L83.en

IPS, Snort inline

IPS
Packet
Acquisition
PCAP
AFPACKET
NFQ
NFQ
IPS Action
replace
IPS procon

• Snort traditionally only rises alerts and logs traffic
• In IPS mode snort is able to drop packets
• The network flow must go through Snort; Snort inline
• ./snort -Q
• ./snort --daq-mode inline

Packet Acquisition

IPS
Packet
Acquisition
PCAP
AFPACKET
NFQ
NFQ
IPS Action
replace
IPS procon

• DAQ: Data AcQuisition library
• The way Snort grabs the data packets
• Snort may use several DAQ-methods
• --daq-mode <mode>
• <mode> = read-file | passive | inline
• --daq <type>
• <type> = pcap | afpacket |

nfq

PCAP

IPS
Packet
Acquisition
PCAP
AFPACKET
NFQ
NFQ
IPS Action
replace
IPS procon

• PCAP = Packet CAPture library
• API for capturing network packets
• *nix implementation: libpcap
• Windows: WinPcap
• Used by: tcpdump, Wireshark, Snort, nmap, Bro, Suricata
• pcap is the default snort DAQ
• ./snort --daq pcap --daq-mode passive

AFPACKET

IPS
Packet
Acquisition
PCAP
AFPACKET
NFQ
NFQ
IPS Action
replace
IPS procon

• Can run Snort in inline mode using afpacket
• ./snort --daq afpacket -i eth0:eth1
• Must have two network interfaces configured as a bridge,

eth0:eth1

IPS
Packet
Acquisition
PCAP
AFPACKET
NFQ
NFQ
IPS Action
replace
IPS procon

NFQ, NetFilter Queue

• snort is running in user mode (is not a kernel module)
• needs nfqueue kernel module
• iptables sends traffic to snort using the NFQUEUE target
iptables -A FORWARD -j NFQUEUE
• sends all traffic to the NFQUEUE target
• Sends the packet from kernel space to user space (to snort)
• Snort may then decide to drop a packet
• Returns the other packets to the kernel, but not to netfilter
• All packets blocked if Snort is not running

NFQ

IPS
Packet
Acquisition
PCAP
AFPACKET
NFQ
NFQ
IPS Action
replace
IPS procon

snort --daq nfq --daq-var queue=0 -Q \
-l /var/log/snort -c /usr/local/snort/etc/snort.conf

–daq nfq Use NFQ, NetFilter Queue
–daq-var queue=0 Default NFQ queue number
-Q - inline mode
iptables -A INPUT -p tcp --dport 80 -j NFQUEUE --queue-num 2

Snort IPS action

IPS
Packet
Acquisition
PCAP
AFPACKET
NFQ
NFQ
IPS Action
replace
IPS procon

• drop Tell iptables to drop the packet and log it via usual Snort

means
• reject Tell iptables to drop the packet, log it via usual Snort

means, and send a TCP reset if the protocol is TCP or an icmp
port unreachable if the protocol is UDP
• sdrop The sdrop rule type will tell iptables to drop the packet.

Nothing is logged

replace

IPS
Packet
Acquisition
PCAP
AFPACKET
NFQ
NFQ
IPS Action
replace
IPS procon

alert ip any any -> any 80 (msg:"replacing string passwd ";\
content: "passwd"; replace: ".paswd" ; sid:1000001)
• The string matched by content: is replaced by the replace-string
• Snort must run in inline mode
• The number of characters of the replacement string must be

exactly the same

IPS
Packet
Acquisition
PCAP
AFPACKET
NFQ
NFQ
IPS Action
replace
IPS procon

Intrusion Prevension Systems:
• Stops and avoids attacks (not just alerts)
PRO
• A false positive may block a legitimate user/host
CON
• An attacker may try to cause some form of denial of service

attack