Extract HTTP data from snort

Akhil Koul <[email protected]>
Newsgroups gmane.comp.security.ids.snort.devel
Message-ID <CAK9eeqWUEP7V+_TOYodTpMzbxUTufRyWxktaBUmz_xPn-SWP1A@mail.gmail.com>
Hello

I am working as part of GSoC under the organization Modsecurity.
Modsecurity v3(latest version) has 2 parts : Connector and Core. Core has
the basic modsecurity functionality while connectors are used to interface
core with other apps.

My project is to interface snort with libmodsecurity. For that, I need to
send data fields extracted by Snort to the libmodsec function so that it
can do further processing. Some of the fields are:
- source and dest IP and port
- HTTP version and method
- URI and query params
- Request and response Body

You can find more about libmodsecurity at
https://github.com/SpiderLabs/ModSecurity/tree/libmodsecurity.

 So, how should I proceed? I have already gone through the docs and have
the basic understanding

Thanks
Akhil

------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are 
consuming the most bandwidth. Provides multi-vendor support for NetFlow, 
J-Flow, sFlow and other flows. Make informed decisions using capacity 
planning reports. https://ad.doubleclick.net/ddm/clk/305295220;132659582;e

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.