Re: Can Snort notify a user program when it finishes processing a packet?

[Jim Campbell <jim () w4bqp net>]

Chang,

If the primary thrust of your effort is to use your program to 
accomplish something, then the answer he gave you is correct.

If the intent is to set up a system that will examine each packet coming 
in to your network then Snort is capable of doing that by itself. Snort 
can be configured as an Intrusion Detection System (IDS) in which it 
simply reports on packets failing some criteria.  An IDS doesn't drop 
packets.

Snort can also be configured as an Intrusion Prevention System (IPS) in 
which it drops any packet failing that criteria. A Snort IPS is a system 
with two LAN cards. One LAN card sits on the input to the system and the 
other on the output. A packet entering the system on one LAN card that 
passes the criteria is sent to the output LAN card. A packet failing 
that criteria goes no further.

Note: An IPS is bi-directional. I have as many packets failing on the 
outgoing stream as I do on the incoming. If there is something in your 
system trying to send bad stuff out that is caught as well.

I hope this helps,

Jim Campbell


On 10/25/2016 5:32 AM, Chang Liu wrote:
> Dear all,
>
> I thought I state my question clearly. Let me try again.
>
> I have a program that will send one packet to Snort at a time. The 
> logic is simple. It waits for Snort to finish processing the packet 
> and get back the decision Snort made on this packet (whether it 
> triggers an alert).
>
> My question is how can my program knows that Snort has finished 
> processing the packet it just sent?
>
> I have tried two methods:
> a) start a Snort instance every time it sends a packet. However, the 
> overhead of loading Snort is too long.
> b) Let Snort sniffing on an interface and send packets to this 
> interface. But how do we know if Snort has finished processing the 
> single packet it just received?
>
> Any suggestion is appreciated. Thanks.
>
> Chang
>
> On Tue, Oct 25, 2016 at 2:19 AM, <wkitty42 () windstream net 
> <mailto:wkitty42 () windstream net>> wrote:
>
>     On 10/25/2016 01:54 AM, Chang Liu wrote:
>     > Any suggestion to solve this problem? Is it possible to get
>     notification from
>     > Snort every time it finishes processing a packet?
>
>     the simple answers?? no and no... not the way you are trying...
>     you second given
>     option of monitoring the alert file is about the only thing you
>     have...
>
>     what, exactly, are you trying to do with your program??
>
>     --
>       NOTE: No off-list assistance is given without prior approval.
>             *Please keep mailing list traffic on the list* unless
>             private contact is specifically requested and granted.
>
>     ------------------------------------------------------------------------------
>     The Command Line: Reinvented for Modern Developers
>     Did the resurgence of CLI tooling catch you by surprise?
>     Reconnect with the command line and become more productive.
>     Learn the new .NET and ASP.NET <http://ASP.NET> CLI. Get your free
>     copy!
>     http://sdm.link/telerik
>     _______________________________________________
>     Snort-users mailing list
>     Snort-users () lists sourceforge net
>     <mailto:Snort-users () lists sourceforge net>
>     Go to this URL to change user options or unsubscribe:
>     https://lists.sourceforge.net/lists/listinfo/snort-users
>     <https://lists.sourceforge.net/lists/listinfo/snort-users>
>     Snort-users list archive:
>     http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>     <http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users>
>
>     Please visit http://blog.snort.org to stay current on all the
>     latest Snort news!
>
>
>
>
> ------------------------------------------------------------------------------
> The Command Line: Reinvented for Modern Developers
> Did the resurgence of CLI tooling catch you by surprise?
> Reconnect with the command line and become more productive.
> Learn the new .NET and ASP.NET CLI. Get your free copy!
> http://sdm.link/telerik
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------
The Command Line: Reinvented for Modern Developers
Did the resurgence of CLI tooling catch you by surprise?
Reconnect with the command line and become more productive. 
Learn the new .NET and ASP.NET CLI. Get your free copy!
http://sdm.link/telerik

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!