Annoying 'Invalid App id" from Snort OpenApp ID
Snort is one of famous Open source softwares in DPI(Deep Packet Inspection), security monitoring. Now Snort is extended to Open App ID which identify applications over network by analysing packets.
To review this functionality, I installed Snort Open App ID. But I keep getting error message as "Invalid app" even I checked, reinstalled application several times.
Error message I got are as follows.
Snort is normally running without error message. "Commencing packet processing" message means Snort is now capturing and monitoring packets.
Next message 'invalid appid in appStat Record (638)" means Snort is failed to identify which application it is.
To fix this issue, I tried every effort and finally get through it. I want to share it
'Invalid Appid' error is caused by wrong configuration in directory information
The reason to cause this issue was wrong configuration in Snort configuration. My Snort configuration is stored at /etc/snort.
There is file named "snort.conf' who holds every configuration information. We can set directory information for OpenApp ID detector, local rules, etc.
To activate Open App ID functionality on Snort, next configuration should be added on "snort.conf"
[Files on my linux /etc/snort]
Bold strings above are just for Open App ID. There is directory setting as app_detector_dir /etc/snort/openappid
This should be very careful. My directory structure is as follows.
In my CentOS Linux, Open App ID detector is stored at '/etc/snort/openappid/odp' as above.
On this environment, how could we set the directory ?
Initially I set it on snort.conf as 'app_detector_dir /etc/snort/openappid/odp'. But 'odp' itself is part of OpenApp Id detector's directory structure. Snort OpenApp ID is seeking someting based on odp structure.
If some detector is required, it is referring such as ./odp/appid.conf or ./odp/lua/client_100bao.lua
Therefore directory should be set not to include 'odp'
Correct directory setting should be as follows.
Wrong: app_detector_dir /etc/snort/openappid/odp
Correct: app_detector_dir /etc/snort/openappid
After I changed the directory setting on snort.conf, there is no longer 'invalid app' error message.
If you are experiencing this kind of error message, please change your snort.conf with correct directory information.
No white_list.rules, black_list.rules
During the installation of Open App ID, someboy are stuck since there are no 'white_list.rules', 'black_list.rules' on snort.org
Then where could we get these files ?
Snort.org does not provide these. If these files are not stored, Snort issues error message having stopped.
Simply you can copy some rules to these files. I copied 'local.rules' to these one.
Since every rule file structure is same, you can copy it. Each rule file name is just for distinguishing its purpose.
If you do not need this functionality, then you could comments out on snort.conf
How to install OpenApp ID ?
Somebody ask me how he/she could install Open App ID.
Snort has variations such as Snort itself, Snort with OpenApp ID functionality.
Therefore you could download Snort OpenApp ID binary or source from Snort.org and install it to your machine.
In my case I installed it into my CentOS 7 machine. It is working well.
For example to my CentOS 7
Detailed installation is well explained on Snort.org, Therefore I do not mention it here.
If you have any question, please let me know. OpenApp ID is new one, there is not enough information on Internet.
Good luck with Snort Open App ID.