[Snort-users] Alerts on Unix Sockets

permalink · #1 (**permalink**) 09-11-2004

Hello list, I wrote this program to receive the alerts sende=
d
from the snort by the unix socket. It's working, but I just only receive =
the
message of the alert. I want to receive, also, the ip destination, ip sou=
rce
and others informations, like protocol, priority... I want to
receive the same alerts, emmited on the console (with -A console option).
 Is it possible? The simple code, receive correctly the
messages alerts. I didn't receive the rest of the information. Fo=
r
Example, for the alert relationed with bad-traffic, I receive on console
this alert:
Potentially Bad Traffic
[Priority: 2] {ICMP} 127.0.0.1 -> 127.0.0.1 ....... By the
Unix Socket:
BAD-TRAFFIC loopback
traffic ************************************ **********=
******************** Code: #include
<sys/socket.h> #include <sys/un.h> #include
<stdio.h> #define UNSOCK
"/var/log/snort/snort_alert" main() {         int sock,
length;         struct sockaddr_un
name;         char
buf[1024];         sock =3D
socket(AF_UNIX, SOCK_DGRAM, 0);         if (sock < 0)         {        &nb sp;   &n=
bsp;   
perror("opening datagram socket");        &nb sp;   &n=
bsp;   
exit(1);         }        
name.sun_family =3D AF_UNIX;         strcpy(name.sun_pa=
th,
NAME);         if (bind(sock,
(struct sockaddr *) &name, sizeof(struct sockaddr_un)))        
{        &nb sp;   &n=
bsp;   
perror("binding name to datagram socket");        &nb sp;   &n=
bsp;   
exit(1);         }        
printf("socket -->%s\n", NAME);         while
(recvfrom(sock,buf,1024,0,(struct sockaddr *) &name, sizeof(struct
sockaddr_un) > 0))  <=
SPAN
style=3D"mso-spacerun:
yes">       &nb sp;   &n=
bsp;  
printf("-->%s\n", buf);         close(sock); <S=
PAN
style=3D"mso-spacerun: yes">       
unlink(NAME); } Thank you, Maicon Melo Alves=
..
<?xml:namespace prefix =3D o ns =3D "urn:schemas-microsoft-com:office:off=
ice"
/><o:p></o:p>
  
 
________________________________________________
Message sent using UebiMiau 2.7.2 

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode