Re: [Snort-users] Extending CSV output plug-in

permalink · #1 (**permalink**) 03-03-2008

--===============1734221072==
Content-Type: multipart/alternative;
boundary="----=_Part_28144_13440253.1204512283142"

------=_Part_28144_13440253.1204512283142
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Yes - all other outputs i.e. tcpdump, fast, standard are working properly.
Its only csv that is not producing any output.

Thanks for pointing to the Snort development site.

Apologies for posting to private e-mail unintentionally.

Come on guys, is there anyone to point out where I might have problem??????

On Mon, Mar 3, 2008 at 12:14 PM, Jason <security@brvenik.com> wrote:

>
>
> Kamran Shafi wrote:
> > Hi Jason,
> >
> > Thanks for the reply. However, due to my ignorance I couldn't get much
> out
> > of it.
> >>> inline -- could you please elobarate more.
> >
> >>> Perhaps it is because command line options override the config file.
> > I don't really think so, because the tcpdump output is working without
> any
> > glitches.
>
> Did you try?
>
> >
> >>> You will have to write the code to make packet data available in the
> csv.
> > I guessed so -- can you provide any useful links, where to start from
> and
> > which module/preprocessor to modify??
>
> You should start reading here - http://www.snort.org/docs/#devel
>
> Specifically, look at src/output-plugins/spo_csv.c
>
> For templates check out hte sources in the templates directories.
>
> Please keep replies on list, it doesn't much help the next person when
> things go off-line.
>
>
> > On Sun, Mar 2, 2008 at 12:52 PM, Jason <security@brvenik.com> wrote:
> >
> >> inline
> >>
> >> Kamran Shafi wrote:
> >>> Hi All,
> >>>
> >>> I am new to Snort and this is my first mail to this list so please
> bear
> >> with
> >>> me.
> >>>
> >>> First - I have been trying hard for last few days to get csv plug-in
> >> work
> >>> for me but it has not. I am on Fedora Core 7 and running Snort 2.8.1the
> >>> latest version. I am running Snort with the following command:
> >>>
> >>> snort -A console -i lo -c test.conf (please see the output of running
> >> this
> >>> command at the bottom of this mail)
> >>>
> >>> I have enabled only one rules file i.e. local.rules and have some test
> >> rules
> >>> in it.
> >>>
> >>> the entry for my csv output plug-in in the test.conf file is
> >>>
> >>> output alert_CSV: /var/log/alert.csv default
> >>>
> >>> Afterwards I generate some attack traffic and get some alerts on the
> >>> console. (please see the output at the end of this mail).
> >>>
> >>> The problem is that the alert.csv is never created!!!
> >>>
> >>> I have tried using full mode, -h flag and few other tricks but nothing
> >> is
> >>> working
> >> Perhaps it is because command line options override the config file.
> >>
> >>> Please note that I have not installed barnyard and assume that it is
> not
> >> a
> >>> must for csv module to work.
> >>>
> >>> My second question is the following:
> >>>
> >>> If I am lucky enough to configure the csv module correctly with the
> help
> >> of
> >>> you gurus, then how can I extend this module to add more details about
> >> the
> >>> packet payload to the csv output ?
> >>>
> >>> I have posted similar messages on Snort forum without any response.
> Any
> >> help
> >>> is appreciated.
> >> You will have to write the code to make packet data available in the
> csv.
> >>
> >
>

--
Regards
Kamran Shafi
+61 41 824 9510

------=_Part_28144_13440253.1204512283142
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

<div>Yes - all other outputs i.e. tcpdump, fast, standard are working properly. Its only csv that is not producing any output.</div>
<div> </div>
<div>Thanks for pointing to the Snort development site.</div>
<div> </div>
<div>Apologies for posting to private e-mail unintentionally. </div>
<div> </div>
<div>Come on guys, is there anyone to point out where I might have problem??????<br><br></div>
<div class="gmail_quote">On Mon, Mar 3, 2008 at 12:14 PM, Jason <<a href="mailto:security@brvenik.com">security@brveni k.com</a>> wrote:<br>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">
<div class="Ih2E3d"><br><br>Kamran Shafi wrote:<br>> Hi Jason,<br>><br>> Thanks for the reply. However, due to my ignorance I couldn't get much out<br>> of it.<br>>>> inline -- could you please elobarate more.<br>
><br>>>> Perhaps it is because command line options override the config file.<br>> I don't really think so, because the tcpdump output is working without any<br>> glitches.<br><br></div>Did you try?<br>

<div class="Ih2E3d"><br>><br>>>> You will have to write the code to make packet data available in the csv.<br>> I guessed so -- can you provide any useful links, where to start from and<br>> which module/preprocessor to modify??<br>
<br></div>You should start reading here - <a href="http://www.snort.org/docs/#devel" target="_blank">http://www.snort.org/docs/#devel</a><br><br>Specifically, look at src/output-plugins/spo_csv.c<br><br>For templates check out hte sources in the templates directories.<br>
<br>Please keep replies on list, it doesn't much help the next person when<br>things go off-line.<br>
<div>
<div></div>
<div class="Wj3C7c"><br><br>> On Sun, Mar 2, 2008 at 12:52 PM, Jason <<a href="mailto:security@brvenik.com">security@brveni k.com</a>> wrote:<br>><br>>> inline<br>>><br>>> Kamran Shafi wrote:<br>
>>> Hi All,<br>>>><br>>>> I am new to Snort and this is my first mail to this list so please bear<br>>> with<br>>>> me.<br>>>><br>>>> First - I have been trying hard for last few days to get csv plug-in<br>
>> work<br>>>> for me but it has not. I am on Fedora Core 7 and running Snort 2.8.1 the<br>>>> latest version. I am running Snort with the following command:<br>>>><br>>>> snort -A console -i lo -c test.conf  (please see the output of running<br>
>> this<br>>>> command at the bottom of this mail)<br>>>><br>>>> I have enabled only one rules file i.e. local.rules and have some test<br>>> rules<br>>>> in it.<br>>>><br>
>>> the entry for my csv output plug-in in the test.conf file is<br>>>><br>>>> output alert_CSV: /var/log/alert.csv default<br>>>><br>>>> Afterwards I generate some attack traffic and get some alerts on the<br>
>>> console. (please see the output at the end of this mail).<br>>>><br>>>> The problem is that the alert.csv is never created!!!<br>>>><br>>>> I have tried using full mode, -h flag and few other tricks but nothing<br>
>> is<br>>>> working<br>>> Perhaps it is because command line options override the config file.<br>>><br>>>> Please note that I have not installed barnyard and assume that it is not<br>
>> a<br>>>> must for csv module to work.<br>>>><br>>>> My second question is the following:<br>>>><br>>>> If I am lucky enough to configure the csv module correctly with the help<br>
>> of<br>>>> you gurus, then how can I extend this module to add more details about<br>>> the<br>>>> packet payload to the csv output ?<br>>>><br>>>> I have posted similar messages on Snort forum without any response. Any<br>
>> help<br>>>> is appreciated.<br>>> You will have to write the code to make packet data available in the csv.<br>>><br>><br></div></div></blockquote></div><br><br clear="all"><br>-- <br>Regards<br>
Kamran Shafi<br>+61 41 824 9510

------=_Part_28144_13440253.1204512283142--

--===============1734221072==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
--===============1734221072==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users
--===============1734221072==--

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode