Snort mailing list archives
Perl script that Generates Snort Raw Events
From: "Kamal Ahmed" <Kamal.Ahmed () esecurity net>
Date: Fri, 24 Sep 2004 11:26:22 -0400
Hi, I would like to know if there is a Perl script that Generates Snort Raw Events, e.g. : Full Format: 07/16/-2-08:06:26.464649 [**] [1:716:5] TELNET access [**] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 172.16.112.50:23 -> 135.13.216.191:1026 07/16/-2-08:23:39.630057 [**] [1:716:5] TELNET access [**] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 172.16.112.50:23 -> 135.13.216.191:1588 07/16/-2-08:34:18.399673 [**] [117:1:1] (spp_portscan2) Portscan detected from 195.73.151.50: 6 targets 6 ports in 19 seconds [**] {TCP} 195.73.151.50:2111 -> 172.16.113.105:25 Fast Format: 06/01/-2-08:04:50.992467 [**] [117:1:1] (spp_portscan2) Portscan detected from 172.16.114.148: 1 targets 21 ports in 14 seconds [**] {TCP} 172.16.114.148:20 -> 194.7.248.153:1812 06/01/-2-08:05:07.895030 [**] [1:716:5] TELNET access [**] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 172.16.112.50:23 -> 135.8.60.182:1941 06/01/-2-08:06:48.768633 [**] [117:1:1] (spp_portscan2) Portscan detected from 197.218.177.69: 1 targets 21 ports in 12 seconds [**] {TCP} 197.218.177.69:20 -> 172.16.113.204:1306 06/01/-2-08:07:13.845382 [**] [1:716:5] TELNET access [**] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 172.16.112.50:23 -> 135.8.60.182:2064 06/01/-2-08:16:27.920109 [**] [117:1:1] (spp_portscan2) Portscan detected from 135.8.60.182: 6 targets 6 ports in 5 seconds [**] {TCP} 135.8.60.182:2120 -> 172.16.114.168:25 06/01/-2-08:21:44.335582 [**] [117:1:1] (spp_portscan2) Portscan detected from 135.13.216.191: 6 targets 7 ports in 6 seconds [**] {TCP} 135.13.216.191:2186 -> 172.16.114.169:25 As well as Syslog Format ( I do not have any example) I would appreciate any info/help. Thanks, -Kamal. ------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Perl script that Generates Snort Raw Events Kamal Ahmed (Sep 24)
- <Possible follow-ups>
- RE: Perl script that Generates Snort Raw Events Kamal Ahmed (Sep 25)
- RE: RE: Perl script that Generates Snort Raw Events Lawrence Waterhouse (Sep 25)