Friday, March 8, 2013

Snort and some Minor Enhancements

Hello Autosnort Users,

As most of you may know, snort released a few days ago. I didn't find out until about a day after it released. Since then I've been busy testing autosnort against all supported operating systems to ensure that everything continues to work like clockwork.

Here are the new features as reported on

[*] Improvements

* Updated File processing for partial HTTP content and MIME attachments.
* Addition of new config option max_attribute_services_per_host and improve memory usage within attribute table.
* Handle excessive overlaps in frag3.
* Stream API updates to return session key for a session.
* Reduce false positives for TCP window slam events.
* Updates to provide better encoding for TCP packets generated for respond and react. 
* Disable non-ethernet decoders by default for performance reasons. If needed, use --enable-non-ether-decoders with configure.

Just to serve as a reminder for new autosnort users, If you are using the registered user ruleset from, we're in the 30-day holding period before a rule tarball with compatible SO rules will be released.  This comes into play when autosnort walks you through installing your rules manually or via pulled pork.

During this time you will have to use a rule tarball and disable the SO rules. If you choose to do this via pulledpork in the autosnort script, this is done for you automatically if you download the rule tarball -- it is pulled down and pulled pork is configured to install text-based rules only.

If you happen to have a VRT subscription oink code, you can install the latest rule tarballs with no issues whatsoever.

Normally I would have had the blog post out sooner to correspond to the release of, but I made a couple of minor tweaks to the script that I've been meaning to do as well. So here are the improvements I have made:

1. During the snortreport install for all versions of the script, instead installing snortreport to /var/www/snortreport-1.3.3 (for Ubuntu/Debian) or /var/www/html/snortreport-1.3.3 (for CentOS), removed the trailing version number.

Now the directory path is /var/www/snortreport or /var/www/html/snortreport. This has been done to make it easier to point your web browser at the snort report front-end post-install. Now all you should have to type in your web browser is http://[ip address]/snortreport to gain access to the web UI.

2. Updated the online scripts to pull the barnyard2 source tarball from the barnyard2 github.

It was brought to my attention a little while ago over e-mail that the version of barnyard2 I was using in the script, as well as where I was downloading it from was a little dated and no longer recommended, so I rectified that. autosnort should be installing the latest master tarball via github now.

That's all for now.

Happy Snorting.

p.s: Most of you will notice that new code has been posted for every version BUT the BT5r3 version of the script that's because quite frankly, the BT5r3 version of the script had no need to be updated whatsoever. I tested the script and it works perfectly fine as-is. The backtrack script does not install a web front-end, or barnyard2. That can change if there's enough of a desire for it...

No comments:

Post a Comment