Actions
Bug #3880
closedhttp parsing/alerting - continue
Affected Versions:
Effort:
Difficulty:
Label:
Description
I am not sure if this is a serious issue - hence putting it to private till otherwise said.
The data is definitely private.
There are a couple of issue (maybe one reason).
(I can share the pcap of course - but it is strictly private :) )
It seems we get 69 anomaly alerts on 20 packet one stream pcap. The amount seems excessive.
It also seems to not to parse the traffic properly.
rm logs/* ;time /opt/suritest/bin/suricata -S /dev/null -l logs/ -k none -r /home/pevma/inthetrenches/Suricata/Bugs/http_continuation_parsing_error.pcapng ; grep '"event_type":"alert"' logs/eve.json |perl -ne 'print "$1\n" if /\"signature\":\"(.*?)\"/' | sort | uniq -c |sort -n -r -t " " -k 1 ; cat logs/eve.json |perl -ne 'print "$1\n" if /\"event_type\":\"(.*?)\"/' | sort | uniq -c | sort -n -r -k 1 ; grep '"event_type":"anomaly"' logs/eve.json | jq .anomaly.event | uniq -c | sort -rn
[972220] 15/8/2020 -- 16:09:34 - (suricata.c:1065) <Notice> (LogVersion) -- This is Suricata version 6.0.0-dev (ac491c6e8 2020-08-07) running in USER mode
[972220] 15/8/2020 -- 16:09:35 - (flow.c:635) <Notice> (FlowInitConfig) -- flow size 328, memcap allows for 409200 flows. Per hash row in perfect conditions 6
[972220] 15/8/2020 -- 16:09:35 - (tm-threads.c:1964) <Notice> (TmThreadWaitOnThreadInit) -- all 9 packet processing threads, 4 management threads initialized, engine started.
[972230] 15/8/2020 -- 16:09:35 - (flow-manager.c:805) <Notice> (FlowManager) -- FM FM#01/0 starting. min_timeout 30s. Full hash pass in 240s
[972220] 15/8/2020 -- 16:09:35 - (suricata.c:2638) <Notice> (SuricataMainLoop) -- Signal Received. Stopping engine.
[972220] 15/8/2020 -- 16:09:35 - (flow-manager.c:1299) <Notice> (FlowDisableFlowRecyclerThread) -- flows to progress: 1
[972221] 15/8/2020 -- 16:09:35 - (source-pcap-file.c:382) <Notice> (ReceivePcapFileThreadExitStats) -- Pcap-file module read 1 files, 20 packets, 9547 bytes
real 0m0.554s
user 0m0.380s
sys 0m0.167s
70 anomaly
2 http
2 fileinfo
1 stats
1 flow
49 "REQUEST_BODY_UNEXPECTED"
20 "REQUEST_BODY_UNEXPECTED"
1 "UNABLE_TO_MATCH_RESPONSE_TO_REQUEST"
grep '"event_type":"http"' logs/eve.json | jq . |more
{
"timestamp": "2020-06-30T07:23:05.652209+0200",
"flow_id": 517714489240655,
"pcap_cnt": 12,
"event_type": "http",
"src_ip": "192.168.0.1",
"src_port": 35137,
"dest_ip": "10.10.10.1",
"dest_port": 8001,
"proto": "TCP",
"tx_id": 0,
"ether": {
"src_mac": "90:1b:0e:a1:1a:33",
"dest_mac": "00:1c:7f:f2:ae:d0"
},
"http": {
"hostname": "OBFUSCATED-ON-PURPOSE",
"url": "/orssv/sbt_catalog/STAMUS1_0fv41eup_1_1/metadata.xml?format=xml&x-BackupType=ArchivedLog&x-BlockSize=262144&x-Chunks=1&x-CloseTime=2020-06-30%2005%3A23%3A05&x-CmpVersion=12.2.0.0.0&x-Compressed=FALSE
&x-CopyNumber=0&x-DbVersion=12.2.0.1.0&x-Dbid=1767827704&x-Dbname=STAMUS1&x-Encrypted=FALSE&x-FileName=STAMUS1_0fv41eup_1_1&x-FileSize=4980736&x-FileType=BackupPiece&x-Incarnation=KTVs8w9V0wwD&x-Incremental=FALS
E&x-NetTest=FALSE&x-Node=test-13-forstamus-1.example.com&x-OpenTime=2020-06-30%2005%3A23%3A05&x-PieceBlockSize=512&x-PieceNo=1&x-PrevOpEnd=2020-06-30%2005%3A23%3A05&x-ReqCnt=4&x-ReqTime=2020-06-30%2005%3A23%3A05
&x-SbtApi=sbtclose2&x-SbtOp=EndUpload&x-SbtVersion=12.2.0.2&x-SessionId=A9475EA89E86717FE0531F01220AFC86&x-SetCount=33807&x-SetStamp=1044429785&x-System=Linux%20x86%2064-bit&x-SystemId=13&x-Tag=AO_STAMUS1_202006
30072302&x-User=oracle",
"http_content_type": "text/html",
"http_method": "PUT",
"protocol": "HTTP/1.1",
"status": 401,
"length": 147
}
}
{
"timestamp": "2020-06-30T07:23:05.663044+0200",
"flow_id": 517714489240655,
"pcap_cnt": 19,
"event_type": "http",
"src_ip": "192.168.0.1",
"src_port": 35137,
"dest_ip": "10.10.10.1",
"dest_port": 8001,
"proto": "TCP",
"tx_id": 1,
"ether": {
"src_mac": "90:1b:0e:a1:1a:33",
"dest_mac": "00:1c:7f:f2:ae:d0"
},
"http": {
"http_port": 0,
"url": "/libhtp::request_uri_not_seen",
"status": 200,
"length": 3
}
}
grep '"event_type":"alert"' logs/eve.json |perl -ne 'print "$1\n" if /\"signature\":\"(.*?)\"/' | sort | uniq -c |sort -n -r -t " " -k 1 ; cat logs/eve.json |perl -ne 'print "$1\n" if /\"event_type\":\"(.*?)\"/' | sort | uniq -c | sort -n -r -k 1 ; grep '"event_type":"anomaly"' logs/eve.json | jq .anomaly.event | uniq -c | sort -rn
70 anomaly
2 http
2 fileinfo
1 stats
1 flow
49 "REQUEST_BODY_UNEXPECTED"
20 "REQUEST_BODY_UNEXPECTED"
1 "UNABLE_TO_MATCH_RESPONSE_TO_REQUEST"
cat logs/stats.log
------------------------------------------------------------------------------------
Date: 8/15/2020 -- 16:09:35 (uptime: 0d, 00h 00m 00s)
------------------------------------------------------------------------------------
Counter | TM Name | Value
------------------------------------------------------------------------------------
decoder.pkts | Total | 20
decoder.bytes | Total | 9547
decoder.ipv4 | Total | 20
decoder.ethernet | Total | 20
decoder.tcp | Total | 20
decoder.avg_pkt_size | Total | 477
decoder.max_pkt_size | Total | 1514
decoder.max_mac_addrs_src | Total | 1
decoder.max_mac_addrs_dst | Total | 1
flow.tcp | Total | 1
flow.wrk.spare_sync_avg | Total | 100
flow.wrk.spare_sync | Total | 1
tcp.sessions | Total | 1
tcp.syn | Total | 1
tcp.synack | Total | 1
app_layer.flow.http | Total | 1
app_layer.tx.http | Total | 2
flow.mgr.full_hash_pass | Total | 1
flow.spare | Total | 9900
flow.mgr.rows_maxlen | Total | 1
flow.mgr.flows_checked | Total | 1
flow.mgr.flows_notimeout | Total | 1
tcp.memuse | Total | 4587520
tcp.reassembly_memuse | Total | 786432
flow.memuse | Total | 7474304
Files
Actions