SNORT(8) SNORT(8) NNAAMMEE Snort - open source network intrusion detection system SSYYNNOOPPSSIISS ssnnoorrtt [[--bbCCddDDeeGGIINNooOOppqqssTTUUvvVVxxXXyyzz??]] [[--AA _a_l_e_r_t_-_m_o_d_e ]] [[--BB _a_d_d_r_e_s_s_-_c_o_n_v_e_r_- _s_i_o_n_-_m_a_s_k ]] [[--cc _r_u_l_e_s_-_f_i_l_e ]] [[--FF _b_p_f_-_f_i_l_e ]] [[--gg _g_r_p_n_a_m_e ]] [[--hh _h_o_m_e_-_n_e_t ]] [[--ii _i_n_t_e_r_f_a_c_e ]] [[--kk _c_h_e_c_k_s_u_m_-_m_o_d_e ]] [[--ll _l_o_g_-_d_i_r ]] [[--LL _b_i_n_-_l_o_g_-_f_i_l_e ]] [[--mm _u_m_a_s_k ]] [[--MM _s_m_b_-_h_o_s_t_s_-_f_i_l_e ]] [[--nn _p_a_c_k_e_t_-_c_o_u_n_t ]] [[--PP _s_n_a_p_-_l_e_n_g_t_h ]] [[--rr _t_c_p_d_u_m_p_-_f_i_l_e ]] [[--SS _v_a_r_i_a_b_l_e_=_v_a_l_u_e ]] [[--tt _c_h_r_o_o_t___d_i_r_e_c_t_o_r_y ]] [[--uu _u_s_r_- _n_a_m_e ]] _e_x_p_r_e_s_s_i_o_n DDEESSCCRRIIPPTTIIOONN SSnnoorrtt is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP net- works. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fin- gerprinting attempts, and much more. Snort uses a flexible rules lan- guage to describe traffic that it should collect or pass, as well as a detection engine that utilizes a modular plugin architecture. Snort also has a modular real-time alerting capability, incorporating alert- ing and logging plugins for syslog, a ASCII text files, UNIX sockets, WinPopup messages to Windows clients using Samba's smbclient, database (Mysql/PostgreSQL/Oracle/ODBC) or XML. Snort has three primary uses. It can be used as a straight packet sniffer like ttccppdduummpp(1), a packet logger (useful for network traffic debugging, etc), or as a full blown network intrusion detection system. Snort logs packets in ttccppdduummpp(1) binary format, to a database or in Snort's decoded ASCII format to a hierarchy of logging directories that are named based on the IP address of the "foreign" host. OOPPTTIIOONNSS -A alert-mode Alert using the specified _a_l_e_r_t_-_m_o_d_e_. Valid alert modes include ffaasstt,, ffuullll,, nnoonnee,, and uunnssoocckk.. FFaasstt writes alerts to the default "alert" file in a single-line, syslog style alert message. FFuullll writes the alert to the "alert" file with the full decoded header as well as the alert message. NNoonnee turns off alerting. UUnnssoocckk is an experimental mode that sends the alert information out over a UNIX socket to another process that attaches to that socket. -b Log packets in a ttccppdduummpp(1) formatted file. All packets are logged in their native binary state to a tcpdump formatted log file named with the snort start timestamp and "snort.log". This option results in much faster operation of the program since it doesn't have to spend time in the packet binary->text converters. Snort can keep up pretty well with 100Mbps networks in '-b' mode. To choose an alternate name for the binary log file, use the '-L' switch. -B address-conversion-mask Convert all IP addresses in _h_o_m_e_-_n_e_t to addresses specified by _a_d_d_r_e_s_s_-_c_o_n_v_e_r_s_i_o_n_-_m_a_s_k_. Used to obfuscate IP addresses within binary logs. Specify _h_o_m_e_-_n_e_t with the '-h' switch. Note this is nnoott the same as $HOME_NET. -c config-file Use the rules located in file _c_o_n_f_i_g_-_f_i_l_e_. -C Print the character data from the packet payload only (no hex). -d Dump the application layer data when displaying packets in ver- bose or packet logging mode. -D Run Snort in daemon mode. Alerts are sent to /var/log/snort/alert unless otherwise specified. -e Display/log the link layer packet headers. -F bpf-file Read BPF filters from _b_p_f_-_f_i_l_e_. This is handy for people run- ning Snort as a SHADOW replacement or with a love Of super com- plex BPF filters. See the "expressions" section of this man page for more info on writing BPF fileters. -g group Change the group/GID Snort runs under to _g_r_o_u_p after initializa- tion. This switch allows Snort to drop root priveleges after it's initialization phase has completed as a security measure. -h home-net Set the "home network" to _h_o_m_e_-_n_e_t_. The format of this address variable is a network prefix plus a CIDR block, such as 192.168.1.0/24. Once this variable is set, all decoded packet logging will be done relative to the home network address space. This is useful because of the way that Snort formats