Re: Extending CSV output plug-in

["Kamran Shafi" <kamran.shafi () gmail com>]

Yes - all other outputs i.e. tcpdump, fast, standard are working properly.
Its only csv that is not producing any output.

Thanks for pointing to the Snort development site.

Apologies for posting to private e-mail unintentionally.

Come on guys, is there anyone to point out where I might have problem??????

On Mon, Mar 3, 2008 at 12:14 PM, Jason <security () brvenik com> wrote:

> Kamran Shafi wrote:
> > Hi Jason,
> >
> > Thanks for the reply. However, due to my ignorance I couldn't get much
> out
> > of it.
> > > > inline -- could you please elobarate more.
> >
> > > > Perhaps it is because command line options override the config file.
> > I don't really think so, because the tcpdump output is working without
> any
> > glitches.
>
> Did you try?
>
> > > > You will have to write the code to make packet data available in the
> csv.
> > I guessed so -- can you provide any useful links, where to start from
> and
> > which module/preprocessor to modify??
>
> You should start reading here - http://www.snort.org/docs/#devel
>
> Specifically, look at src/output-plugins/spo_csv.c
>
> For templates check out hte sources in the templates directories.
>
> Please keep replies on list, it doesn't much help the next person when
> things go off-line.
>
>
> > On Sun, Mar 2, 2008 at 12:52 PM, Jason <security () brvenik com> wrote:
> >
> > > inline
> > >
> > > Kamran Shafi wrote:
> > > > Hi All,
> > > >
> > > > I am new to Snort and this is my first mail to this list so please
> bear
> > > with
> > > > me.
> > > >
> > > > First - I have been trying hard for last few days to get csv plug-in
> > > work
> > > > for me but it has not. I am on Fedora Core 7 and running Snort 2.8.1the
> > > > latest version. I am running Snort with the following command:
> > > >
> > > > snort -A console -i lo -c test.conf  (please see the output of running
> > > this
> > > > command at the bottom of this mail)
> > > >
> > > > I have enabled only one rules file i.e. local.rules and have some test
> > > rules
> > > > in it.
> > > >
> > > > the entry for my csv output plug-in in the test.conf file is
> > > >
> > > > output alert_CSV: /var/log/alert.csv default
> > > >
> > > > Afterwards I generate some attack traffic and get some alerts on the
> > > > console. (please see the output at the end of this mail).
> > > >
> > > > The problem is that the alert.csv is never created!!!
> > > >
> > > > I have tried using full mode, -h flag and few other tricks but nothing
> > > is
> > > > working
> > > Perhaps it is because command line options override the config file.
> > >
> > > > Please note that I have not installed barnyard and assume that it is
> not
> > > a
> > > > must for csv module to work.
> > > >
> > > > My second question is the following:
> > > >
> > > > If I am lucky enough to configure the csv module correctly with the
> help
> > > of
> > > > you gurus, then how can I extend this module to add more details about
> > > the
> > > > packet payload to the csv output ?
> > > >
> > > > I have posted similar messages on Snort forum without any response.
> Any
> > > help
> > > > is appreciated.
> > > You will have to write the code to make packet data available in the
> csv.
> > >



-- 
Regards
Kamran Shafi
+61 41 824 9510

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users