspector Modules @@ -232,11 +233,12 @@ Table of Contents 10.1. alert_csv 10.2. alert_fast 10.3. alert_full - 10.4. alert_syslog - 10.5. log_codecs - 10.6. log_hext - 10.7. log_pcap - 10.8. unified2 + 10.4. alert_sfsocket + 10.5. alert_syslog + 10.6. log_codecs + 10.7. log_hext + 10.8. log_pcap + 10.9. unified2 11. DAQ Modules @@ -364,7 +366,7 @@ available. 1.1. Configuration ------------- +-------------- Note that retaining backwards compatibility is not a goal. While Snort++ leverages some of the Snort code base, a lot has changed. The @@ -380,7 +382,7 @@ differences are given in this manual. 1.2. Modules ------------- +-------------- Snort++ is organized into a collection of builtin and plugin modules. If a module has parameters, it is configured by a Lua table of the @@ -432,7 +434,7 @@ active = { max_responses = 1, min_interval = 5 } 1.3. Plugins and Scripts ------------- +-------------- There are several plugin types: @@ -465,21 +467,19 @@ IpsOptions. 1.4. New Http Inspector ------------- +-------------- One of the major undertakings for Snort 3.0 is developing a -completely new HTTP inspector. It is incomplete right now but you can -examine the work-in-progress. You can configure it by adding: +completely new HTTP inspector. You can configure it by adding: -new_http_inspect = {} +http_inspect = {} to your snort.lua configuration file. Or you can read it in the -source code under src/service_inspectors/nhttp_inspect. +source code under src/service_inspectors/http_inspect. The classic HTTP preprocessor is still available in the alpha release -as http_inspect. It’s probably the better choice for now if you just -want to do some work and do not feel like experimenting. Be sure not -to configure both old and new HTTP inspectors at the same time. +under extra. It has been renamed http_server. Be sure not to +configure both old and new HTTP inspectors at the same time. So why a new HTTP inspector? @@ -492,25 +492,25 @@ centralized in a series of tables where it can be easily reviewed and modified. Many significant changes can be made just by updating these tables. -New_http_inspect is the first inspector written specifically for the -new Snort 3.0 architecture. That provides access to one of the very -best features of Snort 3.0: purely PDU-based inspection. Classic -http_inspect processes HTTP messages, but even while doing so it is +Http_inspect is the first inspector written specifically for the new +Snort 3.0 architecture. That provides access to one of the very best +features of Snort 3.0: purely PDU-based inspection. The classic +preprocessor processes HTTP messages, but even while doing so it is constantly aware of IP packets and how they divide up the TCP data stream. The same HTTP message might be processed differently depending on how the sender (bad guy) divided it up into IP packets. -New_http_inspect is free of this burden and can focus exclusively on -HTTP. That makes it much more simple, easier to test, and less prone -to false positives. It also greatly reduces the opportunity for +Http_inspect is free of this burden and can focus exclusively on +HTTP. That makes it much simpler, easier to test, and less prone to +false positives. It also greatly reduces the opportunity for adversaries to probe the inspector for weak spots by adjusting packet boundaries to disguise bad behavior. Dealing solely with HTTP messages also opens the door for developing -major new features. The new_http_inspect design supports true -stateful processing. Want to ask questions that involve both the -client request and the server response? Or different requests in the -same session? These things are possible. +major new features. The http_inspect design supports true stateful +processing. Want to ask questions that involve both the client +request and the server response? Or different requests in the same +session? These things are possible. Another new feature on the horizon is HTTP/2 analysis. HTTP/2 derives from Google’s SPDY project and is in the process of being @@ -519,14 +519,15 @@ as a newer version of HTTP/1.1, but rather a separate protocol layer that runs under HTTP/1.1 and on top of TLS or TCP. It’s a perfect fit for the new Snort 3.0 architecture because a new HTTP/2 inspector would naturally output HTTP/1.1 messages but not any underlying -packets. Exactly what the new_http_inspect wants to input. +packets. Exactly what http_inspect wants to input. -New_http_inspect is taking a very different approach to HTTP header -fields. Classic http_inspect divides all the HTTP headers following -the start line into cookies and everything else. It normalizes the -two pieces using a generic process and puts them in buffers that one -can write rules against. There is some limited support for examining -individual headers within the inspector but it is very specific. +Http_inspect is taking a very different approach to HTTP header +fields. The classic preprocessor divides all the HTTP headers +following the start line into cookies and everything else. It +normalizes the two pieces using a generic process and puts them in +buffers that one can write rules against. There is some limited +support for examining individual headers within the inspector but it +is very specific. The new concept is that every header should be normalized in an appropriate and specific way and individually made available for the @@ -537,7 +538,7 @@ format. 1.5. Binder and Wizard ------------- +-------------- One of the fundamental differences between Snort and Snort++ concerns configuration related to networks and ports. Here is a brief review @@ -620,7 +621,7 @@ Additional Details: 1.6. Packet Processing ------------- +-------------- One of the goals of Snort++ is to provide a more flexible framework for packet processing by implementing an event-driven approach. @@ -699,7 +700,7 @@ The following pointers will help you get started: 2.1. Dependencies ------------- +-------------- Required: @@ -744,7 +745,7 @@ Optional: 2.2. Building ------------- +-------------- * Optionally built features are listed in the reference section. * Create an install path: @@ -796,7 +797,7 @@ Optional: 2.3. Run ------------- +-------------- First set up the environment: @@ -842,7 +843,7 @@ For more examples, see the usage section. 