The pfSense Store

Author Topic: snort alerts  (Read 2006 times)

0 Members and 1 Guest are viewing this topic.

Offline demian

  • Jr. Member
  • **
  • Posts: 41
  • Karma: +0/-0
    • View Profile
snort alerts
« on: May 22, 2013, 09:48:07 am »
hi everyone, Recently I deployed Snort on my pfsense box, everything is going fine(I think) but on snort alerts tab I see a lot of this messages:
05/22/13-10:30:46    3    TCP    Unknown Traffic    208.51.35.50    80    200.108.136.46    41052    119:32:1     (http_inspect) SIMPLE REQUEST
05/22/13-10:30:40    3    TCP    Unknown Traffic    200.108.136.46    41953    50.116.194.21    80    120:8:1     (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE
05/22/13-10:30:39    3    TCP    Unknown Traffic    200.108.136.46    14305    50.116.194.21    80    120:8:1     (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE
05/22/13-10:30:31    3    TCP    Unknown Traffic    200.108.136.46    46228    206.191.168.170    80    120:8:1     (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE

I dont  know what does it mean.. Could you help me please?
Thanks!

Offline bmeeks

  • Hero Member
  • *****
  • Posts: 1114
  • Karma: +4/-0
    • View Profile
Re: snort alerts
« Reply #1 on: May 22, 2013, 12:50:10 pm »
hi everyone, Recently I deployed Snort on my pfsense box, everything is going fine(I think) but on snort alerts tab I see a lot of this messages:
05/22/13-10:30:46    3    TCP    Unknown Traffic    208.51.35.50    80    200.108.136.46    41052    119:32:1     (http_inspect) SIMPLE REQUEST
05/22/13-10:30:40    3    TCP    Unknown Traffic    200.108.136.46    41953    50.116.194.21    80    120:8:1     (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE
05/22/13-10:30:39    3    TCP    Unknown Traffic    200.108.136.46    14305    50.116.194.21    80    120:8:1     (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE
05/22/13-10:30:31    3    TCP    Unknown Traffic    200.108.136.46    46228    206.191.168.170    80    120:8:1     (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE

I dont  know what does it mean.. Could you help me please?
Thanks!

Welcome to the confusing world of the HTTP_INSPECT preprocessor and all of its alerts.  Basically Snort's HTTP_INSPECT preprocessor is alerting when some part of a web request or reply does not precisely match the published standards.  As you probably are noticing, many legitimate web sites seem to spew poorly constructed HTML.  Yahoo is one prime example, but there are others.

You can research these various alert messages on Google and get an explanation of what they mean.  Many folks either WHITELIST known good web sites to prevent blocking of them, or they add the GENERATOR ID and SIGNATURE ID of the alert to the Suppress List for the interface.

A third option available is to disable HTTP_INSPECT alerts entirely.  There is a checkbox for this on the Preprocessors tab in Snort.

Bill

Offline demian

  • Jr. Member
  • **
  • Posts: 41
  • Karma: +0/-0
    • View Profile
Re: snort alerts
« Reply #2 on: May 22, 2013, 02:50:11 pm »
Thanks!!
Appreciate it!!


Offline simi8

  • Newbie
  • *
  • Posts: 6
  • Karma: +0/-0
    • View Profile
Re: snort alerts
« Reply #3 on: May 22, 2013, 03:02:27 pm »
thanks, it was useful also for me!