Suricata not recognising packets, but tshark does

The_Radiant · June 9, 2020, 12:32pm

Hello, I am trying to make suricata run on a raspberry pi 4. I have downloaded and installed suricata, and have added a custom rule which detects when any ICMP packet enters the network.

alert icmp any any -> any any (msg: "ICMP Packet found";)

I then sent ICMP packets across my network, the network is set up so that the raspberry pi monitors all traffic on the network.

When I sent 500 ICMP packets, suricata did not pick them up (the console said that only 2 packets had been captured) , however when I repeated the test using tshark, tshark was able to capture the packets. I am confused as to why Suricata is not picking the packets up, yet tshark is.

Jeff_Lucovsky · June 9, 2020, 12:43pm

This is a known issue – see https://redmine.openinfosecfoundation.org/issues/2928

Try these rules (to match icmp echoes and replies)

alert icmp any any -> any any (itype: 0; sid:1;)
alert icmp any any -> any any (itype: 8; sid:2;)

The_Radiant · June 9, 2020, 3:19pm

Unfortunately, nothing change when adding these rules.

I sent 500 ICMP packets to on the network. The pi only picked up 24.

The_Radiant · June 10, 2020, 8:23am

The fast.log is not being populated.

The_Radiant · June 10, 2020, 8:39am

Strange, the amount of packets being detected is diffrent between the cli and the stats.log

------------------------------------------------------------------------------------
Date: 6/10/2020 -- 09:37:56 (uptime: 0d, 00h 17m 55s)
------------------------------------------------------------------------------------
Counter                                    | TM Name                   | Value
------------------------------------------------------------------------------------
capture.kernel_packets                     | Total                     | 2878
decoder.pkts                               | Total                     | 2878
decoder.bytes                              | Total                     | 239250
decoder.ipv4                               | Total                     | 2794
decoder.ipv6                               | Total                     | 84
decoder.ethernet                           | Total                     | 2878
decoder.tcp                                | Total                     | 680
decoder.udp                                | Total                     | 188
decoder.icmpv4                             | Total                     | 2000
decoder.icmpv6                             | Total                     | 5
decoder.avg_pkt_size                       | Total                     | 83
decoder.max_pkt_size                       | Total                     | 1314
flow.tcp                                   | Total                     | 120
flow.udp                                   | Total                     | 64
flow.icmpv4                                | Total                     | 2
flow.icmpv6                                | Total                     | 1
decoder.ipv4.opt_pad_required              | Total                     | 5
decoder.ipv6.zero_len_padn                 | Total                     | 5
tcp.synack                                 | Total                     | 118
tcp.rst                                    | Total                     | 2
app_layer.flow.dhcp                        | Total                     | 3
app_layer.tx.dhcp                          | Total                     | 6
app_layer.flow.failed_udp                  | Total                     | 61
flow_mgr.new_pruned                        | Total                     | 115
flow_mgr.est_pruned                        | Total                     | 1
flow.spare                                 | Total                     | 10000
flow_mgr.flows_checked                     | Total                     | 4
flow_mgr.flows_notimeout                   | Total                     | 4
flow_mgr.rows_checked                      | Total                     | 65536
flow_mgr.rows_skipped                      | Total                     | 65532
flow_mgr.rows_maxlen                       | Total                     | 1
tcp.memuse                                 | Total                     | 2031616
tcp.reassembly_memuse                      | Total                     | 294912
flow.memuse                                | Total                     | 6611344

I was reviewing troubleshooting methods from my last post and when I run
ls -ld

I get the error
-bash: syntax error near unexpected token newline’`

Jeff_Lucovsky · June 10, 2020, 11:22am

Let’s try the following

Stop Suricata
Remove fast.log
Start Suricata
Replay/Send ICMP packets
Stop Suricata and note the packet processed value it reports
Compare (from fast.log) capture.kernel_packets, decoder.pkts, decoder.ethernet, decoder.icmpv4 (or icmpv6)

Also,

Does you pi have 2 interfaces? (wired and wireless)
Where are you running tshark from – the pi?

The_Radiant · June 10, 2020, 12:39pm

Stoped Suricata
Ran sudo rm /var/log/suricata/fast.log
Ran sudo suricata -i eth0
Replayed the ICMP packets.
Suricata notes 2 packets recorded
fast.log created, but nothing recorded (empty file).

