IP Blacklisting Version 2 for Snort 2.8.4.1 available

I found myself with 9 hours to kill on an airplane ride this weekend so I coded up the two features I've been hearing the most for the original IP Blacklisting patch I wrote. The first new feature was to be able to associate a name with a blacklist and have that name produced in the event that Snort outputs. The second feature was to be able to load blacklists from external files so that very large blacklists could be maintained without having to modify the snort.conf file.

Both of these features are now available in version 2 of the patch. Direct loading of the IP address lists from the snort.conf preprocessor directive is no longer supported, you have to use the external files.

Here is a sample directive for snort.conf:

preprocessor iplist: blacklist dshield /etc/snort/dshield.blacklist \
       blacklist sourcefire /etc/snort/sourcefire.blacklist \
       whitelist /etc/snort/default.whitelist

And here is a sample blacklist file:

# This is a blacklist file, there are many like it but this one is mine
# Comments are supported
10.1.1.0/24 192.168.0.0/16  # I can do inline comments too and put
       # multiple CIDR blocks on one line
172.16.16.17/32
172.16.15.14/32             # Whatever you like

As per usual, bug reports and feature requests can be sent directly to me. I still haven't done any performance testing of this code so your mileage may vary. I'd be interested to hear of any comparisons of the performance of this code vs the Emerging Threats blacklist.

Tested on Ubuntu, Fedora and OS X only so far.

You can get the patch here:

http://www.snort.org/users/roesch/code/iplist.patch.v2.tgz

Technorati Tags:
cybersecurity, open source, snort, sourcefire, tools

IP Blacklisting for Snort 2.8.4.1 available

After a discussion on the Snort-users mailing list last week regarding using standard Snort rules to implement Reputation-based IP blocking in Snort (and how badly the performance sucked) I decided to write some code to do it the "right way". The result is the "iplist" preprocessor, a module that supports IP Blacklisting and whitelisting via user-provided lists of known hostile IP addresses.

The internals of the system use the Patricia Trie code from the Snort 3.0 code tree to provide the primary address lookup mechanism. Currently I'm only supporting IPv4 addresses although the P-Trie code supports IPv6 addressing too.

This patch has been applied against Snort 2.8.4.1 only. I've tested
builds on OS X, Ubuntu and Fedora so far. It requires libdnet (or
dumbnet-dev for those of you on Debian-based distros) to build
properly. Check the README file that comes with it for instructions
on patching it into your codebase. It supports inline blocking and
alerting but not Flexresp-style TCP reset session shootdowns.

Have a look and let me know what features you'd like or bugs you find.

This code is purely EXPERIMENTAL, this is just me spending some of my
spare time doing a fun coding project so if your machine sprouts legs
and refuses to work until it receives part of the TARP bailout it's
not my fault.

Here's the link:

http://www.snort.org/users/roesch/code/iplist.patch.tgz

Technorati Tags:
open source, sourcefire, tools, snort, cybersecurity

Daemonlogger 1.2.1 Released (and, oh yeah, 1.2.0)

Daemonlogger 1.2.1 is available at its usual place. This release is a cleanup that allows compilation to work properly on systems which don't support the BSD TAILQ macros (like some Linux's).

I also neglected to announce the release of Deamonlogger 1.2.0. That release changed the default pruning mechanism for ringbuffer mode back to the original default of pruning the oldest file in the logging directory and allows you to do per-run pruning by setting the -z switch at the command line. It also repaired a bug with size-based rollovers not working properly.

Get Daemonlogger here.

Daemonlogger 1.1 Released!

Daemonlogger 1.1 is available on my personal site for those of you interested in packet logging and network tapping. New features include:

Rollover size command line shortcuts (e.g. "-s 1M" vs "-s 1048576")

Disk utilization-based ringbuffer rollovers. For example, you can now tell Daemonlogger to write pcap files until the disk is 90% full and then "eat its tail" by deleting the oldest pcap file in the logging directory.

I also fixed a bug that was found by Wesley Shields to prevent Daemonlogger from pruning files collected by previous runs of the software that were in its logging directory. This should also make it safe to have multiple instances of Daemonlogger write to the same logging directory without interfering with one another.

Enjoy!

Technorati Tags:
open source, sourcefire, tools, daemonlogger

Daemonlogger 1.0 released

Daemonlogger 1.0 is available on my user page on snort.org. It's got a couple new features but nothing major, if you're a Daemonlogger fan it's definitely worth a download!