Hello, I am trying to make suricata run on a raspberry pi 4. I have downloaded and installed suricata, and have added a custom rule which detects when any ICMP packet enters the network.
alert icmp any any -> any any (msg: "ICMP Packet found";)
I then sent ICMP packets across my network, the network is set up so that the raspberry pi monitors all traffic on the network.
When I sent 500 ICMP packets, suricata did not pick them up (the console said that only 2 packets had been captured) , however when I repeated the test using tshark, tshark was able to capture the packets. I am confused as to why Suricata is not picking the packets up, yet tshark is.
Stoped Suricata
Ran sudo rm /var/log/suricata/fast.log
Ran sudo suricata -i eth0
Replayed the ICMP packets.
Suricata notes 2 packets recorded
fast.log created, but nothing recorded (empty file).
Terminal Output
10/6/2020 -- 13:26:12 - <Notice> - This is Suricata version 4.1.2 RELEASE
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.JS.Obfus.Func' is checked but not set. Checked in 2017246 and 1 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.http.PK' is checked but not set. Checked in 2019835 and 3 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'HTTP.UncompressedFlash' is checked but not set. Checked in 2016396 and 3 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.WinHttpRequest' is checked but not set. Checked in 2019822 and 1 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.wininet.UA' is checked but not set. Checked in 2021312 and 0 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.XMLHTTP.ip.request' is checked but not set. Checked in 2022050 and 1 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.XMLHTTP.no.exe.request' is checked but not set. Checked in 2022053 and 0 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.WinHttpRequest.no.exe.request' is checked but not set. Checked in 2022653 and 0 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.IE7.NoRef.NoCookie' is checked but not set. Checked in 2023671 and 9 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.pdf.in.http' is checked but not set. Checked in 2017150 and 4 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.JavaArchiveOrClass' is checked but not set. Checked in 2017768 and 11 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MCOFF' is checked but not set. Checked in 2019837 and 1 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'min.gethttp' is checked but not set. Checked in 2023711 and 0 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.armwget' is checked but not set. Checked in 2024241 and 1 other sigs
10/6/2020 -- 13:26:22 - <Notice> - all 4 packet processing threads, 4 management threads initialized, engine started.
10/6/2020 -- 13:30:59 - <Notice> - This is Suricata version 4.1.2 RELEASE
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.JS.Obfus.Func' is checked but not set. Checked in 2017246 and 1 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.http.PK' is checked but not set. Checked in 2019835 and 3 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'HTTP.UncompressedFlash' is checked but not set. Checked in 2016396 and 3 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.WinHttpRequest' is checked but not set. Checked in 2019822 and 1 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.wininet.UA' is checked but not set. Checked in 2021312 and 0 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.XMLHTTP.ip.request' is checked but not set. Checked in 2022050 and 1 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.XMLHTTP.no.exe.request' is checked but not set. Checked in 2022053 and 0 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.WinHttpRequest.no.exe.request' is checked but not set. Checked in 2022653 and 0 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.IE7.NoRef.NoCookie' is checked but not set. Checked in 2023671 and 9 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.pdf.in.http' is checked but not set. Checked in 2017150 and 4 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.JavaArchiveOrClass' is checked but not set. Checked in 2017768 and 11 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MCOFF' is checked but not set. Checked in 2019837 and 1 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'min.gethttp' is checked but not set. Checked in 2023711 and 0 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.armwget' is checked but not set. Checked in 2024241 and 1 other sigs
10/6/2020 -- 13:31:09 - <Notice> - all 4 packet processing threads, 4 management threads initialized, engine started.
10/6/2020 -- 13:31:23 - <Notice> - Signal Received. Stopping engine.
10/6/2020 -- 13:31:25 - <Notice> - Stats for 'eth0': pkts: 2, drop: 0 (0.00%), invalid chksum: 0
Stats.log
Date: 6/10/2020 – 13:33:58 (uptime: 0d, 00h 07m 46s)
------------------------------------------------------------------------------------
Counter | TM Name | Value
------------------------------------------------------------------------------------
capture.kernel_packets | Total | 2161
decoder.pkts | Total | 2161
decoder.bytes | Total | 151738
decoder.ipv4 | Total | 2119
decoder.ipv6 | Total | 42
decoder.ethernet | Total | 2161
decoder.udp | Total | 142
decoder.icmpv4 | Total | 2000
decoder.icmpv6 | Total | 14
decoder.avg_pkt_size | Total | 70
decoder.max_pkt_size | Total | 385
flow.udp | Total | 36
flow.icmpv4 | Total | 1
flow.icmpv6 | Total | 4
decoder.ipv4.opt_pad_required | Total | 5
decoder.ipv6.zero_len_padn | Total | 10
app_layer.flow.dhcp | Total | 6
app_layer.tx.dhcp | Total | 32
app_layer.flow.failed_udp | Total | 30
flow_mgr.new_pruned | Total | 36
flow_mgr.est_pruned | Total | 2
flow.spare | Total | 10000
flow_mgr.rows_checked | Total | 65536
flow_mgr.rows_skipped | Total | 65536
tcp.memuse | Total | 2031616
tcp.reassembly_memuse | Total | 294912
flow.memuse | Total | 6595024
The pi does have two interfaces, a wlan0 and a eth0, that is why I specify eth0 in my suricata running.
I run tshark on the pi. I run it using sudo tshark in the user folder. By default tshark uses the eth0 interface.
sudo apt-get upgrade suricata
Reading package lists... Done
Building dependency tree
Reading state information... Done
suricata is already the newest version (1:4.1.2-2).
Calculating upgrade... Done
The following package was automatically installed and is no longer required:
rpi-eeprom-images
Use 'sudo apt autoremove' to remove it.
The following packages have been kept back:
python-rpi.gpio
0 upgraded, 0 newly installed, 0 to remove and 1 not upgraded.
Sorry I get an error on that aswell. When I enter sudo add-apt-repository ppa:pj-assis/ppa
I get this error aptsources.distro.NoDistroTemplateException: Error: could not find a distributio n template for Raspbian/buster. I don’t think I need to redownload suricata