Terminal Output

10/6/2020 -- 13:26:12 - <Notice> - This is Suricata version 4.1.2 RELEASE
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.JS.Obfus.Func' is checked but not set. Checked in 2017246 and 1 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.http.PK' is checked but not set. Checked in 2019835 and 3 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'HTTP.UncompressedFlash' is checked but not set. Checked in 2016396 and 3 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.WinHttpRequest' is checked but not set. Checked in 2019822 and 1 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.wininet.UA' is checked but not set. Checked in 2021312 and 0 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.XMLHTTP.ip.request' is checked but not set. Checked in 2022050 and 1 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.XMLHTTP.no.exe.request' is checked but not set. Checked in 2022053 and 0 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.WinHttpRequest.no.exe.request' is checked but not set. Checked in 2022653 and 0 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.IE7.NoRef.NoCookie' is checked but not set. Checked in 2023671 and 9 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.pdf.in.http' is checked but not set. Checked in 2017150 and 4 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.JavaArchiveOrClass' is checked but not set. Checked in 2017768 and 11 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MCOFF' is checked but not set. Checked in 2019837 and 1 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'min.gethttp' is checked but not set. Checked in 2023711 and 0 other sigs
10/6/2020 -- 13:26:14 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.armwget' is checked but not set. Checked in 2024241 and 1 other sigs
10/6/2020 -- 13:26:22 - <Notice> - all 4 packet processing threads, 4 management threads initialized, engine started.
10/6/2020 -- 13:30:59 - <Notice> - This is Suricata version 4.1.2 RELEASE
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.JS.Obfus.Func' is checked but not set. Checked in 2017246 and 1 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.http.PK' is checked but not set. Checked in 2019835 and 3 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'HTTP.UncompressedFlash' is checked but not set. Checked in 2016396 and 3 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.WinHttpRequest' is checked but not set. Checked in 2019822 and 1 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.wininet.UA' is checked but not set. Checked in 2021312 and 0 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.XMLHTTP.ip.request' is checked but not set. Checked in 2022050 and 1 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.XMLHTTP.no.exe.request' is checked but not set. Checked in 2022053 and 0 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.WinHttpRequest.no.exe.request' is checked but not set. Checked in 2022653 and 0 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.IE7.NoRef.NoCookie' is checked but not set. Checked in 2023671 and 9 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.pdf.in.http' is checked but not set. Checked in 2017150 and 4 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.JavaArchiveOrClass' is checked but not set. Checked in 2017768 and 11 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MCOFF' is checked but not set. Checked in 2019837 and 1 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'min.gethttp' is checked but not set. Checked in 2023711 and 0 other sigs
10/6/2020 -- 13:31:01 - <Warning> - [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.armwget' is checked but not set. Checked in 2024241 and 1 other sigs
10/6/2020 -- 13:31:09 - <Notice> - all 4 packet processing threads, 4 management threads initialized, engine started.
10/6/2020 -- 13:31:23 - <Notice> - Signal Received.  Stopping engine.
10/6/2020 -- 13:31:25 - <Notice> - Stats for 'eth0':  pkts: 2, drop: 0 (0.00%), invalid chksum: 0

The pi does have two interfaces, a wlan0 and a eth0, that is why I specify eth0 in my suricata running.
I run tshark on the pi. I run it using sudo tshark in the user folder. By default tshark uses the eth0 interface.

Jeff_Lucovsky · June 10, 2020, 12:46pm

The values from stats.log show 2161 packets were received (capture.kernel_packets) and that all of those were processed (decoder.ethernet).

You’re using ET rules – did you add the rules I listed earlier into that rule file?

What command line are you using to invoke Suricata?

The_Radiant · June 10, 2020, 1:14pm

I did add those rules.

I am using Putty to connect to the pi, and using that terminal window to run suricata.

Jeff_Lucovsky · June 10, 2020, 1:16pm

Ok. I’m not sure why 4.1.2 is reporting 2 packets as we can see from stats.log many more are being processed.

Can you upgrade to 4.1.8?

The_Radiant · June 10, 2020, 1:17pm

What is the command to do that?

The_Radiant · June 10, 2020, 1:49pm

suricata-update
-bash: suricata-update: command not found

The_Radiant · June 10, 2020, 1:50pm

sudo apt-get upgrade suricata
Reading package lists... Done
Building dependency tree
Reading state information... Done
suricata is already the newest version (1:4.1.2-2).
Calculating upgrade... Done
The following package was automatically installed and is no longer required:
  rpi-eeprom-images
Use 'sudo apt autoremove' to remove it.
The following packages have been kept back:
  python-rpi.gpio
0 upgraded, 0 newly installed, 0 to remove and 1 not upgraded.

syoc · June 11, 2020, 7:27am

Try using the ubuntu ppa
https://suricata.readthedocs.io/en/latest/install.html#ubuntu

The_Radiant · June 11, 2020, 7:27am

Hello? suricata is already the newest version (1:4.1.2-2).

The_Radiant · June 11, 2020, 7:28am

Thanks for your help, but I get this error: sudo: add-apt-repository: command not found

syoc · June 11, 2020, 7:29am

The_Radiant · June 11, 2020, 7:40am

Sorry I get an error on that aswell. When I enter sudo add-apt-repository ppa:pj-assis/ppa
I get this error
aptsources.distro.NoDistroTemplateException: Error: could not find a distributio n template for Raspbian/buster. I don’t think I need to redownload suricata

sbhardwaj · June 11, 2020, 7:43am

Hi! Could you please tell how did you install the Suricata package that you are currently running?

The_Radiant · June 11, 2020, 7:55am

I installed suricata by doing sudo apt-get install suricata

Topic		Replies	Views
Suricata not logging incoming packets Help	7	1267	December 29, 2020
Http traffic is not detected after updating to Suricata 7 Help	17	643	February 13, 2024
Testing ping alert rule Rules suricata	5	4241	July 27, 2022
I can only see the first alert of a rule Help	2	1854	December 15, 2020
Weird result when comparing Suricata detections with snort (using same traffic) - what am I missing? Help	4	939	December 13, 2021

Suricata not recognising packets, but tshark does

Related topics