2.4. Tips ------------- +-------------- One of the goals of Snort++ is to make it easier to configure your sensor. Here is a summary of tips and tricks you may find useful. @@ -928,7 +929,7 @@ you can use the options below to format the paths: 2.5. Help ------------- +-------------- Snort has several options to get more help: @@ -963,7 +964,7 @@ Report bugs to bugs@snort.org. 2.6. Common Errors ------------- +-------------- FATAL: snort_config is required @@ -1018,7 +1019,7 @@ WARNING: unknown symbol x 2.7. Gotchas ------------- +-------------- * A nil key in a table will not caught. Neither will a nil value in a table. Neither of the following will cause errors, nor will @@ -1074,7 +1075,7 @@ WARNING: unknown symbol x 2.8. Bugs ------------- +-------------- 2.8.1. Build @@ -1175,7 +1176,7 @@ include configuration for core processing. 3.1. active ------------- +-------------- What: configure responses @@ -1195,7 +1196,7 @@ Configuration: 3.2. alerts ------------- +-------------- What: configure alerts @@ -1225,7 +1226,7 @@ Configuration: 3.3. attribute_table ------------- +-------------- What: configure hosts loading @@ -1243,7 +1244,7 @@ Configuration: 3.4. classifications ------------- +-------------- What: define rule categories with priority @@ -1260,7 +1261,7 @@ Configuration: 3.5. daq ------------- +-------------- What: configure packet acquisition interface @@ -1304,7 +1305,7 @@ Peg counts: 3.6. decode ------------- +-------------- What: general decoder rules @@ -1319,12 +1320,12 @@ Rules: * 116:150 (decode) bad traffic loopback IP * 116:151 (decode) bad traffic same src/dst IP * 116:449 (decode) BAD-TRAFFIC unassigned/reserved IP protocol - * 116:468 (decode) too many protocols present + * 116:472 (decode) too many protocols present 3.7. detection ------------- +-------------- What: configure general IPS rule processing parameters @@ -1365,7 +1366,7 @@ Peg counts: 3.8. event_filter ------------- +-------------- What: configure thresholding of events @@ -1388,7 +1389,7 @@ Configuration: 3.9. event_queue ------------- +-------------- What: configure event queue parameters @@ -1406,7 +1407,7 @@ Configuration: 3.10. file_id ------------- +-------------- What: configure file identification @@ -1465,7 +1466,7 @@ Configuration: 3.11. high_availability ------------- +-------------- What: implement flow tracking high availability @@ -1488,7 +1489,7 @@ Peg counts: 3.12. host_cache ------------- +-------------- What: configure hosts @@ -1514,7 +1515,7 @@ Peg counts: 3.13. host_tracker ------------- +-------------- What: configure hosts @@ -1542,7 +1543,7 @@ Peg counts: 3.14. hosts ------------- +-------------- What: configure hosts @@ -1563,7 +1564,7 @@ Configuration: 3.15. ips ------------- +-------------- What: configure IPS rule processing @@ -1582,7 +1583,7 @@ Configuration: 3.16. latency ------------- +-------------- What: packet and rule latency monitoring and control @@ -1626,7 +1627,7 @@ Peg counts: 3.17. memory ------------- +-------------- What: memory management configuration @@ -1644,7 +1645,7 @@ Configuration: 3.18. network ------------- +-------------- What: configure basic network parameters @@ -1677,7 +1678,7 @@ Configuration: 3.19. output ------------- +-------------- What: configure general output parameters @@ -1711,7 +1712,7 @@ Configuration: 3.20. packets ------------- +-------------- What: configure basic packet handling @@ -1733,7 +1734,7 @@ Configuration: 3.21. process ------------- +-------------- What: configure basic process setup @@ -1757,7 +1758,7 @@ Configuration: 3.22. profiler ------------- +-------------- What: configure profiling of rules and/or modules @@ -1790,7 +1791,7 @@ Configuration: 3.23. rate_filter ------------- +-------------- What: configure rate filters (which change rule actions) @@ -1815,7 +1816,7 @@ Configuration: 3.24. references ------------- +-------------- What: define reference systems used in rules @@ -1829,7 +1830,7 @@ Configuration: 3.25. rule_state ------------- +-------------- What: enable/disable specific IPS rules @@ -1845,7 +1846,7 @@ Configuration: 3.26. search_engine ------------- +-------------- What: configure fast pattern matcher @@ -1899,7 +1900,7 @@ Peg counts: 3.27. side_channel ------------- +-------------- What: implement the side-channel asynchronous messaging subsystem @@ -1910,13 +1911,14 @@ Configuration: * bit_list side_channel.ports: side channel message port list { 65535 } * string side_channel.connectors[].connector: connector handle + * string side_channel.connector: connector handle Peg counts: 3.28. snort ------------- +-------------- What: command line configuration and shell commands @@ -2135,7 +2137,7 @@ Peg counts: 3.29. suppress ------------- +-------------- What: configure event suppressions @@ -2164,7 +2166,7 @@ responses. 4.1. arp ------------- +-------------- What: support for address resolution protocol @@ -2177,7 +2179,7 @@ Rules: 4.2. auth ------------- +-------------- What: support for IP authentication header @@ -2189,9 +2191,25 @@ Rules: * 116:466 (auth) bad authentication header length -4.3. erspan2 +4.3. ciscometadata ------------- +-------------- + +What: support for cisco metadata + +Type: codec + +Rules: + + * 116:468 (ciscometadata) truncated Cisco Metadata header + * 116:469 (ciscometadata) invalid Cisco Metadata option length + * 116:470 (ciscometadata) invalid Cisco Metadata option type + * 116:471 (ciscometadata) invalid Cisco Metadata SGT + + +4.4. erspan2 + +-------------- What: support for encapsulated remote switched port analyzer - type 2 @@ -2203,9 +2221,9 @@ Rules: * 116:463 (erspan2) captured < ERSpan type2 header length -4.4. erspan3 +4.5. erspan3 ------------- +-------------- What: support for encapsulated remote switched port analyzer - type 3 @@ -2216,9 +2234,9 @@ Rules: * 116:464 (erspan3) captured < ERSpan type3 header length -4.5. esp +4.6. esp ------------- +-------------- What: support for encapsulating security payload @@ -2234,9 +2252,9 @@ Rules: * 116:294 (esp) truncated encapsulated security payload header -4.6. eth +4.7. eth ------------- +-------------- What: support for ethernet protocol (DLT 1) (DLT 51) @@ -2247,9 +2265,9 @@ Rules: * 116:424 (eth) truncated eth header -4.7. fabricpath +4.8. fabricpath ------------- +-------------- What: support for fabricpath @@ -2260,9 +2278,9 @@ Rules: * 116:467 (fabricpath) truncated FabricPath header -4.8. gre +4.9. gre ------------- +-------------- What: support for generic routing encapsulation @@ -2278,9 +2296,9 @@ Rules: * 116:165 (gre) GRE trans header length > payload length -4.9. gtp +4.10. gtp ------------- +-------------- What: support for general-packet-radio-service tunnelling protocol @@ -2292,9 +2310,9 @@ Rules: * 116:298 (gtp) GTP header length is invalid -4.10. icmp4 +4.11. icmp4 ------------- +-------------- What: support for Internet control message protocol v4 @@ -2338,9 +2356,9 @@ Peg counts: * icmp4.bad checksum: non-zero icmp checksums -4.11. icmp6 +4.12. icmp6 ------------- +-------------- What: support for Internet control message protocol v6 @@ -2374,9 +2392,9 @@ Peg counts: * icmp6.bad checksum (ip6): nonzero ipcm6 checksums -4.12. igmp +4.13. igmp ------------- +-------------- What: support for Internet group management protocol @@ -2387,9 +2405,9 @@ Rules: * 116:455 (igmp) DOS IGMP IP options validation attempt -4.13. ipv4 +4.14. ipv4 ------------- +-------------- What: support for Internet protocol v4 @@ -2425,9 +2443,9 @@ Peg counts: * ipv4.bad checksum: nonzero ip checksums -4.14. ipv6 +4.15. ipv6 ------------- +-------------- What: support for Internet protocol v6 @@ -2469,9 +2487,9 @@ Rules: * 116:456 (ipv6) too many IP6 extension headers -4.15. mpls +4.16. mpls ------------- +-------------- What: support for multiprotocol label switching @@ -2504,9 +2522,9 @@ Peg counts: * mpls.total bytes: total mpls labeled bytes processed -4.16. pgm +4.17. pgm ------------- +-------------- What: support for pragmatic general multicast @@ -2517,9 +2535,9 @@ Rules: * 116:454 (pgm) BAD-TRAFFIC PGM nak list overflow attempt -4.17. pppoe +4.18. pppoe ------------- +-------------- What: support for point-to-point protocol over ethernet @@ -2530,9 +2548,9 @@ Rules: * 116:120 (pppoe) bad PPPOE frame detected -4.18. tcp +4.19. tcp ------------- +-------------- What: support for transmission control protocol @@ -2568,9 +2586,9 @@ Peg counts: * tcp.bad checksum (ip6): nonzero tcp over ipv6 checksums -4.19. udp +4.20. udp ------------- +-------------- What: support for user datagram protocol @@ -2599,9 +2617,9 @@ Peg counts: * udp.bad checksum (ip6): nonzero udp over ipv6 checksums -4.20. vlan +4.21. vlan ------------- +-------------- What: support for local area network @@ -2626,7 +2644,7 @@ protocols beyond basic decoding. 5.1. appid ------------- +-------------- What: application and service identification @@ -2692,6 +2710,8 @@ Peg counts: * appid.netbios_flows: count of netbios service flows discovered by appid * appid.pop_flows: count of pop service flows discovered by appid + * appid.rsync_flows: count of rsync service flows discovered by + appid * appid.smtp_flows: count of smtp flows discovered by appid * appid.smtps_flows: count of smtps flows discovered by appid * appid.ssh_clients: count of ssh clients discovered by appid @@ -2703,7 +2723,7 @@ Peg counts: 5.2. arp_spoof ------------- +-------------- What: detect ARP attacks and anomalies @@ -2728,7 +2748,7 @@ Peg counts: 5.3. back_orifice ------------- +-------------- What: back orifice detection @@ -2748,7 +2768,7 @@ Peg counts: 5.4. binder ------------- +-------------- What: configure processing based on CIDRs, ports, services, etc. @@ -2786,7 +2806,7 @@ Peg counts: 5.5. dce_smb ------------- +-------------- What: dce over smb inspection @@ -2955,7 +2975,7 @@ Peg counts: 5.6. dce_tcp ------------- +-------------- What: dce over tcp inspection @@ -3054,7 +3074,7 @@ Peg counts: 5.7. dnp3 ------------- +-------------- What: dnp3 inspection @@ -3088,7 +3108,7 @@ Peg counts: 5.8. dns ------------- +-------------- What: dns inspection @@ -3109,7 +3129,7 @@ Peg counts: 5.9. file_log ------------- +-------------- What: log file event to file.log @@ -3129,7 +3149,7 @@ Peg counts: 5.10. ftp_client ------------- +-------------- What: FTP client configuration module for use with ftp_server @@ -3153,7 +3173,7 @@ Configuration: 5.11. ftp_data ------------- +-------------- What: FTP data channel handler @@ -3166,7 +3186,7 @@ Peg counts: 5.12. ftp_server ------------- +-------------- What: main FTP module; ftp_client should also be configured @@ -3233,7 +3253,7 @@ Peg counts: 5.13. gtp_inspect ------------- +-------------- What: gtp control channel inspection @@ -3267,7 +3287,7 @@ Peg counts: 5.14. http_inspect ------------- +-------------- What: HTTP inspector @@ -3281,6 +3301,8 @@ Configuration: body bytes to examine (-1 no limit) { -1: } * bool http_inspect.unzip = true: decompress gzip and deflate message bodies + * bool http_inspect.normalize_utf = true: normalize charset utf + encodings * bit_list http_inspect.bad_characters: alert when any of specified bytes are present in URI after percent decoding { 255 } * string http_inspect.ignore_unreserved: do not alert when the @@ -3405,6 +3427,12 @@ Rules: * 119:73 (http_inspect) Transfer-Encoding did not end with chunked * 119:74 (http_inspect) Transfer-Encoding with chunked not at end * 119:75 (http_inspect) Misformatted HTTP traffic + * 119:76 (http_inspect) Unsupported Transfer-Encoding or + Content-Encoding used + * 119:77 (http_inspect) Unknown Transfer-Encoding or + Content-Encoding used + * 119:78 (http_inspect) Multiple layers of compression encodings + applied Peg counts: @@ -3435,7 +3463,7 @@ Peg counts: 5.15. imap ------------- +-------------- What: imap inspection @@ -3477,7 +3505,7 @@ Peg counts: 5.16. modbus ------------- +-------------- What: modbus inspection @@ -3498,7 +3526,7 @@ Peg counts: 5.17. normalizer ------------- +-------------- What: packet scrubbing for inline mode @@ -3624,7 +3652,7 @@ Peg counts: 5.18. packet_capture ------------- +-------------- What: raw packet dumping facility @@ -3650,7 +3678,7 @@ Peg counts: 5.19. perf_monitor ------------- +-------------- What: performance monitoring and flow statistics collection @@ -3688,7 +3716,7 @@ Peg counts: 5.20. pop ------------- +-------------- What: pop inspection @@ -3730,7 +3758,7 @@ Peg counts: 5.21. port_scan ------------- +-------------- What: port scan inspector; also configure port_scan_global @@ -3788,7 +3816,7 @@ Rules: 5.22. port_scan_global ------------- +-------------- What: shared settings for port_scan inspectors for use with port_scan @@ -3806,7 +3834,7 @@ Peg counts: 5.23. reputation ------------- +-------------- What: reputation inspection @@ -3844,7 +3872,7 @@ Peg counts: 5.24. rpc_decode ------------- +-------------- What: RPC inspector @@ -3865,7 +3893,7 @@ Peg counts: 5.25. sip ------------- +-------------- What: sip inspection @@ -3962,7 +3990,7 @@ Peg counts: 5.26. smtp ------------- +-------------- What: smtp inspection @@ -4053,7 +4081,7 @@ Peg counts: 5.27. ssh ------------- +-------------- What: ssh inspection @@ -4085,7 +4113,7 @@ Peg counts: 5.28. ssl ------------- +-------------- What: ssl inspection @@ -4129,7 +4157,7 @@ Peg counts: 5.29. stream ------------- +-------------- What: common flow tracking @@ -4246,7 +4274,7 @@ Peg counts: 5.30. stream_file ------------- +-------------- What: stream inspector for file flow tracking and processing @@ -4259,7 +4287,7 @@ Configuration: 5.31. stream_icmp ------------- +-------------- What: stream inspector for ICMP flow tracking @@ -4282,7 +4310,7 @@ Peg counts: 5.32. stream_ip ------------- +-------------- What: stream inspector for IP flow tracking and defragmentation @@ -4350,7 +4378,7 @@ Peg counts: 5.33. stream_tcp ------------- +-------------- What: stream inspector for TCP flow tracking and stream normalization and reassembly @@ -4466,7 +4494,7 @@ Peg counts: 5.34. stream_udp ------------- +-------------- What: stream inspector for UDP flow tracking @@ -4491,7 +4519,7 @@ Peg counts: 5.35. stream_user ------------- +-------------- What: stream inspector for user flow tracking and reassembly @@ -4505,7 +4533,7 @@ Configuration: 5.36. telnet ------------- +-------------- What: telnet inspection and normalization @@ -4534,7 +4562,7 @@ Peg counts: 5.37. wizard ------------- +-------------- What: inspector that implements port-independent protocol identification @@ -4588,7 +4616,7 @@ rule to parse. 6.1. react ------------- +-------------- What: send response to client and terminate session @@ -4604,7 +4632,7 @@ Configuration: 6.2. reject ------------- +-------------- What: terminate session with TCP reset or ICMP unreachable @@ -4620,7 +4648,7 @@ Configuration: 6.3. rewrite ------------- +-------------- What: overwrite packet contents @@ -4638,7 +4666,7 @@ IPS options are the building blocks of IPS rules. 7.1. ack ------------- +-------------- What: rule option to match on TCP ack numbers @@ -4652,7 +4680,7 @@ Configuration: 7.2. appids ------------- +-------------- What: detection option for application ids @@ -4665,7 +4693,7 @@ Configuration: 7.3. asn1 ------------- +-------------- What: rule option for asn1 detection @@ -4687,7 +4715,7 @@ Configuration: 7.4. base64_decode ------------- +-------------- What: rule option to decode base64 data - must be used with base64_data option @@ -4706,7 +4734,7 @@ Configuration: 7.5. bufferlen ------------- +-------------- What: rule option to check length of current buffer @@ -4719,7 +4747,7 @@ Configuration: 7.6. byte_extract ------------- +-------------- What: rule option to convert data to an integer variable @@ -4750,7 +4778,7 @@ Configuration: 7.7. byte_jump ------------- +-------------- What: rule option to move the detection cursor @@ -4784,7 +4812,7 @@ Configuration: 7.8. byte_test ------------- +-------------- What: rule option to convert data to integer and compare @@ -4813,7 +4841,7 @@ Configuration: 7.9. classtype ------------- +-------------- What: general rule option for rule classification @@ -4826,7 +4854,7 @@ Configuration: 7.10. content ------------- +-------------- What: payload rule option for basic pattern matching @@ -4854,7 +4882,7 @@ Configuration: 7.11. cvs ------------- +-------------- What: payload rule option for detecting specific attacks @@ -4867,7 +4895,7 @@ Configuration: 7.12. dce_iface ------------- +-------------- What: detection option to check dcerpc interface @@ -4882,7 +4910,7 @@ Configuration: 7.13. dce_opnum ------------- +-------------- What: detection option to check dcerpc operation number @@ -4896,7 +4924,7 @@ Configuration: 7.14. dce_stub_data ------------- +-------------- What: sets the cursor to dcerpc stub data @@ -4905,7 +4933,7 @@ Type: ips_option 7.15. detection_filter ------------- +-------------- What: rule option to require multiple hits before a rule generates an event @@ -4924,7 +4952,7 @@ Configuration: 7.16. dnp3_data ------------- +-------------- What: sets the cursor to dnp3 data @@ -4933,7 +4961,7 @@ Type: ips_option 7.17. dnp3_func ------------- +-------------- What: detection option to check dnp3 function code @@ -4946,7 +4974,7 @@ Configuration: 7.18. dnp3_ind ------------- +-------------- What: detection option to check dnp3 indicator flags @@ -4959,7 +4987,7 @@ Configuration: 7.19. dnp3_obj ------------- +-------------- What: detection option to check dnp3 object headers @@ -4975,7 +5003,7 @@ Configuration: 7.20. dsize ------------- +-------------- What: rule option to test payload size @@ -4989,7 +5017,7 @@ Configuration: 7.21. file_data ------------- +-------------- What: rule option to set detection cursor to file