Rules dont work Nmap version 7.93 #5
Comments
|
Hi, thanks for your post. That is very interesting. I did a test after reading your post using the latest NMAP 7.94 with a standard scan like yours, and also as a SYN scan -sS, and the rules seemed to work perfectly here, as illustrated below in the logs. It might help to check the Suricata logs (and OPNsense's too if one is used there) for more details of possible errors or conflicts somewhere. Or if there are perhaps some other devices or software in the way between the NMAP end and your Suricata, which could already catch such massive fast port floods when they happen, but still let more "normal speeded" traffic pass. Doing a raw packet capture from Suricata's end might also prove either way if the whole NMAP flood is actually really reaching the Suricata's end. The interesting bit there - and some positive at least - is that one of the detection rules is catching stuff, which is clear from that Suricata log indicating the usage of port 4444. So, the rules file is loaded and in use, so it kind of works, but for some reason the other detection rules did not fire to your NMAP scan. Without more information at hand right now, it's somewhat hard to determine the root cause, although I really would like to, but I hope you understand. Here below are my results from the test I just did now to check it myself. It blew up my Suricata log file as was expected. :-) I tested on a dedicated OPNsense computer, running Suricata, and using the installation method following the readme. All software used were with the latest updates at the time of writing. All the best,
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-06 01:28 **** Nmap done: 1 IP address (1 host up) scanned in 4.95 seconds 2024-09-06T01:28:21.051985 ***** 3400002 blocked LAN .*..*** 39590 .*..*** 3517 POSSBL PORT SCAN (NMAP -sS) .....and so on it went. :-) |
|
I am testing Suricata on pfSense (FreeBSD), and the ruleset is designed according to Suricata's patterns. I wrote a rule to detect segmented and unsuccessful TCP/SYN requests, and it worked. |
This out:
$ nmap 172.19.0.2 Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-05 17:08 -03 Nmap scan report for 172.19.10.2 Host is up (0.024s latency). Not shown: 996 filtered tcp ports (no-response) PORT STATE SERVICE 22/tcp open ssh 53/tcp open domain 80/tcp open http 1198/tcp open cajo-discovery Nmap done: 1 IP address (1 host up) scanned in 4.80 secondsLogs:
I'm running test in with suricata -T and dont show errors, but the rule dont recongize nmap scan.
Obs.: I test with -sS, etc
The text was updated successfully, but these errors were encountered: