Project

General

Profile

Actions

Support #1588

closed

drop event on bittorrent is not working.

Added by Jeevan Nailwal over 8 years ago. Updated almost 8 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Affected Versions:
Label:

Description

Hi All,
while testing latest code of suricata, I compiled and executed the suricata with a small change in rule for bitorrent( basically changed the alert to drop and added my name in all messages )

I can see the message from the rules files. like:

11/03/2015-16:24:57.101776 [wDrop] [**] [1:2008581:3] Jeevan: ET P2P BitTorrent DHT ping request [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {UDP} 172.16.1.82:6881 -> 115.201.76.134:16001

11/03/2015-16:23:12.435275 [wDrop] [**] [1:2011699:4] Jeevan: ET P2P Bittorrent P2P Client User-Agent (Transmission/1.x) [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 172.16.1.82:37340 -> 91.216.110.47:80

As you can see, I am getting the drop messages for ping and other messages, but on other hand, my torrent file is also getting downloaded(log file attached). I tried different torrent client, but result was same. As per me, these packets should drop and no further packets should be allowed to downloaded from my client. Can you please suggest me what am I missing here? or is it suricata's bug, to unable to detect certain torrent packets?

Attaching the fast.log.


Files

fast.log (35.9 KB) fast.log log file which contains wdrop messages Jeevan Nailwal, 11/04/2015 12:39 AM
Actions #1

Updated by Andreas Herz about 8 years ago

  • Tracker changed from Bug to Support
  • Priority changed from Urgent to Normal

How do you run/start suricata?

This looks like simple monitoring mode with "wDrop" meaning (would drop). So you want to use Suricata in IPS mode?

Actions #2

Updated by Victor Julien almost 8 years ago

  • Status changed from New to Closed
Actions

Also available in: Atom PDF