2

About a month ago on one of my servers I started receiving random packets from IPs all over the world. So I did the smart thing and stopped putting off installing an IDS. This IDS is a ClearOS Gateway which comes with Snort and SnortSam. I enabled it and all of the classifications. The "network-scan" classification is in there, which means that it should be detecting portscans and such

There is a total of 4 ports open, two of which forward to the server I'm talking about. These ports are 3724 and 8085, so they aren't going to be easily detected in a port scan.

However checking some logs of this server I found that the attack is resuming. I found this

...
Accepting connection from '75.166.155.122'
[Auth] got unknown packet from '75.166.155.122'
Accepting connection from '98.164.154.93'
[Auth] got unknown packet from '98.164.154.93'
Ping MySQL to keep connection alive
Accepting connection from '70.241.195.129'
[Auth] got unknown packet from '70.241.195.129'
Accepting connection from '67.182.229.169'
[Auth] got unknown packet from '67.182.229.169'
Accepting connection from '69.137.140.38'
[Auth] got unknown packet from '69.137.140.38'
Accepting connection from '76.31.72.55'
[Auth] got unknown packet from '76.31.72.55'
Accepting connection from '97.88.139.39'
[Auth] got unknown packet from '97.88.139.39'
Accepting connection from '173.35.62.112'
[Auth] got unknown packet from '173.35.62.112'
Accepting connection from '187.15.10.73'
[Auth] got unknown packet from '187.15.10.73'
Accepting connection from '66.66.94.124'
[Auth] got unknown packet from '66.66.94.124'
Accepting connection from '75.159.219.124'
[Auth] got unknown packet from '75.159.219.124'
Accepting connection from '99.102.100.82'
[Auth] got unknown packet from '99.102.100.82'
Accepting connection from '24.128.240.45'
[Auth] got unknown packet from '24.128.240.45'
Accepting connection from '99.231.7.39'
[Auth] got unknown packet from '99.231.7.39'
Accepting connection from '206.255.79.56'
[Auth] got unknown packet from '206.255.79.56'
Accepting connection from '68.97.106.235'
[Auth] got unknown packet from '68.97.106.235'
Accepting connection from '69.134.67.251'
[Auth] got unknown packet from '69.134.67.251'
Accepting connection from '63.228.138.186'
[Auth] got unknown packet from '63.228.138.186'
Accepting connection from '184.39.146.193'
[Auth] got unknown packet from '184.39.146.193'
Accepting connection from '69.171.161.102'
[Auth] got unknown packet from '69.171.161.102'
Accepting connection from '76.0.47.228'
[Auth] got unknown packet from '76.0.47.228'
Ping MySQL to keep connection alive
Accepting connection from '126.112.201.14'
[Auth] got unknown packet from '126.112.201.14'
Ping MySQL to keep connection alive

Now that scares me. Why isn't Snort detecting this? How were they able to find this specific port?

More importantly, what normally would these packets contain? Is this something I should be worried about? How can I stop this?

7
  • Why wouldn't they be easily detected in a port scan? If I'm going to run a port scan against an ip address or a block of ip addresses I'm going to scan for all ports, and I'll find any open ports, including yours.
    – joeqwerty
    Jan 11, 2011 at 1:34
  • @joe What? If someone runs a port scan the Snort should detect it by the 3rd or 4th port
    – TheLQ
    Jan 11, 2011 at 1:39
  • I'm not disputing that. I'm questioning why you think those ports won't be easliy discovered? In addition, your log output doen't have enough detail to make any kind of assumtion or analysis. What ports are these external ip addresses connecting to. Showing us the connections without any other info doesn't give us enough info. Is there any other info in the logs, such as the port these connections are attempting to connect to?
    – joeqwerty
    Jan 11, 2011 at 1:43
  • Have you enabled the rules for the services you want to inspect and/or the sfportscan preprocessor?
    – Scott Pack
    Jan 11, 2011 at 1:53
  • @joe That is the server that runs on port 3724. Unless there is a very large botnet that is specifically targeting this server software (which it apparently isn't doing a good job of), it would be only found through a port scan. With better logs, I've never actually tried to parse Snort logs, so that will take a bit more work on my part
    – TheLQ
    Jan 11, 2011 at 1:57

1 Answer 1

1

Like most IDSes, Snort is a very complicated piece of techonlogy and requires a good amount of effort to start producing useful results. Tuning requires both a lot of time spent analyzing the alerts, as well as what services you have available so that you can determine which rulesets need to be enabled, and which need to be disabled. Knowing that you are interested in two services specifically does help narrow down what may be useful do you.

Looking through both the official SourceFire rules, as well as the 3rd party EmergingThreats, the only alert I found is for matching World of Warcraft login successes and failures. I would start by searching the SourceFire rules site for your services. You might also profit from reading up on the sfPortscan preprocessor in the Manual.

Unfortunately, I don't know much about ClearOS and how they wrap the management of the app. However, the snort application are actually a fairly easy read, once you get through the verbosity.

1
  • Dang, that was quick figuring out what the server was. Anyway, TMK ClearOS just wraps Snort in a GUI. From the docs on Pg 141 the "network-scan" is a classification of threats. In ClearOS I see that the "scan" group contains 63 rules. I'm thinking that this is working because when I forgot to open up SSH in the Firewall then tried to connected 4 times, my IP got banned. That should be what happens to a portscan. With my configuration, I blindly enabled all the classifications since I'm not yet too sure what needs to be disabled.
    – TheLQ
    Jan 11, 2011 at 2:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .