Snort mailing list archives
Re: How get list of valid app names for appids rule option.
From: Andy Swartzbaugh via Snort-users <snort-users () lists snort org>
Date: Thu, 4 Oct 2018 10:49:15 -0400
Sorry, I forgot to include the appid directory: appid = { debug = true, -- appid requires this to use appids in rules app_detector_dir = '/opt/snort/lib/' } You get the dynamic stats: -------------------------------------------------- Appid dynamic stats: firefox: flows: 0, clients: 1, users: 0, payloads 0, misc: 0, incompatible: 0, failed: 0 http: flows: 1, clients: 0, users: 0, payloads 0, misc: 0, incompatible: 0, failed: 0 -------------------------------------------------- in addition to the overall line: AppId Lua-Detector Stats: instance 0, odp detectors 497, custom detectors 0, total memory 2900 kb But you still won't get a listing of the appids. On Thu, Oct 4, 2018 at 10:26 AM Andy Swartzbaugh <andy.swartzbaugh () gmail com> wrote:
I believe that the last column of the 'src/network_inspectors/appid/odp/appMapping.data' file will give you what you need. With the following snort.lua configuration element: appid = { debug = true, } You only get the following appid-specific debug information from the executable (which unfortunately does not include the list of appid names): AppId Lua-Detector Stats: instance 0, odp detectors 0, custom detectors 0, total memory 33 kb On Thu, Oct 4, 2018 at 7:21 AM Meridoff via Snort-users < snort-users () lists snort org> wrote:Hello, subj. For snort++. How is the simplest wayt to get valid names that can be used in appids rules option ? I have the ODP dir with lua odp modules, I need to parse them to get names? The valid name is DetectorPackageInfo.name filed ? Thanks _______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: snort-users-leave () lists snort org Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
_______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: snort-users-leave () lists snort org Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
Current thread:
- How get list of valid app names for appids rule option. Meridoff via Snort-users (Oct 04)
- Re: How get list of valid app names for appids rule option. Andy Swartzbaugh via Snort-users (Oct 04)
- Re: How get list of valid app names for appids rule option. Andy Swartzbaugh via Snort-users (Oct 04)
- Re: How get list of valid app names for appids rule option. Mike Stepanek (mstepane) via Snort-users (Oct 04)
- Re: How get list of valid app names for appids rule option. Meridoff via Snort-users (Oct 05)
- Re: How get list of valid app names for appids rule option. Diddi amiibiai via Snort-users (Oct 05)
- Re: How get list of valid app names for appids rule option. Russ via Snort-users (Oct 05)
- Re: How get list of valid app names for appids rule option. Andy Swartzbaugh via Snort-users (Oct 04)