Re: Can Snort notify a user program when it finishes processing a packet?

[Chang Liu <gaustin909 () gmail com>]

Dear all,

Thanks for your reply. I understand that Snort can standalone examine
packets, but my intent is to interact with Snort from my program, and based
on the decision made by Snort, other follow-up steps will be taken
afterwards in my program. I will try posting this question in snort-dev.

Thanks
Chang

On Tue, Oct 25, 2016 at 8:55 AM, Jim Campbell <jim () w4bqp net> wrote:

> Chang,
>
> If the primary thrust of your effort is to use your program to accomplish
> something, then the answer he gave you is correct.
>
> If the intent is to set up a system that will examine each packet coming
> in to your network then Snort is capable of doing that by itself. Snort can
> be configured as an Intrusion Detection System (IDS) in which it simply
> reports on packets failing some criteria.  An IDS doesn't drop packets.
>
> Snort can also be configured as an Intrusion Prevention System (IPS) in
> which it drops any packet failing that criteria. A Snort IPS is a system
> with two LAN cards. One LAN card sits on the input to the system and the
> other on the output. A packet entering the system on one LAN card that
> passes the criteria is sent to the output LAN card. A packet failing that
> criteria goes no further.
>
> Note: An IPS is bi-directional. I have as many packets failing on the
> outgoing stream as I do on the incoming. If there is something in your
> system trying to send bad stuff out that is caught as well.
>
> I hope this helps,
>
> Jim Campbell
>
> On 10/25/2016 5:32 AM, Chang Liu wrote:
>
> Dear all,
>
> I thought I state my question clearly. Let me try again.
>
> I have a program that will send one packet to Snort at a time. The logic
> is simple. It waits for Snort to finish processing the packet and get back
> the decision Snort made on this packet (whether it triggers an alert).
>
> My question is how can my program knows that Snort has finished processing
> the packet it just sent?
>
> I have tried two methods:
> a) start a Snort instance every time it sends a packet. However, the
> overhead of loading Snort is too long.
> b) Let Snort sniffing on an interface and send packets to this interface.
> But how do we know if Snort has finished processing the single packet it
> just received?
>
> Any suggestion is appreciated. Thanks.
>
> Chang
>
> On Tue, Oct 25, 2016 at 2:19 AM, <wkitty42 () windstream net> wrote:
>
> > On 10/25/2016 01:54 AM, Chang Liu wrote:
> > > Any suggestion to solve this problem? Is it possible to get
> > notification from
> > > Snort every time it finishes processing a packet?
> >
> > the simple answers?? no and no... not the way you are trying... you
> > second given
> > option of monitoring the alert file is about the only thing you have...
> >
> > what, exactly, are you trying to do with your program??
> >
> > --
> >   NOTE: No off-list assistance is given without prior approval.
> >         *Please keep mailing list traffic on the list* unless
> >         private contact is specifically requested and granted.
> >
> > ------------------------------------------------------------
> > ------------------
> > The Command Line: Reinvented for Modern Developers
> > Did the resurgence of CLI tooling catch you by surprise?
> > Reconnect with the command line and become more productive.
> > Learn the new .NET and ASP.NET CLI. Get your free copy!
> > http://sdm.link/telerik
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> >
> > Please visit http://blog.snort.org to stay current on all the latest
> > Snort news!
>
>
>
> ------------------------------------------------------------------------------
> The Command Line: Reinvented for Modern Developers
> Did the resurgence of CLI tooling catch you by surprise?
> Reconnect with the command line and become more productive.
> Learn the new .NET and ASP.NET CLI. Get your free copy!http://sdm.link/telerik
>
>
>
> _______________________________________________
> Snort-users mailing listSnort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
>
>
>
> ------------------------------------------------------------
> ------------------
> The Command Line: Reinvented for Modern Developers
> Did the resurgence of CLI tooling catch you by surprise?
> Reconnect with the command line and become more productive.
> Learn the new .NET and ASP.NET CLI. Get your free copy!
> http://sdm.link/telerik
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
------------------------------------------------------------------------------
The Command Line: Reinvented for Modern Developers
Did the resurgence of CLI tooling catch you by surprise?
Reconnect with the command line and become more productive. 
Learn the new .NET and ASP.NET CLI. Get your free copy!
http://sdm.link/telerik

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!