Using Snort with PF_RING ======================== Prerequisites ------------- Make sure you have installed: - Snort 2.9 or later - Snort with DAQ include files/libraries (0.6.2, 1.1.1, and 2.0). You can do that downloading snort and DAQ from http://www.snort.org/snort-downloads? Compilation ----------- .. code-block:: console git clone https://github.com/ntop/PF_RING.git cd PF_RING/kernel make && sudo make install cd PF_RING/userland/lib ./configure && make && sudo make install cd PF_RING/userland/snort/pfring-daq-module autoreconf -ivf ./configure make Configure Options ----------------- If you do not have PF_RING installed, nor in the "$HOME/PF_RING" path, a few configure options are available: .. code-block:: console --with-libpfring-includes= --with-pfring-kernel-includes= --with-libpfring-libraries= Installation ------------ Install the library with: .. code-block:: console sudo cp .libs/daq_pfring.so /usr/local/lib/daq/ or alternatively with: .. code-block:: console sudo make install or if you want to run snort without installing it use "--daq-dir=./.libs" Running snort in IDS mode ------------------------- .. code-block:: console snort --daq-dir=/usr/local/lib/daq --daq pfring --daq-mode passive -i eth0 -v -e It is possible to specify multiple interfaces by using a comma-separated list. Running snort in IPS mode ------------------------- .. code-block:: console snort --daq-dir=/usr/local/lib/daq --daq pfring -i eth0:eth1 -e -Q It is possible to specify multiple interface pairs by using a comma-separated list. PF_RING DAQ Specific Options ---------------------------- 1. Kernel Filters By default, PF_RING kernel filtering rules are added whenever snort's verdict requests to drop specific flows. If you want instead snort (and not PF_RING) drop packets (i.e. don't add automatically PF_RING kernel filtering rules) add: .. code-block:: console --daq-var no-kernel-filters Kernel filtering rules idle for more than 5 minutes are automatically removed. In order to change the default timeout for idle rules do: .. code-block:: console --daq-var kernel-filters-idle-timeout= 2. Socket clustering PF_RING allows you to distribute packets across multiple processes by using socket clusters. For instance two snort instances bound to the same clusterId receive each a subset of packets so that both can cooperatively share the load. In order to enable this feature do: .. code-block:: console --daq-var clusterid= where an id is a number (i.e. the clusterId), one for each interface. It is also possible to specify the cluster mode, with: .. code-block:: console --daq-var clustermode= where valid mode values are: - 2 for 2-tuple flow - 4 for 4-tuple flow - 5 for 5-tuple flow - 6 for 6-tuple flow 3. Bind an instance to a core Proper core insulation, grants snort instances not to step on each other's feet. In order to bind an instance to a specific core do: .. code-block:: console --daq-var bindcpu= 4. Kernel-level forwarding in IDS mode If you want to forward incoming packets at kernel level while snort is running in IDS mode, you can specify a destination interface for each ingress interface with: .. code-block:: console --daq-var lowlevelbridge= 5. Fast TX in IPS mode Since forwarding packets from userspace requires additional copies (thus affecting performances), it is possible to forward at kernel level the packets for which snort gives a positive verdict: .. code-block:: console --daq-var fast-tx 6. Packet capture tuning It is possible to tune the packet capture activity specifying the poll() timeout: .. code-block:: console --daq-var timeout= and the watermark (min number of incoming packets for the poll() to return): .. code-block:: console --daq-var watermark= Example of Clustering + Core Binding ------------------------------------ IDS mode: .. code-block:: console snort -q --pid-path /var/run --create-pidfile -D -c /etc/snort/snort.conf -l /var/log/snort/bpbr0/instance-1 --daq-dir=/usr/local/lib/daq --daq pfring --daq-mode passive -i eth2,eth3 --daq-var lowlevelbridge=eth3,eth2 --daq-var clusterid=10,11 --daq-var bindcpu=1 snort -q --pid-path /var/run --create-pidfile -D -c /etc/snort/snort.conf -l /var/log/snort/bpbr0/instance-2 --daq-dir=/usr/local/lib/daq --daq pfring --daq-mode passive -i eth2,eth3 --daq-var lowlevelbridge=eth3,eth2 --daq-var clusterid=10,11 --daq-var bindcpu=2 snort -q --pid-path /var/run --create-pidfile -D -c /etc/snort/snort.conf -l /var/log/snort/bpbr0/instance-3 --daq-dir=/usr/local/lib/daq --daq pfring --daq-mode passive -i eth2,eth3 --daq-var lowlevelbridge=eth3,eth2 --daq-var clusterid=10,11 --daq-var bindcpu=3 snort -q --pid-path /var/run --create-pidfile -D -c /etc/snort/snort.conf -l /var/log/snort/bpbr0/instance-4 --daq-dir=/usr/local/lib/daq --daq pfring --daq-mode passive -i eth2,eth3 --daq-var lowlevelbridge=eth3,eth2 --daq-var clusterid=10,11 --daq-var bindcpu=4 IPS mode: .. code-block:: console snort -q --pid-path /var/run --create-pidfile -D -c /etc/snort/snort.conf -l /var/log/snort/bpbr0/instance-1 --daq-dir=/usr/local/lib/daq --daq pfring --daq-mode inline -i eth2:eth3 --daq-var fast-tx=1 --daq-var clusterid=10,11 --daq-var bindcpu=1 snort -q --pid-path /var/run --create-pidfile -D -c /etc/snort/snort.conf -l /var/log/snort/bpbr0/instance-2 --daq-dir=/usr/local/lib/daq --daq pfring --daq-mode inline -i eth2:eth3 --daq-var fast-tx=1 --daq-var clusterid=10,11 --daq-var bindcpu=2 snort -q --pid-path /var/run --create-pidfile -D -c /etc/snort/snort.conf -l /var/log/snort/bpbr0/instance-3 --daq-dir=/usr/local/lib/daq --daq pfring --daq-mode inline -i eth2:eth3 --daq-var fast-tx=1 --daq-var clusterid=10,11 --daq-var bindcpu=3 snort -q --pid-path /var/run --create-pidfile -D -c /etc/snort/snort.conf -l /var/log/snort/bpbr0/instance-4 --daq-dir=/usr/local/lib/daq --daq pfring --daq-mode inline -i eth2:eth3 --daq-var fast-tx=1 --daq-var clusterid=10,11 --daq-var bindcpu=4 PF_RING FT Acceleration ----------------------- In order to take advantage of the PF_RING FT L7 filtering/shunting, you also need nDPI. Since PF_RING 7.3 *ndpi* is installed as a dependency of *pfring* when installing from packages. If you are compiling from source code, or using an older version of PF_RING, you need to manually install the nDPI library from https://github.com/ntop/nDPI following the steps below: .. code-block:: console git clone https://github.com/ntop/nDPI.git cd nDPI ./autogen.sh make && sudo make install Then you need to create a configuration file with the filtering rules: .. code-block:: console # cat /etc/pf_ring/ft-rules.conf [filter] YouTube = discard Netflix = discard At this point you are ready to run Snort, setting the path of the configuration file using the PF_RING_FT_CONF environment variable: .. code-block:: console sudo PF_RING_FT_CONF=/etc/pf_ring/ft-rules.conf snort --daq-dir=/usr/local/lib/daq --daq pfring --daq-mode passive -i ethX -v -e For further information about PF_RING FT please read http://www.ntop.org/guides/pf_ring/ft.html