Snort configuration file /etc/snort/snort.conf contains following lines for stream5 configuration
preprocessor stream5_global: max_tcp 8192, track_tcp yes, track_udp yes, track_icmp no max_active_responses 2 min_response_seconds 5
preprocessor stream5_tcp: policy windows, detect_anomalies, require_3whs 180, \
overlap_limit 10, small_segments 3 bytes 150, timeout 180, \
ports client 22, \
ports both 80 8080
preprocessor stream5_udp: timeout 180
For http_inspect following lines are present
preprocessor http_inspect: global iis_unicode_map unicode.map 1252 compress_depth 65535 decompress_depth 65535
preprocessor http_inspect_server: server default \
chunk_length 500000 \
server_flow_depth 0 \
client_flow_depth 0 \
post_depth 65495 \
oversize_dir_length 500 \
max_header_length 750 \
max_headers 100 \
ports { 80 8080 } \
non_rfc_char { 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 } \
enable_cookie \
extended_response_inspection \
inspect_gzip \
normalize_utf \
unlimited_decompress \
apache_whitespace no \
ascii no \
bare_byte no \
base36 no \
directory no \
double_decode no \
iis_backslash no \
iis_delimiter no \
iis_unicode no \
multi_slash no \
utf_8 no \
u_encode yes \
webroot no
Basically just port configuration is changed from ruleset 'snortrules-snapshot-2905.tar.gz' to have only ports 80 and 8080. Rest all is as it is. All rule files are commented excep local.rules which has only one rule
alert tcp any any <> any any (content:"saurabhisgood"; nocase; sid:1000001; rev:1; msg:"Found saurabhisgood";)
This rule gets triggered if I try to search for 'saurabhisgood' as the keyword comes in URL and is part of HTTP request which is plaintext. But if I browse websites like facebook.com, mail.yahoo.com which send gzipped response this rule is not getting triggered even if page contains saurabhisgood as text. I have verified this using view source.
I am not able to resolve this problem of snort not being able to content match on gzipped HTTP response. Any help is appreciated.
