Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 26 subscribers
  • Views 5597 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS problem witch Adobe Reader downloading PDFs from Webserver

UliKell

Hello NG,


We are using a Sophos SF SW/Virtual TotalProtect. For some days we have some problems with downloading PDF using Adobe Acrobat Reader.

(Foxit Reader works fine)

In the IPS section we had "critical" and major "selected". The downloads are blocked and in the Firewall Log (IPS) we found an IPS ID signature 1110822080. How can we find the according rule ? As a workaround we reduced severity to "critical"; after that it all worked fine again. Could you please help us out?

Regards...



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to sachingurung

    Hi,

    Thanks for the information. Here is a part of the ips.log:

    INFO[4262]:Jul 29 14:09:39:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17841,mem in use 268437735
    INFO[4262]:Jul 29 14:09:39:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17835,mem in use 268439009
    INFO[4262]:Jul 29 14:09:39:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17829,mem in use 268440444
    INFO[4262]:Jul 29 14:09:39:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17823,mem in use 268441879
    INFO[4262]:Jul 29 14:09:39:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17817,mem in use 268443314
    INFO[4262]:Jul 29 14:09:39:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17811,mem in use 268276878
    INFO[4262]:Jul 29 14:09:41:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:09:41:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268210281
    INFO[4262]:Jul 29 14:09:50:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:09:50:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268342214
    INFO[4262]:Jul 29 14:09:55:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:09:55:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268337410
    INFO[4262]:Jul 29 14:09:59:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17803,mem in use 268268739
    INFO[4262]:Jul 29 14:10:04:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:10:04:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268176607
       INFO[4262]:Jul 29 14:10:29:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:10:29:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268262638
    INFO[4262]:Jul 29 14:10:29:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:10:29:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268262638
    INFO[4262]:Jul 29 14:10:29:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:10:29:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268262638
    INFO[4262]:Jul 29 14:10:29:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:10:29:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268262638
    INFO[4262]:Jul 29 14:10:29:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:10:29:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268262638
    INFO[4262]:Jul 29 14:10:30:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:10:30:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268262988
    INFO[4262]:Jul 29 14:10:31:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:10:31:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268312656
    INFO[4262]:Jul 29 14:10:35:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:10:35:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268266576
    INFO[4262]:Jul 29 14:10:42:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17812,mem in use 268262071
    INFO[4262]:Jul 29 14:10:43:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17813,mem in use 268348984
    INFO[4262]:Jul 29 14:10:45:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17807,mem in use 268229479
    INFO[4262]:Jul 29 14:10:53:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17792,mem in use 268246503
    INFO[4262]:Jul 29 14:10:57:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17785,mem in use 268113429
    INFO[4262]:Jul 29 14:11:08:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:11:08:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268331179
    INFO[4262]:Jul 29 14:11:12:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:11:12:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268334030
    INFO[4262]:Jul 29 14:11:15:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:11:15:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268334234
    INFO[4262]:Jul 29 14:11:16:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:11:16:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268334030
    INFO[4262]:Jul 29 14:11:16:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:11:16:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268334030
    INFO[4262]:Jul 29 14:11:17:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:11:17:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268334030
    INFO[4262]:Jul 29 14:11:17:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:11:17:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268334030
    INFO[4262]:Jul 29 14:11:17:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:11:17:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268334030
    INFO[4262]:Jul 29 14:11:17:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:11:17:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268334030
    INFO[4262]:Jul 29 14:11:17:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:11:17:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268334030
    INFO[4262]:Jul 29 14:11:17:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:11:17:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268334030
    INFO[4262]:Jul 29 14:11:17:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:11:17:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268334030
    INFO[4262]:Jul 29 14:11:17:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:11:17:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268334030
    INFO[4262]:Jul 29 14:11:19:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:11:19:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268334030
    INFO[4262]:Jul 29 14:11:21:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:11:21:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268333528
    INFO[4262]:Jul 29 14:11:25:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:11:25:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268334036
    INFO[4262]:Jul 29 14:11:33:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17784,mem in use 268435535
    INFO[4262]:Jul 29 14:11:33:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17778,mem in use 268435535
    INFO[4262]:Jul 29 14:11:33:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17772,mem in use 268207080
    INFO[4262]:Jul 29 14:11:40:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:11:40:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268172525
    INFO[4262]:Jul 29 14:12:04:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:12:04:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268388680
    INFO[4262]:Jul 29 14:12:05:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17789,mem in use 268436063
    INFO[4262]:Jul 29 14:12:05:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17783,mem in use 268181423
    INFO[4262]:Jul 29 14:12:06:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:12:06:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268200178
    INFO[4262]:Jul 29 14:12:06:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:12:06:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268199310
    INFO[4262]:Jul 29 14:12:10:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:12:10:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268363581
    INFO[4262]:Jul 29 14:12:12:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17778,mem in use 268143070
    INFO[4262]:Jul 29 14:12:18:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:12:18:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268244006
    INFO[4262]:Jul 29 14:12:22:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:12:22:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268244381
    INFO[4262]:Jul 29 14:12:32:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:12:32:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268254221
    INFO[4262]:Jul 29 14:12:41:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:12:41:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268260279
    INFO[4262]:Jul 29 14:12:47:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17795,mem in use 268434710
    INFO[4262]:Jul 29 14:12:47:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17789,mem in use 268397219
    INFO[4262]:Jul 29 14:12:51:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:12:51:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268413225
    INFO[4262]:Jul 29 14:12:51:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17786,mem in use 268216510
    INFO[4262]:Jul 29 14:12:56:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:12:56:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268328429
    INFO[4262]:Jul 29 14:12:56:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:12:56:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268328429
    INFO[4262]:Jul 29 14:12:56:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17775,mem in use 268386177
    INFO[4262]:Jul 29 14:12:56:snort_stream5_tcp.c:6541:SegmentAlloc:prune 10 sessions,current sessions 17764,mem in use 268252918
    INFO[4262]:Jul 29 14:12:56:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17759,mem in use 267960458
    INFO[4262]:Jul 29 14:13:02:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:13:02:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268090790
    INFO[4262]:Jul 29 14:13:11:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:13:11:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268129732
    INFO[4262]:Jul 29 14:13:18:snort_stream5_session.c:949:NewLWSession:HashTable full, clean it
    INFO[4262]:Jul 29 14:13:18:snort_stream5_session.c:965:NewLWSession:[17] HashTable full,pruned 6 timeout sessions,current sessions 32762,mem in use 268134329
    INFO[4262]:Jul 29 14:13:32:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17760,mem in use 268265833
    INFO[4262]:Jul 29 14:13:38:snort_stream5_tcp.c:6541:SegmentAlloc:prune 6 sessions,current sessions 17757,mem in use 268099423

    CU