Archive for the ‘LittleBug’ Category

Ourmon and Snort 2.8.1 Released

Friday, April 4th, 2008

I noticed Ourmon 2.8.1 is quietly released on 21 March 2008. This bug-fix release fixes the bugs that I have reported previously, and my name is in the release note. The IP blacklist config takes 3 argument now, this helps when you have multiple blacklists, so you immediately tell which blacklist caused the message, but I am yet to test this feature.
For example in ourmon.conf:

blist_include "irc"  /home/mrourmon/etc/ipblacklist.txt

Snort LogoSnort, an open source network intrusion prevention and detection system, releases version 2.8.1. I got a 404 error while I was trying to download Snort 2.8.0.2 yesterday and noticed the file was not there anymore. Within few minutes, the Snort download page was refreshed and replaced with new v2.8.1 package. Coincidentally, the release version number is same with Ourmon latest bug-fix release. In v2.8.1, one of the new additions is the ability to read multiple pcaps from the command line, which I have usually done with Argus. Here is the sample:

[[email protected] /]# snort -dv -r irc1.pcap -r irc2.pcap | less
Running in packet dump mode

        --== Initializing Snort ==--
Initializing Output Plugins!
Verifying Preprocessor Configurations!
TCPDUMP file reading mode.
Reading network traffic from "irc1.pcap" file.
snaplen = 65535

        --== Initialization Complete ==--

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.8.1 (Build 28)
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/team.html
           (C) Copyright 1998-2008 Sourcefire Inc., et al.
           Using PCRE version: 7.6 2008-01-28

Not Using PCAP_FRAMES
07/11-08:00:32.312306 192.168.128.86:6667 -> 10.1.2.177:32793
TCP TTL:40 TOS:0x0 ID:51682 IpLen:20 DgmLen:91 DF
***AP*** Seq: 0xB368B2EB  Ack: 0xE79F2A5  Win: 0xB50  TcpLen: 32
TCP Options (3) => NOP NOP TS: 2184210158 757152
3A 62 6D 77 30 37 21 34 76 71 74 71 74 34 40 38  :[email protected]
32 2E 37 39 2E 38 37 2E 37 39 20 4A 4F 49 4E 20  2.79.87.79 JOIN
23 61 6C 62 61 0D 0A                                               #alba..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

Ourmon drops packets on 64 bit machine - Fixed

Monday, March 10th, 2008

I mentioned I had Ourmon v2.7 installed previously but it generated a lot packets drop at peaks. I thought it was just my machine’s (Quad core Xeon) fault, which is running FreeBSD AMD64 (64 bit).
I have then installed the latest version of Ourmon (v2.8) which has the experimental threaded support and hoped it would run better in threaded but after the compilation and tested for some time, the problem did not seem to go away.

The CPU usage when I run it in T3 (4 threaded), notice the high CPU usage?

  PID USERNAME  THR PRI   NICE   SIZE    RES STATE  C   TIME   WCPU COMMAND
48707   root           1    121    0      193M   162M CPU5   5   1:41   93.49% ourmon
48706   root           1    121    0      193M   162M CPU2   2   1:35   91.82% ourmon
48705   root           1    120    0      193M   162M CPU7   7   1:37   90.31% ourmon
48708   root           1    121    0      193M   162M CPU3   3   1:31   90.31% ourmon

Ourmon seemed to generate incorrect packet per second graph for me too:
Packet per second before Fix

The bpfstat information:

  pid   	netif  flags       recv     drop      match      sblen 	   hblen   command
48705     em1  p--s-     240244 67980     240244 16777175 16777098 ourmon
48705     em1  p--s-     270156 86341     270156   248714        0          ourmon

There was same problem when I run Ourmon without threaded support:
i386 usage:

  PID USERNAME  THR PRI   NICE   SIZE    RES  STATE  C   TIME   WCPU COMMAND
 1100      root        1      -58    0   24932K 24416K bpf    0  37.2H    1.90% ourmon

AMD64 usage:

  PID USERNAME  THR PRI   NICE   SIZE    RES   STATE  C    TIME   WCPU COMMAND
38236     root        1      109    0     172M   168M  CPU2   2  355:15 70.46% ourmon

I have contacted Jim, the project admin of Ourmon on this issue.
After we have tested for 2 days, I noticed after I have disabled topn_icmperror, topn_scans, and topn_port_scans modules in ourmon.conf, Ourmon has not dropped any packets at peaks.

I reported my findings to Jim and he seemed to find out the problem which caused the Ourmon to drop packet in 64bit machine:

on x86, unsigned int is 4 bytes, unsigned long is 4 bytes
on amd64, unsigned int is 4 bytes, unsigned long is 8 bytes

He sent me a new fixed package and it has been running fine after compilation. Here is the resouce usage with default ourmon.conf on 64 bit:

  PID USERNAME  THR PRI   NICE   SIZE     RES    STATE  C    TIME   WCPU COMMAND
39548     root        1      -58    0   51164K 29752K    bpf    1  15:29    3.96%  ourmon

The pkts graph is displaying correct result now:
Packet per second After Fixed

Jim said this fix will be included in Ourmon v2.9, and it will come with a couple of new features as well.
While we wait for the new package now, it is time to test the blacklist features in v2.8.
Thanks Jim!