Snort mailing list archives
Re: writing to log file and running a script at once???
From: Erek Adams <erek () theadamsfamily net>
Date: Mon, 22 Apr 2002 15:53:16 -0700 (PDT)
On Mon, 22 Apr 2002, Lookman Fazal wrote:
I have snort (1.8.3) running on linux. The linux machine is connected on the mirror port and monitoring traffic just fine. For example, when someone goes to yahoo, it creates a directory with the sender's IP address in /var/log/snort directory Now what I want to do is, when it writes the sender's IP address in this /var/log/snort directory I want to, at the same time run a script, which will take the sender's IP address and telnet to my router and add an access-list to deny this sender. I can work on the script, how do I do the other part? Is there a way to do this? Any help will be greatly appreciated
Ok.... I'm not going to re-write the message, but before you decide to do this, please check this out: http://marc.theaimsgroup.com/?l=snort-users&m=101872552332464&w=2 Anyway... Onto your question: Use a unix socket alerts and have the code on the other side read from the socket as the data comes in. It's quite a bit cleaner and will work a bit faster since it's not hitting the disk. Check the archives, there's been some talk of doing that on the list recently. Good luck! ----- Erek Adams Nifty-Type-Guy TheAdamsFamily.Net _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- writing to log file and running a script at once??? Lookman Fazal (Apr 22)
- Re: writing to log file and running a script at once??? Erek Adams (Apr 22)