hi everyone, Recently I deployed Snort on my pfsense box, everything is going fine(I think) but on snort alerts tab I see a lot of this messages:
05/22/13-10:30:46 3 TCP Unknown Traffic 126.96.36.199 80 188.8.131.52 41052 119:32:1 (http_inspect) SIMPLE REQUEST
05/22/13-10:30:40 3 TCP Unknown Traffic 184.108.40.206 41953 220.127.116.11 80 120:8:1 (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE
05/22/13-10:30:39 3 TCP Unknown Traffic 18.104.22.168 14305 22.214.171.124 80 120:8:1 (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE
05/22/13-10:30:31 3 TCP Unknown Traffic 126.96.36.199 46228 188.8.131.52 80 120:8:1 (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE
I dont know what does it mean.. Could you help me please?
Welcome to the confusing world of the HTTP_INSPECT preprocessor and all of its alerts. Basically Snort's HTTP_INSPECT preprocessor is alerting when some part of a web request or reply does not precisely match the published standards. As you probably are noticing, many legitimate web sites seem to spew poorly constructed HTML. Yahoo is one prime example, but there are others.
You can research these various alert messages on Google and get an explanation of what they mean. Many folks either WHITELIST known good web sites to prevent blocking of them, or they add the GENERATOR ID and SIGNATURE ID of the alert to the Suppress List for the interface.
A third option available is to disable HTTP_INSPECT alerts entirely. There is a checkbox for this on the Preprocessors
tab in Snort.