CS/CoE 535 : Snort Lite - Fall 2003 1

Snort Lite

Members•Michael Attig (mea1@arl)

–Hardware Design / System Architecture•Qian Wan (qw2@arl)

–Software Design

Webpage http://www.arl.wustl.edu/arl/projects/fpx/snort_lite/

CS/CoE 535 : Snort Lite - Fall 2003 2

Motivation

• Built up ability to do packet inspection• Would like to add some form of packet-

classification • Combining these 2 features is a first step

toward implementing Snort in hardware– Ideally reach line rates– Inspect all packets– Turn Snort active

• Header Processing + Payload Processing

CS/CoE 535 : Snort Lite - Fall 2003 3

Assumptions

• Time constraints force several assumptions– Support Signature lengths from 10 to 32

characters long (80 to 256 bits)– 1 content-rule can be associated with only 1

header rule– Must have content and header rule

• Content + Header = Rule– No content Wildcards (no regular expressions)– Wildcards are allowed in Header Fields– Recognize IP, TCP, UDP protocols

CS/CoE 535 : Snort Lite - Fall 2003 4

Hardware Overview

Packet Data

SID

Matching Rule

CS/CoE 535 : Snort Lite - Fall 2003 5

Major Components Functionality

• Options Processing– Payload Processing via Multiple Bloom Filters

• 8 Hash Functions per BF• False Positive Probability 0.0039

– SDRAM Hash Table Implementation (Quadratic Probing)

• Expected Number of Lookups = ?

• Header Processing– SRAM table lookup– Header Fields Comparator

CS/CoE 535 : Snort Lite - Fall 2003 6

Chip Utilization

• Number of 4-input LUTs – 63%• Number of Occupied Slices – 88%• Number of Block RAMs – 123 of 160 – 76%• Speed – 34.7 MHz

– (this number doesn’t reflect current design)!

CS/CoE 535 : Snort Lite - Fall 2003 7

Control Opcodes

• x70 – Add String to Hash Table• x72 – Remove String from Hash Table• x74 – Set Bits in a Bloom Filter• x76 – Add Header Table Entry• x78 – Remove Header Table Entry• x80 – Change Alert Message Destination• x82 – Read Header Table Entry• x84 – Read Statistics• x86 – Test Functionality / Pass Through

CS/CoE 535 : Snort Lite - Fall 2003 8

Example Rule

• alert tcp 128.252.153.51/16 any 192.168.200.10 80 (content: “Look at my Sample content!”; sid:750;)

• Generic– action proto src_ip src_port dest_ip dest_port

(content: sid:)

CS/CoE 535 : Snort Lite - Fall 2003 9

Java Rule Parser

• Reads in a Rule File• Creates the payload for 3 control

packets to program Circuit– x70 – add signature to analyzer– x74 – set bits in appropriate

Bloom Filter– x76 – Add Header Entry

• Tells you if a rule doesn’t match assumptions

• Ignores other fields – Just extracts content and sid

CS/CoE 535 : Snort Lite - Fall 2003 10

Data Flow Overview

Add rules from web interface

Save rules into database

Construct rules to plain text

Parse rules into payloadRecord matches in database

Output statistics to web page

Construct payload to UDP

CS/CoE 535 : Snort Lite - Fall 2003 11

Updated Table definitions in DB snortlight

TABLES

BLOOMFILTER --------------------- Id INT ; // identity(1, 1) BlockRAM1 INT ; // the ID of BlockRAM 1 BlockRAM2 INT ; // the ID of BlockRAM 2 BlockRAM3 INT ; // the ID of BlockRAM 3 BlockRAM4 INT ; // the ID of BlockRAM 4 BlockRAM5 INT ; // the ID of BlockRAM 5

RULES ---------- Id INT ; // identity(1, 1) BloomId INT ; // FK of BLOOMFILTER Content VARCHAR(100) ; // NOT NULL SourceIP VARCHAR(30) ; DestIP VARCHAR(30) ; SourcePort VARCHAR(20) ; DestPort VARCHAR(20) ; NoCase ENUM(“FALSE”, “TRUE”) ; // 0 false InHardware ENUM(“FALSE”, “TRUE”) ; // 0 false Action CHAR(5) ; // actions to take Protocol CHAR(5) ; // type of protocol InsertTime DATE; DeleteTime DATE; KeepLog ENUM(“FALSE”, “TRUE”) ; // 0 false

BLOOMCNTR ------------------

BloomId INT ; BlockRAMId VARCHAR(10) ; BitPosition INT ; Counter INT ;

RULEMATCH ------------------

PacketID INT ; RuleID INT ; // FK of RULES EventDT DATE;

MATCHSTATIS // use 0 for false match -------------------- RuleID INT ; BloomID INT ; StartDT DATE; EndDT DATE; counter INT ;

CS/CoE 535 : Snort Lite - Fall 2003 12

Work completed during break- software

• Resolved All Major Technical Challenges during first-use of PHP and MySQL– Reconfigured Apache and PHP for Java

extension and tested using system classes– Tested File I/O from PHP and tested – Reconfigured PHP for socket extension and

tested using Telnet to communicate to server• Modified Web Pages ( partial demo)

CS/CoE 535 : Snort Lite - Fall 2003 13

Web Interface

• Use Apache as web server, MySQL as database server all on Windows XP

• HTML and PHP including its extensions to glue the system together

CS/CoE 535 : Snort Lite - Fall 2003 14

Results - Software

• Integration– Statistics for matches– Bloom Filter Counter– Software and hardware components– Sockets?

CS/CoE 535 : Snort Lite - Fall 2003 15

Future Work

• Redesign – too many assumptions• Allow Header-only and content-only rules• Implement more content-based features

– TCP flags– IP options– More header fields– Multiple Signatures per content rule

• Snort has many over-lapping rules

• Software to dynamically recreate VHDL to change Number of PBFs per LBF based on number of strings for a particular length– Statistical Modeling would help determine this