All Apps and Add-ons

TA_netfilter - REGEX used by netfilter_flags transform breaks under certain conditions

chris_barrett
SplunkTrust
SplunkTrust

Hi @doksu ,

I've found that the REGEX used by [netfilter_flags] will break if the event contains a sequence of uppercase characters before the actuals flags within the event.  This can occur if the event contains an action of DROP, ACCEPT or REJECT with whitespace before and after the action.  In these cases, the FLAGS and tcp_flags fields will be set to the action.

My fix was to change the REGEX line within the netfilter_flags stanza to:

REGEX = \s((?:(ACK|FIN|PSH|RST|SYN|URG)\s)+)

 

 

 

Labels (1)
0 Karma

doksu
Contributor

Cool, thanks @chris_barrett . Perhaps it should also support the few other more unusual flags (see https://en.wikipedia.org/wiki/Transmission_Control_Protocol), including 'NS'. What do you reckon?

0 Karma

chris_barrett
SplunkTrust
SplunkTrust

Hi @doksu 

I haven't encountered those other 3 flags (NS,CWR,ECE) in the environments that I'm working in at the moment but I agree that the TA should cater for any and all of the flags that it could encounter.

0 Karma

chris_barrett
SplunkTrust
SplunkTrust

Hi @doksu,

I have now seen the ECE and CWR flags "in the wild" so I've locally updated the REGEX for [netfilter_flags] to now be:

REGEX = \s((?:(ACK|CWR|ECE|FIN|NS|PSH|RST|SYN|URG)\s)+)

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...