RE: [Snort-users] Quick questions about recieved packets

permalink · #1 (**permalink**) 10-26-2005

This is a multi-part message in MIME format.

------_=_NextPart_001_01C5DA38.1D3EF739
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

What kind of NIC's are you using on the Sensor? I have had some issues
with certain cards (mostly Realteks) on Linux, the Intel NIC's seem to
work the best and you can enable device polling (NAPI) in the kernel for
some of these cards as well which will boost performance.

________________________________

From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Joseph
Nicholson
Sent: Wednesday, October 26, 2005 8:25 AM
To: snort-users@lists.sourceforge.net
Subject: Re: [Snort-users] Quick questions about recieved packets

I was afraid of that.
=20
I have snort plugged into a Cisco 3560G Switch on a mirrored port. I am
mirroring 10 other ports on the switch currently. This is my core
switch and brings about 5 different network segments together. I am
using the Official Snort Rules and the Bleeding Snort Rules. Snort is
setup to kick out the Alerts via Syslog. The local Syslog function in
Linux is setup to send the Alerts to a Syslog appliance that parses all
of my logs for me.=20
=20
For testing I setup Snort to output Alerts via unified logging and that
didn't help any. I currently have both Tx and Rx being mirrored to my
monitoring port. I tried just Tx and just Rx and got the same result.
The monitor port is a Gigabit port and the monitoring ethernet port is
running at a Gigabit also. On the linux appliance that port is running
in promiscuous mode and has no IP. I have a management interface on the
box also that I use to send the syslog files across and that I log into
to manage the box.=20
=20
Any thoughts or suggestions would be appreciated. This is the first
production Sensor I have setup. All my testing sensors apparently
didn't have enough traffic being pushed at them.

=20
On 10/26/05, Richard Bejtlich <taosecurity@gmail.com> wrote:=20

Joseph Nicholson wrote:
=09
>I see that snort dropped 179457 packets because it couldn't
process them.=20
> Snort received 186246 packets
> Analyzed: 6789(3.645%)
> Dropped: 179457(96.355%)
> My gut instinct is telling me that it dropped 179457 packets
because it
> felt there was no threat from them and that the 6789 it
analyzed looked=20
> suspicious.
=09
Hi Joseph,
=09
You have a serious problem with your Snort deployment. The
packets
Snort dropped were never inspected, period.
=09
Can you describe your configuration? Are you sending Snort
alerts=20
directly to a database, without Barnyard? Are you running any
odd
rules?
=09
Sincerely,
=09
Richard
http://www.taosecurity.com
=09

--=20
Joseph Nicholson=20

------_=_NextPart_001_01C5DA38.1D3EF739
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2900.2769" name=3DGENERATOR></HEAD>
<BODY>
<DIV dir=3Dltr align=3Dleft><SPAN class=3D110122014-26102005><FONT =
face=3DArial=20
color=3D#0000ff size=3D2>What kind of NIC's are you using on the =
Sensor?  I=20
have had some issues with certain cards (mostly Realteks) on Linux, the =
Intel=20
NIC's seem to work the best and you can enable device polling (NAPI) in =
the=20
kernel for some of these cards as well which will boost=20
performance.</FONT></SPAN></DIV><BR>
<DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr align=3Dleft>
<HR tabIndex=3D-1>
<FONT face=3DTahoma size=3D2><B>From:</B> =
snort-users-admin@lists.sourceforge.net=20
[mailto:snort-users-admin@lists.sourceforge.net] <B>On Behalf Of =
</B>Joseph=20
Nicholson<BR><B>Sent:</B> Wednesday, October 26, 2005 8:25 =
AM<BR><B>To:</B>=20
snort-users@lists.sourceforge.net<BR><B>Subject:</B> Re: [Snort-users] =
Quick=20
questions about recieved packets<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV>I was afraid of that.</DIV>
<DIV> </DIV>
<DIV>I have snort plugged into a Cisco 3560G Switch on a mirrored =
port.  I=20
am mirroring 10 other ports on the switch currently.  This is my =
core=20
switch and brings about 5 different network segments together.  I =
am using=20
the Official Snort Rules and the Bleeding Snort Rules.  Snort is =
setup to=20
kick out the Alerts via Syslog.  The local Syslog function in Linux =
is=20
setup to send the Alerts to a Syslog appliance that parses all of my =
logs for=20
me. </DIV>
<DIV> </DIV>
<DIV>For testing I setup Snort to output Alerts via unified logging and =
that=20
didn't help any.  I currently have both Tx and Rx being mirrored to =
my=20
monitoring port.  I tried just Tx and just Rx and got the same=20
result.  The monitor port is a Gigabit port and the monitoring =
ethernet=20
port is running at a Gigabit also.  On the linux appliance that =
port is=20
running in promiscuous mode and has no IP.  I have a management =
interface=20
on the box also that I use to send the syslog files across and that I =
log into=20
to manage the box. </DIV>
<DIV> </DIV>
<DIV>Any thoughts or suggestions would be appreciated.  This is the =
first=20
production Sensor I have setup.  All my testing sensors apparently =
didn't=20
have enough traffic being pushed at them.<BR><BR> </DIV>
<DIV><SPAN class=3Dgmail_quote>On 10/26/05, <B =
class=3Dgmail_sendername>Richard=20
Bejtlich</B> <<A=20
href=3D"mailto:taosecurity@gmail.com">taosecurity@ gmail.com</A>> =
wrote:</SPAN>=20
<BLOCKQUOTE class=3Dgmail_quote=20
style=3D"PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc =
1px solid">Joseph=20
Nicholson wrote:<BR><BR>>I see that snort dropped 179457 packets =
because it=20
couldn't process them. <BR>> Snort received 186246 packets<BR>>=20
Analyzed: 6789(3.645%)<BR>> Dropped: 179457(96.355%)<BR>> My gut =

instinct is telling me that it dropped 179457 packets because =
it<BR>> felt=20
there was no threat from them and that the 6789 it analyzed looked =
<BR>>=20
suspicious.<BR><BR>Hi Joseph,<BR><BR>You have a serious problem with =
your=20
Snort deployment.  The packets<BR>Snort dropped were never=20
inspected, period.<BR><BR>Can you describe your =
configuration?  Are=20
you sending Snort alerts <BR>directly to a database, without=20
Barnyard?  Are you running any=20
odd<BR>rules?<BR><BR>Sincerely,<BR><BR>Richard<BR> <A=20
=
href=3D"http://www.taosecurity.com">http://www.taosecurity.com</A><BR></B=
LOCKQUOTE></DIV><BR><BR=20
clear=3Dall><BR>-- <BR>Joseph Nicholson </BODY></HTML>

------_=_NextPart_001_01C5DA38.1D3EF739--

-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.
Get Certified Today * Register for a JBoss Training Course
Free Certification Exam for All Training Attendees Through End of 2005
Visit http://www.jboss.com/services/certification for more information
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode