Today, I have updated my FreeBSD 12.1 (fully updated) host with Suricata 5.0.3. After that, I have enabled anomaly option and I am receiving a lot of entries like this:
{“timestamp”:“2020-05-05T07:14:02.301024+0000”,“flow_id”:608287902755297,“in_iface”:“vtnet2”,“event_type”:“anomaly”,“src_ip”:“172.22.55.4”,“src_port”:49394,“dest_ip”:“172.22.55.5”,“dest_port”:443,“proto”:“TCP”,“community_id”:“1:+WREAUJoDuoz9NdiHyesC68d1JU=”,“anomaly”:{“type”:“stream”,“event”:“stream.pkt_invalid_ack”}}
{“timestamp”:“2020-05-05T07:14:02.301024+0000”,“flow_id”:608287902755297,“in_iface”:“vtnet2”,“event_type”:“anomaly”,“src_ip”:“172.22.55.4”,“src_port”:49394,“dest_ip”:“172.22.55.5”,“dest_port”:443,“proto”:“TCP”,“community_id”:“1:+WREAUJoDuoz9NdiHyesC68d1JU=”,“anomaly”:{“type”:“stream”,“event”:“stream.est_invalid_ack”}}
{“timestamp”:“2020-05-05T07:14:02.307457+0000”,“flow_id”:608287902755297,“in_iface”:“vtnet2”,“event_type”:“anomaly”,“src_ip”:“172.22.55.5”,“src_port”:443,“dest_ip”:“172.22.55.4”,“dest_port”:49394,“proto”:“TCP”,“community_id”:“1:+WREAUJoDuoz9NdiHyesC68d1JU=”,“anomaly”:{“type”:“stream”,“event”:“stream.pkt_invalid_ack”}}
{“timestamp”:“2020-05-05T07:14:02.307457+0000”,“flow_id”:608287902755297,“in_iface”:“vtnet2”,“event_type”:“anomaly”,“src_ip”:“172.22.55.5”,“src_port”:443,“dest_ip”:“172.22.55.4”,“dest_port”:49394,“proto”:“TCP”,“community_id”:“1:+WREAUJoDuoz9NdiHyesC68d1JU=”,“anomaly”:{“type”:“stream”,“event”:“stream.est_invalid_ack”}}
{“timestamp”:“2020-05-05T07:14:02.307872+0000”,“flow_id”:608287902755297,“in_iface”:“vtnet2”,“event_type”:“anomaly”,“src_ip”:“172.22.55.4”,“src_port”:49394,“dest_ip”:“172.22.55.5”,“dest_port”:443,“proto”:“TCP”,“community_id”:“1:+WREAUJoDuoz9NdiHyesC68d1JU=”,“anomaly”:{“type”:“stream”,“event”:“stream.pkt_invalid_ack”}}
{“timestamp”:“2020-05-05T07:14:02.307872+0000”,“flow_id”:608287902755297,“in_iface”:“vtnet2”,“event_type”:“anomaly”,“src_ip”:“172.22.55.4”,“src_port”:49394,“dest_ip”:“172.22.55.5”,“dest_port”:443,“proto”:“TCP”,“community_id”:“1:+WREAUJoDuoz9NdiHyesC68d1JU=”,“anomaly”:{“type”:“stream”,“event”:“stream.est_invalid_ack”}}
{“timestamp”:“2020-05-05T07:14:02.454401+0000”,“flow_id”:608287902755297,“in_iface”:“vtnet2”,“event_type”:“anomaly”,“src_ip”:“172.22.55.5”,“src_port”:443,“dest_ip”:“172.22.55.4”,“dest_port”:49394,“proto”:“TCP”,“community_id”:“1:+WREAUJoDuoz9NdiHyesC68d1JU=”,“anomaly”:{“type”:“stream”,“event”:“stream.pkt_invalid_ack”}}
{“timestamp”:“2020-05-05T07:14:02.454401+0000”,“flow_id”:608287902755297,“in_iface”:“vtnet2”,“event_type”:“anomaly”,“src_ip”:“172.22.55.5”,“src_port”:443,“dest_ip”:“172.22.55.4”,“dest_port”:49394,“proto”:“TCP”,“community_id”:“1:+WREAUJoDuoz9NdiHyesC68d1JU=”,“anomaly”:{“type”:“stream”,“event”:“stream.est_invalid_ack”}}
{“timestamp”:“2020-05-05T07:14:02.455095+0000”,“flow_id”:608287902755297,“in_iface”:“vtnet2”,“event_type”:“anomaly”,“src_ip”:“172.22.55.4”,“src_port”:49394,“dest_ip”:“172.22.55.5”,“dest_port”:443,“proto”:“TCP”,“community_id”:“1:+WREAUJoDuoz9NdiHyesC68d1JU=”,“anomaly”:{“type”:“stream”,“event”:“stream.pkt_invalid_ack”}}
{“timestamp”:“2020-05-05T07:14:02.455095+0000”,“flow_id”:608287902755297,“in_iface”:“vtnet2”,“event_type”:“anomaly”,“src_ip”:“172.22.55.4”,“src_port”:49394,“dest_ip”:“172.22.55.5”,“dest_port”:443,“proto”:“TCP”,“community_id”:“1:+WREAUJoDuoz9NdiHyesC68d1JU=”,“anomaly”:{“type”:“stream”,“event”:“stream.est_invalid_ack”}}
I am using netmap capture in Suricata … My config for interfaces is pretty simple:
netmap:
-
interface: vtnet2
checksum-checks: no
-
interface: vtnet3
checksum-checks: no
-
interface: vtnet4
checksum-checks: no
-
interface: vtnet5
checksum-checks: no
-
interface: vtnet6
checksum-checks: no
An I have disabled all off-loading options in network interfaces … Any idea?
