Snort mailing list archives
Database formats
From: "Greg Robinson" <greg () diverdown cc>
Date: Tue, 16 Jul 2002 20:23:14 -0500
I am logging my snort server to a MySql Database.... I have two questions..?? 1. How do I get snort to only write to the database..and not the /var/log/snort directory also..?? 2. How would I go about getting custom reports out of the snort database..?? For instance: If i look at the iphdr table: I get the following output..?? mysql> select * from iphdr where cid = '1'; +-----+-----+------------+------------+--------+---------+--------+--------+-------+----------+--------+--------+----------+---------+ | sid | cid | ip_src | ip_dst | ip_ver | ip_hlen | ip_tos | ip_len | ip_id | ip_flags | ip_off | ip_ttl | ip_proto | ip_csum | +-----+-----+------------+------------+--------+---------+--------+--------+-------+----------+--------+--------+----------+---------+ | 1 | 1 | 1065291291 | 3487996171 | 4 | 5 | 0 | 753 | 16405 | 0 | 0 | 113 | 6 | 4198 | | 2 | 1 | 1036618565 | 3487996171 | 4 | 5 | 16 | 623 | 0 | 0 | 0 | 240 | 6 | 0 | +-----+-----+------------+------------+--------+---------+--------+--------+-------+----------+--------+--------+----------+---------+ 2 rows in set (1.77 sec) How do I convert the ip_src field back to an IP address so I could write a select statement to find out how many times that ip_src is in the database..?? Thanks in advance... Greg
Current thread:
- Database formats Greg Robinson (Jul 16)
- Re: Database formats Imran William Smith (Jul 16)
- Re: Database formats Ian Macdonald (Jul 23)
- Re: Database formats Imran William Smith (Jul 23)