Re: Snort and Mysql for statistics purposes

Hi all,

It's my first query to a group, i am intended to make a data analysis interface using PHP and MySql and i am stuck at a point i.e how to fetch top 10 records e.g. top 10 source IPs or top 10 Destination ports from mysql database. Can any one please help in this regard, any Mysql commands or something...?

Regards

Omar

>From: [email protected] >To: David Jiménez Domínguez <[email protected]> >CC: [email protected], [email protected],[email protected] >Subject: Re: Snort and Mysql for statistics purposes >Date: Wed, 9 Mar 2005 08:53:46 -0500 >MIME-Version: 1.0 >X-Originating-IP: 68.40.48.74 >Received: from [205.206.231.26] ([205.206.231.26]) by mc10-f13.hotmail.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 9 Mar 2005 06:21:54 -0800 >Received: from no.name.available by [205.206.231.26] via smtpd (for [65.54.166.230] [65.54.166.230]) with ESMTP; Wed, 9 Mar 2005 06:22:02 -0800 >Received: from lists.securityfocus.com (lists.securityfocus.com [205.206.231.19])by outgoing2.securityfocus.com (Postfix) with SMTP id BA446160961for <[email protected]>; Wed, 9 Mar 2005 07:11:36 -0700 (MST) >Received: (qmail

20335 invoked by alias); 9 Mar 2005 14:37:46 -0000 >Received: (qmail 14396 invoked from network); 9 Mar 2005 14:10:05 -0000 >X-Message-Info: JGTYoYF78jGFFV1qsmGqmdPXbfSdrgjwFGM4X0g561k= >Mailing-List: contact [email protected]; run by ezmlm >Precedence: bulk >X-No-Archive: yes >List-Id: <honeypots.list-id.securityfocus.com> >List-Post: <mailto:[email protected]> >List-Help: <mailto:[email protected]> >List-Unsubscribe: <mailto:[email protected]> >List-Subscribe: <mailto:[email protected]> >Delivered-To: mailing list [email protected] >Delivered-To: moderator for [email protected] >References: <[email protected]> >User-Agent: Internet Messaging Program (IMP) 3.2.7 >X-IMP-Server:
141.211.144.104 >X-Originating-User: sushant >X-Spam-Checker-Version: SpamAssassin 3.0.0-r20550 (2004-05-28) on mail.securityfocus.com >X-Spam-Status: No, score=1.3 required=5.0 tests=NO_REAL_NAME,SPF_HELO_FAIL autolearn=no version=3.0.0-r20550 >X-Spam-Level: * >Return-Path: [email protected] >X-OriginalArrivalTime: 09 Mar 2005 14:21:55.0021 (UTC) FILETIME=[585DB7D0:01C524B3] > >I have used PHP with jpgraph to get real time threat graphs. PHP is very easy to >use with MYSQL and jpgraph is a good graphic tool. >-Sushant. >Quoting David Jiménez Domínguez <[email protected]>: > > > Hi folks! > > > > I need to graph all the traffic in my network (Top ports, Top src_ip, > > Top attacks) each 5 minutes...In the DataServer I have intalled Mysql > > and in the firewall I have
installed snort-2.3.0 and I created just 4 > > rules to get all the tcp,udp,icmp and ip traffic in order to graph it > > with perl and rrdtool and post it in a web page.... > > > > Do you think it is the best way to do that??? > > Have your ever done something like that?? What tools do you recommend me?? > > > > Regards > > > > DJ > > -------------------------------------------------- > > > > > > > >

----------
The new, more precise and more powerful MSN Search is here! Take a tour today.

-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users