Re: [Snort-users] unpacking IP follow up

On Sun, Aug 01, 2004 at 09:27:27PM -0400, Don Murdoch wrote:
>
> OH - after I had my senior moment - I did notice from the ACID
> page that you can write
>
> "Select inet_ntoa( ip_src ) from iphdr"
>
> and it does work. SO ... now that I am totally embarrassed, I
> would still like to know if anyone has a code chunk they can
> share which shows how to do this "the hard way".
>
> Much ablidged
>
> --------------------------------------
> >From the home outbox of ...
> Don Murdoch, CISSP
> GCWN, GCUX, GCIA, GCIH, MCSD, MCSE (NT/2K)
> Today's Sun Tzu Quote: "To fight and conquer in all your battles is not
> supreme excellence; supreme excellence consists in breaking the enemy's
> resistance without fighting." -Sun Tzu

If you want to do this with perl (i would ;) ) here is one way you could do it.

# We only need access to inet_aton and inet_ntoa.
use Socket qw (inet_aton inet_ntoa);
my $int = '167837953';
my $ip = '10.1.1.1';
# convert ip (example 10.1.1.1) to 32bit int.
print "Ip in Int form " . unpack( "N", inet_aton($ip) ) . "\n";
# convert 32bit (example 167837953) to ip
print "Ip in IP form " . inet_ntoa( pack("N", $int) ) . "\n";

Then you can always cache the results in hash so that you only call the socket
func 1 time per ip. Should speed things up a bit and let the database
concentrate on database stuff.

Very basic cache check...

my %ipcache;

$ipcache{ $int } = inet_ntoa( pack("N", $int) ) unless defined( $ipcache{ $int } );

Something like that.


-------------------------------------------------------
This SF.Net email is sponsored by OSTG. Have you noticed the changes on
Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
one more big change to announce. We are now OSTG- Open Source Technology
Group. Come see the changes on the new OSTG site. www.ostg.com
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users