hi everyone, Recently I deployed Snort on my pfsense box, everything is going fine(I think) but on snort alerts tab I see a lot of this messages:
05/22/13-10:30:46 3 TCP Unknown Traffic 22.214.171.124 80 126.96.36.199 41052 119:32:1 (http_inspect) SIMPLE REQUEST
05/22/13-10:30:40 3 TCP Unknown Traffic 188.8.131.52 41953 184.108.40.206 80 120:8:1 (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE
05/22/13-10:30:39 3 TCP Unknown Traffic 220.127.116.11 14305 18.104.22.168 80 120:8:1 (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE
05/22/13-10:30:31 3 TCP Unknown Traffic 22.214.171.124 46228 126.96.36.199 80 120:8:1 (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE
I dont know what does it mean.. Could you help me please?
Welcome to the confusing world of the HTTP_INSPECT preprocessor and all of its alerts. Basically Snort's HTTP_INSPECT preprocessor is alerting when some part of a web request or reply does not precisely match the published standards. As you probably are noticing, many legitimate web sites seem to spew poorly constructed HTML. Yahoo is one prime example, but there are others.
You can research these various alert messages on Google and get an explanation of what they mean. Many folks either WHITELIST known good web sites to prevent blocking of them, or they add the GENERATOR ID and SIGNATURE ID of the alert to the Suppress List for the interface.
A third option available is to disable HTTP_INSPECT alerts entirely. There is a checkbox for this on the Preprocessors
tab in Snort.