Snort Hints

I recently received a question via the blog email. Email read:

"I'm a new Snort user in a IDS class and I'm getting the following error message about my bad traffic rule. however, if I comment out this rule it still appears in every successive rule. I have also open the bad traffic rule file and I see no "!any" syntax. Can you give some more advice?

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
ERROR: c:\snort\rules/bad-traffic.rules(27) => !any is not allowed
Fatal Error, Quitting..
C:\Snort\bin>

Additionally, I get this error message if I'm trying to run a custom rule named testing.rule:

ERROR: Unable to open rules file:
c:\snort\rules/TESTING.rules or C:\snort\etc\c:\snort\rules/TESTING.rules
Fatal Error, Quittting...
Any advice here also?"

Now, this looks like two separate problems. Let's look at the first one.

The (27) in Bold above tells you exactly what line you have the error on. You can find this in vi by starting vi like this: "vi +27 bad-traffic.rules". This will open the file bad-traffic.rules at exactly line 27. Well, I asked the guy, "What is line 27?"

"alert tcp $EXTERNAL_NET any <> $HOME_NET 0 (msg:"BAD-TRAFFIC tcp port 0 traffic"; flow:stateless; classtype:misc-activity; sid:524; rev:8;)"

Okay, so the error is "!any is not allowed". The only "any" I see here is the any after EXTERNAL_NET. So that tells me that something is screwed in the Snort.conf. So, how do you have your variables configured I asked.

"var HOME_NET 192.168.0.0/24
var HOME_NET any
var EXTERNAL_NET !$HOME_NET"

Was the answer I got. Well what happens here is Snort reads the variables in the snort.conf file from top to bottom, so the last HOME_NET that was configured is "any". Then EXTERNAL_NET is read "!any". Which you can't do. What happens is the header of the rule winds up being:

"alert tcp !any any <> any 0" See how that doesn't work?

Now, for the second question..

Looks like a simple misconfiguration of the RULE_PATH variable. The RULE_PATH variable is by default "../rules" so it just looks like testing.rules isn't in that area. So, you either have to reset that to the correct path, or put your rules in the RULE_PATH directory.

I posted these hints and this email with permission from the guy who wrote the question in to me, with the promise that I remove his name. No problem. Thanks.

If you have questions, feel free to write me. However, as I will tell you in #snort on IRC, and as I will tell you in forums. We are not here to help you do your homework. Every year at the same time we start getting a ton of really basic questions from users in IRC and on the Snort-Users list. There has to be a class at a University out there somewhere that is giving assignments.

Last year we got a classic one on the snort-users list. It was a direct copy and paste of the assignment asking us to answer his questions for him.

I'm definitely not saying that this guy that wrote me is in a class like that, since this kind of question happens all the time, it just happens to be that time of year.