data @@ -4998,7 +5026,7 @@ Type: ips_option 7.22. file_type ------------- +-------------- What: rule option to check file type @@ -5011,7 +5039,7 @@ Configuration: 7.23. flags ------------- +-------------- What: rule option to test TCP control flags @@ -5025,7 +5053,7 @@ Configuration: 7.24. flow ------------- +-------------- What: rule option to check session properties @@ -5049,7 +5077,7 @@ Configuration: 7.25. flowbits ------------- +-------------- What: rule option to set and test arbitrary boolean flags @@ -5064,7 +5092,7 @@ Configuration: 7.26. fragbits ------------- +-------------- What: rule option to test IP frag flags @@ -5077,7 +5105,7 @@ Configuration: 7.27. fragoffset ------------- +-------------- What: rule option to test IP frag offset @@ -5091,7 +5119,7 @@ Configuration: 7.28. gid ------------- +-------------- What: rule option specifying rule generator @@ -5104,7 +5132,7 @@ Configuration: 7.29. gtp_info ------------- +-------------- What: rule option to check gtp info element @@ -5117,7 +5145,7 @@ Configuration: 7.30. gtp_type ------------- +-------------- What: rule option to check gtp types @@ -5130,7 +5158,7 @@ Configuration: 7.31. gtp_version ------------- +-------------- What: rule option to check gtp version @@ -5143,7 +5171,7 @@ Configuration: 7.32. http_client_body ------------- +-------------- What: rule option to set the detection cursor to the request body @@ -5152,7 +5180,7 @@ Type: ips_option 7.33. http_cookie ------------- +-------------- What: rule option to set the detection cursor to the HTTP cookie @@ -5170,7 +5198,7 @@ Configuration: 7.34. http_header ------------- +-------------- What: rule option to set the detection cursor to the normalized headers @@ -5191,7 +5219,7 @@ Configuration: 7.35. http_method ------------- +-------------- What: rule option to set the detection cursor to the HTTP request method @@ -5208,7 +5236,7 @@ Configuration: 7.36. http_raw_cookie ------------- +-------------- What: rule option to set the detection cursor to the unnormalized cookie @@ -5227,7 +5255,7 @@ Configuration: 7.37. http_raw_header ------------- +-------------- What: rule option to set the detection cursor to the unnormalized headers @@ -5246,7 +5274,7 @@ Configuration: 7.38. http_raw_request ------------- +-------------- What: rule option to set the detection cursor to the unnormalized request line @@ -5263,7 +5291,7 @@ Configuration: 7.39. http_raw_status ------------- +-------------- What: rule option to set the detection cursor to the unnormalized status line @@ -5280,7 +5308,7 @@ Configuration: 7.40. http_raw_trailer ------------- +-------------- What: rule option to set the detection cursor to the unnormalized trailers @@ -5299,7 +5327,7 @@ Configuration: 7.41. http_raw_uri ------------- +-------------- What: rule option to set the detection cursor to the unnormalized URI @@ -5324,7 +5352,7 @@ Configuration: 7.42. http_stat_code ------------- +-------------- What: rule option to set the detection cursor to the HTTP status code @@ -5340,7 +5368,7 @@ Configuration: 7.43. http_stat_msg ------------- +-------------- What: rule option to set the detection cursor to the HTTP status message @@ -5357,7 +5385,7 @@ Configuration: 7.44. http_trailer ------------- +-------------- What: rule option to set the detection cursor to the normalized trailers @@ -5377,7 +5405,7 @@ Configuration: 7.45. http_uri ------------- +-------------- What: rule option to set the detection cursor to the normalized URI buffer @@ -5401,7 +5429,7 @@ Configuration: 7.46. http_version ------------- +-------------- What: rule option to set the detection cursor to the version buffer @@ -5419,7 +5447,7 @@ Configuration: 7.47. icmp_id ------------- +-------------- What: rule option to check ICMP ID @@ -5433,7 +5461,7 @@ Configuration: 7.48. icmp_seq ------------- +-------------- What: rule option to check ICMP sequence number @@ -5447,7 +5475,7 @@ Configuration: 7.49. icode ------------- +-------------- What: rule option to check ICMP code @@ -5461,7 +5489,7 @@ Configuration: 7.50. id ------------- +-------------- What: rule option to check the IP ID field @@ -5475,7 +5503,7 @@ Configuration: 7.51. ip_proto ------------- +-------------- What: rule option to check the IP protocol number @@ -5488,7 +5516,7 @@ Configuration: 7.52. ipopts ------------- +-------------- What: rule option to check for IP options @@ -5502,7 +5530,7 @@ Configuration: 7.53. isdataat ------------- +-------------- What: rule option to check for the presence of payload data @@ -5517,7 +5545,7 @@ Configuration: 7.54. itype ------------- +-------------- What: rule option to check ICMP type @@ -5531,7 +5559,7 @@ Configuration: 7.55. md5 ------------- +-------------- What: payload rule option for hash matching @@ -5549,7 +5577,7 @@ Configuration: 7.56. metadata ------------- +-------------- What: rule option for conveying arbitrary name, value data within the rule text @@ -5564,7 +5592,7 @@ Configuration: 7.57. modbus_data ------------- +-------------- What: rule option to set cursor to modbus data @@ -5573,7 +5601,7 @@ Type: ips_option 7.58. modbus_func ------------- +-------------- What: rule option to check modbus function code @@ -5586,7 +5614,7 @@ Configuration: 7.59. modbus_unit ------------- +-------------- What: rule option to check modbus unit ID @@ -5599,7 +5627,7 @@ Configuration: 7.60. msg ------------- +-------------- What: rule option summarizing rule purpose output with events @@ -5612,7 +5640,7 @@ Configuration: 7.61. pcre ------------- +-------------- What: rule option for matching payload data with pcre @@ -5625,7 +5653,7 @@ Configuration: 7.62. pkt_data ------------- +-------------- What: rule option to set the detection cursor to the normalized packet data @@ -5635,7 +5663,7 @@ Type: ips_option 7.63. priority ------------- +-------------- What: rule option for prioritizing events @@ -5649,7 +5677,7 @@ Configuration: 7.64. raw_data ------------- +-------------- What: rule option to set the detection