This is odd. I don't know the firewalls that you are using, but I am guessing they are not keeping a state table http://j.mp/78bHjA. This state table would be needed due to the dynamic ports selected OSSEC on the agent side of the connection.
OSSEC works by having the agent contacting the server on UDP port 1514 and the src port will be picked randomly. Can you give me some more details on the firewall's used? -Jeremy On Dec 8, 2009, at 6:01 PM, jplee3 wrote: > Hey guys, > > I found something interesting in attempting to deploy OSSEC in agent/ > server model. Not sure what the implications are here, but it seems > like 1514 isn't the only port OSSEC retains communication over (since > it's UDP I think?). > > The firewall rules that I'm working with are very restrictive. And UDP > is also restricted. I requested that 1514 UDP be opened on both the > server and agents but still couldn't get OSSEC to communicate between > the agents/servers. > > After running a tcpdump, I found this: > > 18:24:49.215025 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto > UDP (17), length 93) 10.x.x.x.1514 > 216.x.x.x.43591: UDP, length 65 > > > So it seems the server was sending a request to the destination where > the destination port is dynamic. > > > Is there something I'm missing here? >
