Snort mailing list archives
Re: barnyard2, syslog and pulling the packet data
From: Y M <snort () outlook com>
Date: Mon, 19 Jan 2015 11:21:25 +0000
Date: Mon, 19 Jan 2015 10:30:47 +0200 From: ran_r () radiflow com To: snort-users () lists sourceforge net Subject: [Snort-users] barnyard2, syslog and pulling the packet data Hello everyone, This is the requirement:From a syslog message that describes an alert to be able to grab the entire packet that caused this alert. I thought of few ways to do this, and after considering other requirements as well, came to the conclusion that I would like to work in this way: 1. snort output to unified2 files.2. barnyard2 reads the files and takes two outputs:a. syslog.b. database. Based on the information in the syslog message, I'll be able to correlate between the message and the saved event. As far as I understand, the correlation should be done using sid and cid. However, I can't find them in the syslog message. ** sid is for the sensor id; if you have one sensor or one Snort/barnyard2 instance forwarding events to DB, then this value will always be 1. If you have multiple sensors or Snort/Barnyard2 instances, then each one will have its own id. Keep in mind that these values are incremental. This is "internally" created by Barnyard2/DB - based on name uniqueness I guess - and is not generated by Snort. ** cid is for the events seen by a particular sensor or Snort/Barnyard2 instance. Again, this is something tracked by Banryard2/DB and not Snort. Am I missing something? ** An option would be 1) since you already know the sensor name/hostname, get its sid, 2) since you already know the signature id (sig_sid), get its sig_id. 3) From here may be you can use the timestamp of the event itself. While may not be as unique as the combination of (sid+cid), this may get you started. Ran. ------------------------------------------------------------------------------ New Year. New Location. New Benefits. New Data Center in Ashburn, VA. GigeNET is offering a free month of service with a new server in Ashburn. Choose from 2 high performing configs, both with 100TB of bandwidth. Higher redundancy.Lower latency.Increased capacity.Completely compliant. http://p.sf.net/sfu/gigenet _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------ New Year. New Location. New Benefits. New Data Center in Ashburn, VA. GigeNET is offering a free month of service with a new server in Ashburn. Choose from 2 high performing configs, both with 100TB of bandwidth. Higher redundancy.Lower latency.Increased capacity.Completely compliant. http://p.sf.net/sfu/gigenet
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- barnyard2, syslog and pulling the packet data Ran Regev (Jan 19)
- Re: barnyard2, syslog and pulling the packet data Y M (Jan 19)