Re: Unified Log Format

["Mario D. Santana" <mds () mariosantana net>]

Martin,

> If you want a comprehensive map of the SIDs (Snort ID's) of GID 1, you should 
> look at the sid-msg.map file in the etc directory of your Snort distribution. 
> SID 527 is a bad-traffic.rules detect for same source/dest IP in a packet. 
> Typically you'll get these listening on loopback...

Ahh!  The sid-msg.map, now I get it.  In fact, this 527 alert is from an 
old log file from an early snort setup of mine.  Maybe I'll get ethereal 
to load up this file and generate the messages from it...

> [...] Typically the log data 
> will be a standard Snort packet, but on aggregate event like a portscan 
> you'll get our crammed packet type that we're overloading the field with.

Right.  I've actually been able to (mostly) decode the sfPorstan packets. 
I'm thinking about teaching ethereal to understand the actual packet 
contents for these.  It seems that these packets use the SLL ("linux 
cooked capture") encapsulation, but with a broken or missing SLL header? 
I've gotten it to work by forcing the encapsulation to ethernet -- then 
the normal ethereal ethernet dissector kicks in and the rest follows.  But 
the reference date is all wacky...

> GIDs 100, 117, 121 and 122 are all various portscan detectors that have been 
> built for Snort over the years, you might just want to skip those records...

Hmm.  Is there any way to get a full list of these "aggregate events" that 
you mention, along with details about the packet they fake up?

Thanks for the tips!  Some of these anomalies are starting to make sense.

Cheers,
mds


-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users