Snort not showing blocked/dropped packets

Question

I'm trying to detect ping flood attacks with Snort. I have included the rule

(drop icmp any any -> any any (itype:8; threshold, track by_src, count 20, seconds; msg:"Ping flood attack detected"; sid:100121))

in the Snort's ddos.rule file.

I'm attacking using the command

hping3 -1 --fast

The ping statistics in the attacking machine says

100% packet loss

However, the Snort action stats shows the verdicts as

Block ->0.

Why is this happening?

Answer 1

A few things to note:

1) This rule is missing the value for seconds. You need to specify a timeout value, you currently have "seconds;" You need something like "seconds 5;". Since this is not valid I'm not sure when snort is actually going to generate an alert, which means it may just be dropping all of the icmp packets, but not generating any alerts.

2) This rule is going to drop EVERY icmp packet for itype 8. The threshold only specifies when to alert, not when to drop. So this is going to drop all packets that match and then generate 1 alert per 20 that it drops. See the manual on rule thresholds here.

3) If you do not have snort configured in inline mode, you will not be able to actually block any packets. See more on the information about the three different modes here.

If you just want to detect and drop ping floods you should probably change this to use the detection_filter option, instead of threshold. If you want to allow legitimate pings, and drop ping floods you do not want to use threshold because the way you have this rule written it will block all icmp itype 8 packets. If you use detection_filter you can write a rule that if snort sees 20 pings in 5 seconds from the same source host then drop. Here is an example of what your rule might look like:

drop icmp any any -> any any (itype:8; detection_filter:track by_src, count 20, seconds 5; sid:100121)

If snort sees 20 pings from the same source host within 5 seconds of each other it will then drop and generate an alert. See the snort manual for detection filters here.

With this configuration, you can allow legitimate pings on the network and block ping floods from the same source host.