cursor to the raw packet data @@ -5658,7 +5686,7 @@ Type: ips_option 7.65. reference ------------- +-------------- What: rule option to indicate relevant attack identification system @@ -5672,7 +5700,7 @@ Configuration: 7.66. regex ------------- +-------------- What: rule option for matching payload data with hyperscan regex @@ -5691,7 +5719,7 @@ Configuration: 7.67. rem ------------- +-------------- What: rule option to convey an arbitrary comment in the rule body @@ -5704,7 +5732,7 @@ Configuration: 7.68. replace ------------- +-------------- What: rule option to overwrite payload data; use with rewrite action @@ -5717,7 +5745,7 @@ Configuration: 7.69. rev ------------- +-------------- What: rule option to indicate current revision of signature @@ -5730,7 +5758,7 @@ Configuration: 7.70. rpc ------------- +-------------- What: rule option to check SUNRPC CALL parameters @@ -5738,14 +5766,14 @@ Type: ips_option Configuration: - * string rpc.~app: application number - * string rpc.~ver: version number or * for any - * string rpc.~proc: procedure number or * for any + * int rpc.~app: application number + * int rpc.ver: version number or * for any + * int rpc.proc: procedure number or * for any 7.71. sd_pattern ------------- +-------------- What: rule option for detecting sensitive data @@ -5766,7 +5794,7 @@ Peg counts: 7.72. seq ------------- +-------------- What: rule option to check TCP sequence number @@ -5780,7 +5808,7 @@ Configuration: 7.73. session ------------- +-------------- What: rule option to check user data from TCP sessions @@ -5793,7 +5821,7 @@ Configuration: 7.74. sha256 ------------- +-------------- What: payload rule option for hash matching @@ -5811,7 +5839,7 @@ Configuration: 7.75. sha512 ------------- +-------------- What: payload rule option for hash matching @@ -5829,7 +5857,7 @@ Configuration: 7.76. sid ------------- +-------------- What: rule option to indicate signature number @@ -5842,7 +5870,7 @@ Configuration: 7.77. sip_body ------------- +-------------- What: rule option to set the detection cursor to the request body @@ -5851,7 +5879,7 @@ Type: ips_option 7.78. sip_header ------------- +-------------- What: rule option to set the detection cursor to the SIP header buffer @@ -5861,7 +5889,7 @@ Type: ips_option 7.79. sip_method ------------- +-------------- What: detection option for sip stat code @@ -5874,7 +5902,7 @@ Configuration: 7.80. sip_stat_code ------------- +-------------- What: detection option for sip stat code @@ -5887,7 +5915,7 @@ Configuration: 7.81. so ------------- +-------------- What: rule option to call custom eval function @@ -5900,7 +5928,7 @@ Configuration: 7.82. soid ------------- +-------------- What: rule option to specify a shared object rule ID @@ -5913,7 +5941,7 @@ Configuration: 7.83. ssl_state ------------- +-------------- What: detection option for ssl state @@ -5940,7 +5968,7 @@ Configuration: 7.84. ssl_version ------------- +-------------- What: detection option for ssl version @@ -5965,7 +5993,7 @@ Configuration: 7.85. stream_reassemble ------------- +-------------- What: detection option for stream reassembly control @@ -5984,7 +6012,7 @@ Configuration: 7.86. stream_size ------------- +-------------- What: detection option for stream size checking @@ -5999,7 +6027,7 @@ Configuration: 7.87. tag ------------- +-------------- What: rule option to log additional packets @@ -6016,7 +6044,7 @@ Configuration: 7.88. tos ------------- +-------------- What: rule option to check type of service field @@ -6030,7 +6058,7 @@ Configuration: 7.89. ttl ------------- +-------------- What: rule option to check time to live field @@ -6044,7 +6072,7 @@ Configuration: 7.90. window ------------- +-------------- What: rule option to check TCP window field @@ -6090,7 +6118,7 @@ All output of events and packets is done by Loggers. 10.1. alert_csv ------------- +-------------- What: output event in csv format @@ -6116,7 +6144,7 @@ Configuration: 10.2. alert_fast ------------- +-------------- What: output event with brief text format @@ -6133,7 +6161,7 @@ Configuration: 10.3. alert_full ------------- +-------------- What: output event with full packet dump @@ -6148,9 +6176,24 @@ Configuration: K | M | G } -10.4. alert_syslog +10.4. alert_sfsocket + +-------------- + +What: output event over socket + +Type: logger + +Configuration: + + * string alert_sfsocket.file: name of unix socket file + * int alert_sfsocket.rules[].gid = 1: rule generator ID { 1: } + * int alert_sfsocket.rules[].sid = 1: rule signature ID { 1: } + + +10.5. alert_syslog ------------- +-------------- What: output event to syslog @@ -6168,9 +6211,9 @@ Configuration: cons | ndelay | perror | pid } -10.5. log_codecs +10.6. log_codecs ------------- +-------------- What: log protocols in packet by layer @@ -6183,9 +6226,9 @@ Configuration: * bool log_codecs.msg = false: include alert msg -10.6. log_hext +10.7. log_hext ------------- +-------------- What: output payload suitable for daq hext @@ -6202,9 +6245,9 @@ Configuration: * int log_hext.width = 20: set line width (0 is unlimited) { 0: } -10.7. log_pcap +10.8. log_pcap ------------- +-------------- What: log packet in pcap format @@ -6216,9 +6259,9 @@ Configuration: * enum log_pcap.units = B: bytes | KB | MB | GB { B | K | M | G } -10.8. unified2 +10.9. unified2 ------------- +-------------- What: output event and packet in unified2 format file @@ -6259,7 +6302,7 @@ DAQ modules. There are also 3rd DAQ modules available. 11.1. Building the DAQ Library and DAQ Modules ------------- +-------------- The DAQ is bundled with Snort but must be built first using these steps: @@ -6307,7 +6350,7 @@ configure options, run: 11.2. PCAP Module ------------- +-------------- pcap is the default DAQ. If snort is run w/o any DAQ arguments, it will operate as it always did using this module. These are @@ -6328,7 +6371,7 @@ You can specify the buffer size pcap uses with: 11.3. AFPACKET Module ------------- +-------------- afpacket functions similar to the pcap DAQ but with better performance: @@ -6374,7 +6417,7 @@ PACKET_TX_RING support. 11.4. NFQ Module ------------- +-------------- NFQ is the new and improved way to process iptables packets: @@ -6395,7 +6438,7 @@ Notes on iptables are given below. 11.5. IPQ Module ------------- +-------------- IPQ is the old way to process iptables packets. It replaces the inline version available in pre-2.9 versions built with this: @@ -6423,7 +6466,7 @@ Notes on iptables are given below. 11.6. IPFW Module ------------- +-------------- IPFW is available for BSD systems. It replaces the inline version available in pre-2.9 versions built with this: @@ -6447,7 +6490,7 @@ Notes on FreeBSD and OpenBSD are given below. 11.7. Dump Module ------------- +-------------- The dump DAQ allows you to test the various inline mode features available in 2.9 Snort like injection and normalization. @@ -6474,7 +6517,7 @@ another mode like this: 11.8. Netmap Module ------------- +-------------- The netmap project is a framework for very high speed packet I/O. It is available on both FreeBSD and Linux with varying amounts of @@ -6548,7 +6591,7 @@ TODO: 11.9. Notes on iptables ------------- +-------------- These notes are just a quick reminder that you need to set up iptables to use the IPQ or NFQ DAQs. Doing so may cause problems with @@ -6613,7 +6656,7 @@ defrags the packets before queuing. Also, no need to configure frag3. 11.10. Notes on FreeBSD::IPFW ------------- +-------------- Check the online manual at: @@ -6708,7 +6751,7 @@ The steps to set up NAT with ipfw are as follows: 11.11. Notes on OpenBSD::IPFW ------------- +-------------- OpenBSD supports divert sockets as of 4.7, so we use the ipfw DAQ. @@ -6742,7 +6785,7 @@ Here is one way to set things up: 11.12. Socket Module ------------- +-------------- The socket module provides provides a stream socket server that will accept up to 2 simultaneous connections and bridge them together @@ -6777,7 +6820,7 @@ To use the socket DAQ, start Snort++ like this: 11.13. File Module ------------- +-------------- The file module provides the ability to process files directly w/o having to extract them from pcaps. Use the file module with Snort’s @@ -6796,7 +6839,7 @@ threads with these Snort options: 11.14. Hext Module ------------- +-------------- The hext module generates packets suitable for processing by Snort from hex/plain text. Raw packets include full headers and are @@ -6893,7 +6936,7 @@ Snort++ differs from Snort in the following ways: 12.1. Build Options ------------- +-------------- * configure --with-lib{pcap,pcre}-* → --with-{pcap,pcre}-* * control socket, cs_dir, and users were deleted @@ -6903,7 +6946,7 @@ Snort++ differs from Snort in the following ways: 12.2. Command Line ------------- +-------------- * --pause loads config and waits for resume before processing packets @@ -6930,7 +6973,7 @@ Snort++ differs from Snort in the following ways: 12.3. Conf File ------------- +-------------- * Snort++ has a default unicode.map * Snort++ will not enforce an upper bound on memcaps and the like @@ -6978,7 +7021,7 @@ Snort++ differs from Snort in the following ways: 12.4. Rules ------------- +-------------- * all rules must have a sid * deleted activate / dynamic rules @@ -7012,7 +7055,7 @@ Snort++ differs from Snort in the following ways: 12.5. Output ------------- +-------------- * alert_fast includes packet data by default * all text mode outputs default to stdout @@ -7030,7 +7073,7 @@ Snort++ differs from Snort in the following ways: 12.6. HTTP Profiles ------------- +-------------- This section describes the changes to the Http Inspect config option "profile". @@ -7115,9 +7158,6 @@ can configure can be found by running the following command: snort --help-config http_inspect | grep http_inspect.profile -The new Http Inspect (new_http_inspect) implementation of config -options is still under development. - --------------------------------------------------------------------- @@ -7174,7 +7214,7 @@ capability and then printed as a comment in the rule file. 13.1. Snort2Lua Command Line ------------- +-------------- By default, Snort2Lua will attempt to parse every ‘include’ file and every ‘binding’ file. There is an option to change this @@ -7273,7 +7313,7 @@ Converts the Snort configuration file specified by the -c or 13.2. Known Problems ------------- +-------------- * Any Snort ‘string’ which is dependent on a variable will no longer have that variable in the Lua string. @@ -7301,7 +7341,7 @@ Converts the Snort configuration file specified by the -c or 13.3. Usage ------------- +-------------- Snort2Lua is included in the Snort 3.0 distribution. The Snort2Lua source code is located in the tools/snort2lua directory. The program @@ -7393,7 +7433,7 @@ appended to the original filename. 14.1. Plugins ------------- +-------------- Snort++ uses a variety of plugins to accomplish much of its processing objectives, including: @@ -7419,7 +7459,7 @@ roles. 14.2. Modules ------------- +-------------- The Module is pervasive in Snort+. It is how everything, including plugins, are configured. It also provides access to builtin rules. @@ -7471,7 +7511,7 @@ multiple plugin instances are created which use that Module. 14.3. Inspectors ------------- +-------------- There are several types of inspector, which determines which inspectors are executed when: @@ -7491,7 +7531,7 @@ inspectors are executed when: 14.4. Codecs ------------- +-------------- The Snort3.0 Codecs decipher raw packets. These Codecs are now completely pluggable; almost every Snort3.0 Codec can be built @@ -7677,7 +7717,7 @@ may also be unable to accomplish some of its basic functionality. 14.5. IPS Actions ------------- +-------------- Action plugins specify a builtin action in the API which is used to determine verdict. (Conversely, builtin actions don’t have an @@ -7686,7 +7726,7 @@ associated plugin function.) 14.6. Developers Guide ------------- +-------------- Run doc/dev_guide.sh to generate /tmp/dev_guide.html, an annotated guide to the source tree. @@ -7694,7 +7734,7 @@ guide to the source tree. 14.7. Piglet Test Harness ------------- +-------------- In order to assist with plugin development, an experimental mode called "piglet" mode is provided. With piglet mode, you can call @@ -7740,7 +7780,7 @@ results of each test script. 14.8. Piglet Lua API ------------- +-------------- This section documents the API that piglet exposes to Lua. Refer to the piglet directory in the source tree for examples of usage. @@ -8045,7 +8085,7 @@ with. 15.1. General ------------- +-------------- * Generally try to follow http://google-styleguide.googlecode.com/ svn/trunk/cppguide.xml, but there are some differences documented @@ -8065,7 +8105,7 @@ with. 15.2. C++ Specific ------------- +-------------- * Do not use exceptions. Exception-safe code is non-trivial and we have ported legacy code that makes use of exceptions unwise. @@ -8097,7 +8137,7 @@ with. 15.3. Naming ------------- +-------------- * Use camel case for namespaces, classes, and types like WhizBangPdfChecker. @@ -8108,7 +8148,7 @@ with. 15.4. Comments ------------- +-------------- * Write comments sparingly with a mind towards future proofing. Often the comments can be obviated with better code. Clear code @@ -8154,7 +8194,7 @@ with. 15.5. Logging ------------- +-------------- * Messages intended for the user should not look like debug messages. Eg, the function name should not be included. It is @@ -8166,7 +8206,7 @@ with. 15.6. Types ------------- +-------------- * Use logical types to make the code clearer and to help the compiler catch problems. typedef uint16_t Port; bool foo(Port) is @@ -8203,7 +8243,7 @@ with. 15.7. Macros (aka defines) ------------- +-------------- * In many cases, even in C++, use #define name "value" instead of a const char* const name = "value" because it will eliminate a @@ -8224,7 +8264,7 @@ with. 15.8. Formatting ------------- +-------------- * Try to keep all source files under 2500 lines. 3000 is the max allowed. If you need more lines, chances are that the code needs @@ -8273,7 +8313,7 @@ with. 15.9. Headers ------------- +-------------- * Don’t hesitate to create a new header if it is needed. Don’t lump unrelated stuff into an header because it is convenient. @@ -8331,7 +8371,7 @@ with. 15.10. Warnings ------------- +-------------- * With g++, use at least these compiler flags: @@ -8350,7 +8390,7 @@ with. 15.11. Uncrustify ------------- +-------------- Currently using uncrustify from at https://github.com/bengardner/ uncrustify to reformat legacy code and anything that happens to need @@ -8374,7 +8414,7 @@ uncrustify -c crusty.cfg --replace file.cc 16.1. Terminology ------------- +-------------- * basic module: a module integrated into Snort that does not come from a plugin. @@ -8434,7 +8474,7 @@ uncrustify -c crusty.cfg --replace file.cc 16.2. Usage ------------- +-------------- For the following examples "$my_path" is assumed to be the path to the Snort++ install directory. Additionally, it is assumed that @@ -8564,7 +8604,7 @@ snort -c $my_path/etc/snort/snort.lua --daq afpacket -i "eth0:eth1" \ 16.3. Plugins ------------- +-------------- Load external plugins and use the "ex" alert: @@ -8585,7 +8625,7 @@ END 16.4. Output Files ------------- +-------------- To make it simple to configure outputs when you run with multiple packet threads, output files are not explicitly configured. Instead, @@ -8735,7 +8775,7 @@ The available signals may vary from platform to platform. 16.5. Optional Features ------------- +-------------- The features listed below must be explicitly enabled so they are built into the Snort binary. For a full list of build features, run . @@ -8769,7 +8809,7 @@ libraries see the Getting Started section of the manual. 16.6. Environment Variables ------------- +-------------- * HOSTTYPE: optional string that is output with the version at end of line. @@ -8794,21 +8834,28 @@ libraries see the Getting Started section of the manual. 16.7. Command Line Options ------------- +-------------- * --alert-before-pass process alert, drop, sdrop, or reject before pass; default is pass before alert, drop,… + * -A set alert mode: none, cmg, or alert_* + * -B obfuscated IP addresses in alerts and packet dumps + using CIDR mask * --bpf are standard BPF options, as seen in TCPDump * --c2x output hex for given char (see also --x2c) * --catch-test comma separated list of cat unit test tags or all + * -c use this configuration + * -C print out payloads with character data only (no hex) * --create-pidfile create PID file, even when not in Daemon mode - * --daq select packet acquisition module (default is pcap) * --daq-dir tell snort where to find desired DAQ * --daq-list list packet acquisition modules available in optional dir, default is static modules only + * --daq select packet acquisition module (default is pcap) * --daq-var specify extra DAQ configuration variable + * -d dump the Application Layer * --dirty-pig don’t flush packets on shutdown + * -D run Snort in background (daemon) mode * --dump-builtin-rules [] output stub rules for selected modules * --dump-defaults [] output module defaults in Lua @@ -8817,24 +8864,34 @@ libraries see the Getting Started section of the manual. libraries * --dump-version output the version, the whole version, and only the version + * -e display the second layer header info * --enable-inline-test enable Inline-Test Mode Operation - * --help list command line options + * -f turn off fflush() calls after binary log writes + * -G <0xid> (same as --logid) (0:65535) + * -g run snort gid as group (or gid) after + initialization * --help-commands [] output matching commands (optional) * --help-config [] output matching config options (optional) * --help-counts [] output matching peg counts (optional) + * --help list command line options * --help-module output description of given module * --help-modules list all available modules with brief help * --help-options