Re: DNS on Log Messsages?

[Erek Adams <erek () snort org>]

On Tue, 14 Jan 2003, Mike Koponick wrote:

> I was wondering if there was a way to resolve IP addresses into names from
> the SNORT.LOG file. That is, this is the log that SNORT outputs now:
>
> 01/13-18:39:12.868701 [**] [1:384:4] ICMP PING [**] [Classification: Misc
> activity] [Priority: 3] {ICMP} 192.168.11.21 -> 192.168.11.2
>
> I would like log to look something like:
>
> 01/13-18:39:12.868701 [**] [1:384:4] ICMP PING [**] [Classification: Misc
> activity] [Priority: 3] {ICMP} 192.168.11.21 (MYPC.MYDOMAIN.COM)->
> 192.168.11.2 (THEREPC.MYDOMAIN.COM)

Snort can't do that.  DNS resolution is something that takes _time_.  If
you have to lookup 500 IP's, and there's a 50ms wait for each one...  That
starts to mount up rather quickly.  Snort needs all it's time and power to
snarf packets.

You could use a sed/awk script and post process the logs.  That would be
a bit better as you're not making the Snort process do all the work.  If
you could, I would even suggest doing that off of your sensor.  Do it on a
backend box with a local caching DNS server.

Cheers!

-----
Erek Adams

   "When things get weird, the wierd turn pro."   H.S. Thompson


-------------------------------------------------------
This SF.NET email is sponsored by: FREE  SSL Guide from Thawte
are you planning your Web Server Security? Click here to get a FREE
Thawte SSL guide and find the answers to all your  SSL security issues.
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0026en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users