On November 29, 2004 5:06 pm, Matt Kettler wrote:
At 06:27 PM 11/29/2004, Matt Kettler wrote:
What is wrong with that? Does snort understand the pf log format?
No, snort doesn't understand any textual log formats at all, including pf.
Self correction.. pflogd generates tcpdump binary files. So, theoretically,
it should work with snort -r.
My mistake entirely.
However, looking around, pflogd files aren't exactly tcpdump files.. they
have (or at least had) a "pftcpdump" to read them in freebsd:
http://lists.freebsd.org/pipermail/freebsd-current/2004-August/035814.html
http://lists.sans.org/pipermail/list/2004-November/062633.html
It's unclear if OpenBSD generates real tcpdump files that any ordinary
tcpdump can read, or if they patched tcpdump to support them.
It doesn't, it is a modified format that the tcpdump in OpenBSD was patched to
read. However, in the FAQ:
4.4 Does snort see packets filtered by IPTables/IPChains/IPF/PF?
...
Under OpenBSD you can snort just the PF rejects by using the /dev/pflogN
interface.
Since pflogd simply writes the traffic from pflog, snort should be able to
understand the log file, but I have tried to have it read the file and
attached it to /dev/pflog0 and it does not understand the traffic. Perhaps
the output format changed in one of the recent OpenBSD releases and Snort was
never updated. If so, the FAQ needs to be fixed.
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