its ASCII log data. With this value set to the local network, all decoded output will be logged into decode directories with the address of the foreign computer as the directory name, which is very useful during traffic analysis. -i interface Sniff packets on _i_n_t_e_r_f_a_c_e_. -I Print out the receiving interface name in alerts. -k checksum-mode Tune the internal checksum verification functionality with _a_l_e_r_t_-_m_o_d_e_. Valid checksum modes include aallll,, nnooiipp,, nnoottccpp,, nnoouuddpp,, nnooiiccmmpp,, and nnoonnee.. AAllll activates checksum verification for all supported protocols. NNooiipp turns off IP checksum verifi- cation, which is handy if the gateway router is already dropping packets that fail their IP checksum checks. NNoottccpp turns off TCP checksum verification, all other checksum modes are oonn.. nnoouuddpp turns off UDP checksum verification. NNooiiccmmpp turns off ICMP checksum verification. NNoonnee turns off the entire checksum veri- fication subsystem. -l log-dir Set the output logging directory to _l_o_g_-_d_i_r_. All plain text alerts and packet logs go into this directory. If this option is not specified, the default logging directory is set to /var/log/snort. -L binary-log-file Set the filename of the binary log file to _b_i_n_a_r_y_-_l_o_g_-_f_i_l_e_. If this switch is not used, the default name is a timestamp for the time that the file is created plus "snort.log". -M smb-hosts-file Send WinPopup messages to the list of workstations contained in the _s_m_b_-_h_o_s_t_s_-_f_i_l_e _. This option requires Samba to be resident and in the path of the machine running Snort. The workstation file is simple: each line of the file contains the SMB name of the box to send the message to. -m umask Set the file mode creation mask to _u_m_a_s_k -n packet-count Process _p_a_c_k_e_t_-_c_o_u_n_t packets and exit. -N Turn off packet logging. The program still generates alerts normally. -o Change the order in which the rules are applied to packets. Instead of being applied in the standard Alert->Pass->Log order, this will apply them in Pass->Alert->Log order. -O Obfuscate the IP addresses when in ASCII packet dump mode. This switch changes the IP addresses that get printed to the screen/log file to "xxx.xxx.xxx.xxx". If the homenet address switch is set (-h), only addresses on the homenet will be obfus- cated while non- homenet IPs will be left visible. Perfect for posting to your favorite security mailing list! -p Turn off promiscuous mode sniffing. -P snap-length Set the packet snaplen to _s_n_a_p_-_l_e_n_g_t_h -q Quiet operation. Don't display banner and initialization infor- mation. -r tcpdump-file Read the tcpdump-formatted file _t_c_p_d_u_m_p_-_f_i_l_e_. This will cause Snort to read and process the file fed to it. This is useful if, for instance, you've got a bunch of SHADOW files that you want to process for content, or even if you've got a bunch of reassembled packet fragments which have been written into a tcp- dump formatted file. -s Send alert messages to syslog. On linux boxen, they will appear in /var/log/secure, /var/log/messages on many other platforms. -S variable=value Set variable name "variable" to value "value". This is useful for setting the value of a defined variable name in a Snort rules file to a command line specified value. For instance, if you define a HOME_NET variable name inside of a Snort rules file, you can set this value from it's predefined value at the command line. -t chroot Changes Snort's root directory to _c_h_r_o_o_t after initialization. Please note that all log/alert filenames are relative to the chroot directory if chroot is used. -T Snort will start up in self-test mode, checking all the supplied command line switches and rules files that are handed to it and indicating that everything is ready to proceed. This is a good switch to use if daemon mode is going to be used, it verifies that the Snort configuration that is about to be used is valid and won't fail at run time. -u user Change the user/UID Snort runs under to _u_s_e_r after initializa- tion. -U Changes the timestamp in all logs to be in UTC -v Be verbose. Prints packets out to the console. There is one big problem with verbose mode: it's slow. If you are doing IDS work with Snort, ddoonn''tt use the '-v' switch, you WWIILLLL drop pack- ets. -V Show the version number and exit. -X Dump the raw packet data starting at the link layer. This switch overrides the -y Include the year in alert and log files -z The -z switch is used in concert with the stream4 preprocessor code. It takes advantage of stream4's stateful inspection capa- bilities to reduce the amount of spoofing that may be done against Snort. By default, snort doesn't worry about the TCP state of a packet when it's about to issue an alert. The -z switch tells Snort to only allow alerts to be generated for packets that are ppaarrtt ooff aa kknnoowwnn,, eessttaabblliisshheedd sseessssiioonn.. This allows Snort to greatly reduce the effect of anti-NIDS tools like ssttiicckk and ssnnoott.. -? Show the program usage statement and exit. _e_x_p_r_e_s_s_i_o_n selects which packets will be dumped. If no _e_x_p_r_e_s_s_i_o_n is given, all packets on the net will be dumped. Otherwise, only packets for which _e_x_p_r_e_s_s_i_o_n is `true' will be dumped. The _e_x_p_r_e_s_s_i_o_n consists of one or more _p_r_i_m_i_t_i_v_e_s_. Primitives usually consist of an _i_d (name or number) preceded by one or more qualifiers. There are three different kinds of qualifier: _t_y_p_e qualifiers say what kind of thing the id name or number refers to. Possible types are hhoosstt, nneett and ppoorrtt. E.g., `host foo', `net 128.3', `port 20'. If there is no type qualifier, hhoosstt is assumed. _d_i_r qualifiers specify a particular transfer direction to and/or from _i_d_. Possible directions are ssrrcc, ddsstt, ssrrcc oorr ddsstt and ssrrcc aanndd ddsstt. E.g., `src foo', `dst net 128.3', `src or dst port ftp-data'. If there is no dir quali- fier, ssrrcc oorr ddsstt is assumed. For `null' link layers (i.e. point to point protocols such as slip) the iinnbboouunndd and oouuttbboouunndd qualifiers can be used to specify a desired direction. _p_r_o_t_o qualifiers restrict the match to a particular protocol. Possible protos are: eetthheerr, ffddddii, iipp, aarrpp, rraarrpp, ddeeccnneett, llaatt, ssccaa, mmoopprrcc, mmooppddll, ttccpp and uuddpp. E.g., `ether src foo', `arp net 128.3', `tcp port 21'. If there is no proto qualifier, all protocols consistent with the type are assumed. E.g., `src foo' means `(ip or arp or rarp) src foo' (except the latter is not legal syntax), `net bar' means `(ip or arp or rarp) net bar' and `port 53' means `(tcp or udp) port 53'. [`fddi' is actually an alias for `ether'; the parser treats them identically as meaning ``the data link level used on the speci- fied network interface.'' FDDI headers contain Ethernet-like source and destination addresses, and often contain Ethernet- like packet types, so you can filter on these FDDI fields just as with the analogous Ethernet fields. FDDI headers also con- tain other fields, but you cannot name them explicitly in a fil- ter expression.] In addition to the above, there are some special `primitive' keywords that don't follow the pattern: ggaatteewwaayy, bbrrooaaddccaasstt, lleessss, ggrreeaatteerr and arithmetic expressions. All of these are described below. More complex filter expressions are built up by using the words aanndd, oorr and nnoott to combine primitives. E.g., `host foo and not port ftp and not port ftp-data'. To save typing, identical qualifier lists can be omitted. E.g., `tcp dst port ftp or ftp- data or domain' is exactly the same as `tcp dst port ftp or tcp dst port ftp-data or tcp dst port domain'. Allowable primitives are: ddsstt hhoosstt _h_o_s_t True if the IP destination field of the packet is _h_o_s_t, which may be either an address or a name. ssrrcc hhoosstt _h_o_s_t True if the IP source field of the packet is _h_o_s_t. hhoosstt _h_o_s_t True if either the IP source or destination of the packet is _h_o_s_t. Any of the above host expressions can be prepended with the keywords, iipp, aarrpp, or rraarrpp as in: iipp hhoosstt _h_o_s_t which is equivalent to: eetthheerr pprroottoo _\_i_p aanndd hhoosstt _h_o_s_t If _h_o_s_t is a name with multiple IP addresses, each address will be checked for a match. eetthheerr ddsstt _e_h_o_s_t True if the ethernet destination address is _e_h_o_s_t. _E_h_o_s_t may be either a name from /etc/ethers or a number (see _e_t_h_e_r_s(3N) for numeric format). eetthheerr ssrrcc _e_h_o_s_t True if the ethernet source address is _e_h_o_s_t. eetthheerr hhoosstt _e_h_o_s_t True if either the ethernet source or destination address is _e_h_o_s_t. ggaatteewwaayy _h_o_s_t True if the packet used _h_o_s_t as a gateway. I.e., the ethernet source or destination address was _h_o_s_t but nei- ther the IP source nor the IP destination was _h_o_s_t. _H_o_s_t must be a name and must be found in both /etc/hosts and /etc/ethers. (An equivalent expression is eetthheerr hhoosstt _e_h_o_s_t aanndd nnoott hhoosstt _h_o_s_t which can be used with either names or numbers for _h_o_s_t _/ _e_h_o_s_t.) ddsstt nneett _n_e_t True if the IP destination address of the packet has a network number of _n_e_t. _N_e_t may be either a name from /etc/networks or a network number (see _n_e_t_w_o_r_k_s_(_4_) for details). ssrrcc nneett _n_e_t True if the IP source address of the packet has a network number of _n_e_t. nneett _n_e_t True if either the IP source or destination address of the packet has a network number of _n_e_t. nneett _n_e_t mmaasskk _m_a_s_k True if the IP address matches _n_e_t with the specific net- mask. May be qualified with ssrrcc or ddsstt. nneett _n_e_t/_l_e_n True if the IP address matches _n_e_t a netmask _l_e_n bits wide. May be qualified with ssrrcc or ddsstt. ddsstt ppoorrtt _p_o_r_t True if the packet is ip/tcp or ip/udp and has a destina- tion port value of _p_o_r_t. The _p_o_r_t can be a number or a name used in /etc/services (see _t_c_p(4P) and _u_d_p(4P)). If a name is used, both the port number and protocol are checked. If a number or ambiguous name is used, only the port number is checked (e.g., ddsstt ppoorrtt 551133 will print both tcp/login traffic and udp/who traffic, and ppoorrtt ddoommaaiinn will print both tcp/domain and udp/domain traf- fic). ssrrcc ppoorrtt _p_o_r_t True if the packet has a source port value of _p_o_r_t. ppoorrtt _p_o_r_t True if either the source or destination port of the packet is _p_o_r_t. Any of the above port expressions can be prepended with the keywords, ttccpp or uuddpp, as in: ttccpp ssrrcc ppoorrtt _p_o_r_t which matches only tcp packets whose source port is _p_o_r_t. lleessss _l_e_n_g_t_h True if the packet has a length less than or equal to _l_e_n_g_t_h. This is equivalent to: lleenn <<== _l_e_n_g_t_h.. ggrreeaatteerr _l_e_n_g_t_h True if the packet has a length greater than or equal to _l_e_n_g_t_h. This is equivalent to: lleenn >>== _l_e_n_g_t_h.. iipp pprroottoo _p_r_o_t_o_c_o_l True if the packet is an ip packet (see _i_p(4P)) of proto- col type _p_r_o_t_o_c_o_l. _P_r_o_t_o_c_o_l can be a number or one of the names _i_c_m_p, _i_g_r_p, _u_d_p, _n_d, or _t_c_p. Note that the identifiers _t_c_p, _u_d_p, and _i_c_m_p are also keywords and must be escaped via backslash (\), which is \\ in the C-shell. eetthheerr bbrrooaaddccaasstt True if the packet is an ethernet broadcast packet. The _e_t_h_e_r keyword is optional. iipp bbrrooaaddccaasstt True if the packet is an IP broadcast packet. It checks for both the all-zeroes and all-ones broadcast conven- tions, and looks up the local subnet mask. eetthheerr mmuullttiiccaasstt True if the packet is an ethernet multicast packet. The _e_t_h_e_r keyword is optional. This is shorthand for `eetthheerr[[00]] && 11 !!== 00'. iipp mmuullttiiccaasstt True if the packet is an IP multicast packet. eetthheerr pprroottoo _p_r_o_t_o_c_o_l True if the packet is of ether type _p_r_o_t_o_c_o_l. _P_r_o_t_o_c_o_l can be a number or a name like _i_p, _a_r_p, or _r_a_r_p. Note these identifiers are also keywords and must be escaped via backslash (\). [In the case of FDDI (e.g., `ffddddii pprroottooccooll aarrpp'), the protocol identification comes from the 802.2 Logical Link Control (LLC) header, which is usually layered on top of the FDDI header. _T_c_p_d_u_m_p assumes, when filtering on the protocol identifier, that all FDDI packets include an LLC header, and that the LLC header is in so-called SNAP format.] ddeeccnneett ssrrcc _h_o_s_t True if the DECNET source address is _h_o_s_t, which may be an address of the form ``10.123'', or a DECNET host name. [DECNET host name support is only available on Ultrix systems that are configured to run DECNET.] ddeeccnneett ddsstt _h_o_s_t True if the DECNET destination address is _h_o_s_t. ddeeccnneett hhoosstt _h_o_s_t True if either the DECNET source or destination address is _h_o_s_t. iipp, aarrpp, rraarrpp, ddeeccnneett Abbreviations for: eetthheerr pprroottoo _p where _p is one of the above protocols. llaatt, mmoopprrcc, mmooppddll Abbreviations for: eetthheerr pprroottoo _p where _p is one of the above protocols. Note that _S_n_o_r_t does not currently know how to parse these protocols. ttccpp, uuddpp, iiccmmpp Abbreviations for: iipp pprroottoo _p where _p is one of the above protocols. _e_x_p_r _r_e_l_o_p _e_x_p_r True if the relation holds, where _r_e_l_o_p is one of >, <, >=, <=, =, !=, and _e_x_p_r is an arithmetic expression com- posed of integer constants (expressed in standard C syn- tax), the normal binary operators [+, -, *, /, &, |], a length operator, and special packet data accessors. To access data inside the packet, use the following syntax: _p_r_o_t_o [[ _e_x_p_r :: _s_i_z_e ]] _P_r_o_t_o is one of eetthheerr,, ffddddii,, iipp,, aarrpp,, rraarrpp,, ttccpp,, uuddpp,, or iiccmmpp, and indicates the protocol layer for the index operation. The byte offset, relative to the indicated protocol layer, is given by _e_x_p_r. _S_i_z_e is optional and indicates the number of bytes in the field of interest; it can be either one, two, or four, and defaults to one. The length operator, indicated by the keyword lleenn, gives the length of the packet. For example, `eetthheerr[[00]] && 11 !!== 00' catches all multicast traffic. The expression `iipp[[00]] && 00xxff !!== 55' catches all IP packets with options. The expression `iipp[[66::22]] && 00xx11ffffff == 00' catches only unfragmented datagrams and frag zero of fragmented datagrams. This check is implicitly applied to the ttccpp and uuddpp index operations. For instance, ttccpp[[00]] always means the first byte of the TCP _h_e_a_d_e_r, and never means the first byte of an intervening fragment. Primitives may be combined using: A parenthesized group of primitives and operators (paren- theses are special to the Shell and must be escaped). Negation (`!!' or `nnoott'). Concatenation (`&&&&' or `aanndd'). Alternation (`||||' or `oorr'). Negation has highest precedence. Alternation and concatenation have equal precedence and associate left to right. Note that explicit aanndd tokens, not juxtaposition, are now required for concatenation. If an identifier is given without a keyword, the most recent keyword is assumed. For example, nnoott hhoosstt vvss aanndd aaccee is short for nnoott hhoosstt vvss aanndd hhoosstt aaccee which should not be confused with nnoott (( hhoosstt vvss oorr aaccee )) Expression arguments can be passed to Snort as either a single argument or as multiple arguments, whichever is more convenient. Generally, if the expression contains Shell metacharacters, it is easier to pass it as a single, quoted argument. Multiple arguments are concatenated with spaces before being parsed. RRUULLEESS Snort uses a simple but flexible rules language to describe network packet signatures and associate them with actions. The current rules document can be found at http://www.snort.org/snort_rules.html. NNOOTTEESS The following signals have the specified effect when sent to the daemon process using the kkiillll((11)) command: SIGHUP Causes the daemon to close all opened files and restart. Please nnoottee that this will only work if the ffuullll pathname is used to invoke snort in daemon mode, otherwise snort will just exit with an error message being sent to ssyyssllooggdd((88)) SIGUSR1 Causes the program to dump its current packet statistical infor- mation to the cosole or ssyyssllooggdd((88)) if in daemon mode. Any other signal causes the daemon to close all opened files and exit. HHIISSTTOORRYY SSnnoorrtt has been freely available under the GPL license since 1998. DDIIAAGGNNOOSSTTIICCSS SSnnoorrtt returns a 0 on a successful exit, 1 if it exits on an error. BBUUGGSS After consulting the BUGS file included with the source distribution, send bug reports to snort-devel@lists.sourceforge.net AAUUTTHHOORR Martin Roesch SSEEEE AALLSSOO ttccppdduummpp(1), ppccaapp(3) July 2001 SNORT(8)