Snort mailing list archives
Re: Help with alert_unixsock issues
From: Simon Biles <simon.biles () gmail com>
Date: Thu, 1 Dec 2005 06:39:54 -0800
Try the following Perl for example : #!/usr/bin/perl # Include the socket libraries use IO::Socket; # This is the template to capture the Alert Name # Edit this to get the additional packets. $TEMPLATE = "A256 A*"; # Release the socket if it already exists unlink "/var/log/snort/snort_alert"; # In case of user termination - exit gracefully. $SIG{TERM} = $SIG{INT} = sub { exit 0 }; # Open up the socket. my $client = IO::Socket::UNIX->new(Type => SOCK_DGRAM, Local => "/var/log/snort/snort_alert") or die "Socket: $@"; print STDOUT "Socket Open ... \n"; # Loop receiving data from the socket, pulling out the # alert name and printing it. my $data; while ( true ) { recv($client,$data,1024,0); @FIELDS = unpack($TEMPLATE, $data); print "@FIELDS[0] \n"; } # At termination close up the socket again. END {unlink "/var/log/snort/snort_alert";} -- Simon Biles CISSP, OPSA, BS7799 Lead Auditor, MBCS ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://ads.osdn.com/?ad_idv37&alloc_id865&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Help with alert_unixsock issues James Turnbull (Dec 01)
- Re: Help with alert_unixsock issues Dirk Geschke (Dec 01)
- Re: Help with alert_unixsock issues Simon Biles (Dec 01)
- Re: Help with alert_unixsock issues James Turnbull (Dec 01)
- Re: Re: Help with alert_unixsock issues James Turnbull (Dec 01)
- Re: Help with alert_unixsock issues Simon Biles (Dec 01)
- Re: Help with alert_unixsock issues Dirk Geschke (Dec 01)