Snort mailing list archives
running a script when a match is found
From: Lookman Fazal <fazall () research avayalabs com>
Date: Tue, 07 May 2002 10:23:29 -0400
Hello All I have snort (1.8.3) running on linux. The linux machine is connected on the mirror port and monitoring traffic just fine. For example, when someone goes to yahoo, it creates a directory with the sender's IP address in /var/log/snort directory Now what I want to do is, when it writes the sender's IP address in this /var/log/snort directory, I want to, at the same time run a script, which will take the sender's IP address and telnet to my router and add an access-list to deny this sender. How do I invoke a script in snort when a pattern matches? Is there a way to do this? Any help will be greatly appreciated --Fazal PS: Two things which I checked from the mailing list was looking at portsantry or doing socket programming. PS: This is in a test environment and i did read on the false positives _______________________________________________________________ Have big pipes? SourceForge.net is looking for download mirrors. We supply the hardware. You get the recognition. Email Us: bandwidth () sourceforge net _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- running a script when a match is found Lookman Fazal (May 07)
- Re: running a script when a match is found Michael Boman (May 07)
- Re: running a script when a match is found Frank Knobbe (May 07)
- Re: running a script when a match is found Michael Boman (May 07)