Snort mailing list archives
Re: Extending CSV output plug-in
From: "Kamran Shafi" <kamran.shafi () gmail com>
Date: Mon, 3 Mar 2008 15:19:42 +1100
Ok .... It is finally producing alert.csv but only when I dont use -A flag as you mentioned. Thanks for this tip Jason. But what is going wrong? Why does snort log alerts in tcpdump and other formats with -A flag but not with csv? Do I need to set my path somewhere? On Mon, Mar 3, 2008 at 1:48 PM, Jason <security () brvenik com> wrote:
Kamran Shafi wrote:Yes - all other outputs i.e. tcpdump, fast, standard are workingproperly.Its only csv that is not producing any output.Possibly. Paste your conf to http://snort.pastebin.com and the entire output of running the command snort -l /tmp -i lo -c test.confThanks for pointing to the Snort development site. Apologies for posting to private e-mail unintentionally. Come on guys, is there anyone to point out where I might haveproblem??????On Mon, Mar 3, 2008 at 12:14 PM, Jason <security () brvenik com> wrote:Kamran Shafi wrote:Hi Jason, Thanks for the reply. However, due to my ignorance I couldn't get muchoutof it.inline -- could you please elobarate more. Perhaps it is because command line options override the config file.I don't really think so, because the tcpdump output is working withoutanyglitches.Did you try?You will have to write the code to make packet data available in thecsv.I guessed so -- can you provide any useful links, where to start fromandwhich module/preprocessor to modify??You should start reading here - http://www.snort.org/docs/#devel Specifically, look at src/output-plugins/spo_csv.c For templates check out hte sources in the templates directories. Please keep replies on list, it doesn't much help the next person when things go off-line.On Sun, Mar 2, 2008 at 12:52 PM, Jason <security () brvenik com> wrote:inline Kamran Shafi wrote:Hi All, I am new to Snort and this is my first mail to this list so pleasebearwithme. First - I have been trying hard for last few days to get csv plug-inworkfor me but it has not. I am on Fedora Core 7 and running Snort2.8.1thelatest version. I am running Snort with the following command: snort -A console -i lo -c test.conf (please see the output ofrunningthiscommand at the bottom of this mail) I have enabled only one rules file i.e. local.rules and have sometestrulesin it. the entry for my csv output plug-in in the test.conf file is output alert_CSV: /var/log/alert.csv default Afterwards I generate some attack traffic and get some alerts on the console. (please see the output at the end of this mail). The problem is that the alert.csv is never created!!! I have tried using full mode, -h flag and few other tricks butnothingisworkingPerhaps it is because command line options override the config file.Please note that I have not installed barnyard and assume that it isnotamust for csv module to work. My second question is the following: If I am lucky enough to configure the csv module correctly with thehelpofyou gurus, then how can I extend this module to add more detailsaboutthepacket payload to the csv output ? I have posted similar messages on Snort forum without any response.Anyhelpis appreciated.You will have to write the code to make packet data available in thecsv.-------------------------------------------------------------------------------------------------------------------------------------------------This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ ------------------------------------------------------------------------ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
-- Regards Kamran Shafi +61 41 824 9510
------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Extending CSV output plug-in Kamran Shafi (Mar 01)
- Re: Extending CSV output plug-in Jason (Mar 01)
- Message not available
- Re: Extending CSV output plug-in Jason (Mar 02)
- Re: Extending CSV output plug-in Kamran Shafi (Mar 02)
- Re: Extending CSV output plug-in Jason (Mar 02)
- Re: Extending CSV output plug-in Kamran Shafi (Mar 02)
- Re: Extending CSV output plug-in Jason (Mar 02)
- Message not available
- Re: Extending CSV output plug-in Jason (Mar 01)