Re: Snort dont understand pf (openbsd) format

[Matt Kettler <mkettler () evi-inc com>]

At 08:52 PM 11/29/2004, Sean Brown wrote:
> > It's unclear if OpenBSD generates real tcpdump files that any ordinary
> > tcpdump can read, or if they patched tcpdump to support them.
> It doesn't, it is a modified format that the tcpdump in OpenBSD was 
> patched to
> read. However, in the FAQ:
>
> 4.4 Does snort see packets filtered by IPTables/IPChains/IPF/PF?
> ...
> Under OpenBSD you can snort just the PF rejects by using the /dev/pflogN
> interface.
>
> Since pflogd simply writes the traffic from pflog, snort should be able to
> understand the log file, but I have tried to have it read the file and
> attached it to /dev/pflog0 and it does not understand the traffic. Perhaps
> the output format changed in one of the recent OpenBSD releases and Snort was
> never updated. If so, the FAQ needs to be fixed.

Since so many people are responding off list, I'll take a chance to respond 
on-list.

Summary - snort does support PF format log files via -r and pflog devices 
via -i.

However, it only supports said format on a system which has a 
libpcap/tcpdump version that is PF aware. If bpf.h doesn't define the PF 
datalink type, snort will not handle pf files or devices and will generate 
errors if fed them.

The PF log format is an extension of the list of data link formats 
available to pcap, and has been merged to the main tree. The PF "data link" 
adds a header that defines things like what happened to the packet and what 
ruleset is responsible.

Newer releases of libpcap and tcpdump include support for this format, 
older ones don't.

The Breno is running snort on a Linux box, and is trying to parse files 
gathered from an OpenBSD box. It appears that some Linux distros include 
the newer releases, others don't. It appears that Breno's Linux box has a 
non-pf-aware version of libpcap/tcpdump. Since snort can't find the defines 
it needs when built on such a system, PF support disappears. Running pf 
files in generates an unknown data link type error as a result.

As an aside, the FAQ entry is semi-irrelevant to this thread. That faq is 
about using snort to listen pflog DEVICES using snort -i /dev/pflog0, not 
parse pflog FILES via snort -r /var/log/pflog. Two totally different things.






-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users