alert_json logger - not working
Michael Heard via Snort-users <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <DM6PR06MB613911A20325519B99DAF8BF901F9@DM6PR06MB6139.namprd06.prod.outlook.com> |
Hello, I have recently installed Snort3 on Centos Stream 8, using the instructions provided by Snort 3 on the CentOS 8 Stream document (Snort_3_GA_on_CentOS8_Stream.pdf). I believe I successfully completed the steps of sections 7.5 (Configuring alert_json Logger), but the installation doesn't appear to work. A file is created with the name "alert_json.txt, but it doesn't contain any contents. Is something missing in my configuration? Can someone provide some insight into what might be causing this problem? See attachments: 1. snort.lua 2. snort_default.lua 3. Results of running a test against a pcap. Here's what the snort log folder looks like: [root@localhost snort]# cd /var/log/snort/ [root@localhost snort]# ls -la total 4 drws-----T. 2 snort snort 50 Mar 29 21:04 . drwxr-xr-x. 10 root root 4096 Mar 27 03:49 .. -rw-r--r-- 1 root root 0 Mar 29 21:04 alert_fast.txt -rw-r--r-- 1 root root 0 Mar 29 21:04 alert_json.txt Thanks _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
snort_defaults.lua
(application/octet-stream, 50.1 KB) - not displayed
snort.lua
(application/octet-stream, 8.7 KB) - not displayed
sample-snort.rtf
(text/rtf, 50.4 KB)
{\rtf1\ansi\ansicpg1252\cocoartf2580
\cocoatextscaling0\cocoaplatform0{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
{\colortbl;\red255\green255\blue255;}
{\*\expandedcolortbl;;}
\margl1440\margr1440\vieww22160\viewh13480\viewkind0
\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural\partightenfactor0
\f0\fs24 \cf0 [root@localhost user1]# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -r /home/user1/np1-Unmatched_traffic.pcap -l /var/log/snort --plugin-path /usr/local/snort/extra -k none -m 0x1b\
--------------------------------------------------\
o")~ Snort++ 3.1.23.0\
--------------------------------------------------\
Loading /usr/local/snort/etc/snort/snort.lua:\
Loading snort_defaults.lua:\
Finished snort_defaults.lua:\
Loading file_magic.lua:\
Finished file_magic.lua:\
ssh\
hosts\
host_cache\
pop\
so_proxy\
stream_tcp\
smtp\
gtp_inspect\
packets\
dce_http_proxy\
daq\
stream_icmp\
normalizer\
alert_json\
alert_fast\
ips\
binder\
wizard\
appid\
stream_udp\
file_id\
http2_inspect\
search_engine\
http_inspect\
ftp_data\
ftp_server\
port_scan\
dce_http_server\
dce_smb\
dce_tcp\
telnet\
ssl\
sip\
rpc_decode\
netflow\
iec104\
modbus\
host_tracker\
stream_user\
stream_ip\
back_orifice\
classifications\
dnp3\
active\
trace\
ftp_client\
alerts\
decode\
stream\
process\
references\
arp_spoof\
output\
network\
dns\
dce_udp\
imap\
file_policy\
stream_file\
Finished /usr/local/snort/etc/snort/snort.lua:\
Loading ips.rules:\
Loading ../../rules/snort.rules:\
Finished ../../rules/snort.rules:\
Finished ips.rules:\
--------------------------------------------------\
rule counts\
total rules loaded: 17515\
text rules: 17515\
option chains: 17515\
chain headers: 515\
--------------------------------------------------\
port rule counts\
tcp udp icmp ip\
any 318 26 11 5\
src 6383 32 0 0\
dst 10462 293 0 0\
both 2 6 0 0\
total 17165 357 11 5\
--------------------------------------------------\
ips policies rule stats\
id loaded shared enabled file\
0 17515 0 17515 /usr/local/snort/etc/snort/snort.lua\
--------------------------------------------------\
flowbits\
defined: 152\
not checked: 7\
--------------------------------------------------\
service rule counts to-srv to-cli\
dcerpc: 58 7\
dhcp: 6 2\
dns: 135 21\
drda: 2 0\
file: 2 2\
ftp: 23 5\
ftp-data: 50 5430\
http: 4721 6124\
http2: 4721 6124\
ident: 1 0\
imap: 51 5550\
irc: 3 1\
ircd: 0 1\
java_rmi: 18 1\
kerberos: 7 0\
ldap: 11 3\
mysql: 12 2\
netbios-dgm: 5 5\
netbios-ns: 3 1\
netbios-ssn: 180 43\
netware: 2 0\
ntp: 15 3\
openvpn: 16 16\
pop3: 36 5549\
postgresql: 1 0\
printer: 2 0\
radius: 2 2\
rdp: 6 15\
rtmp: 1 4\
rtsp: 4 0\
sip: 6 1\
smtp: 4944 16\
snmp: 8 1\
ssdp: 11 0\
ssh: 1 2\
ssl: 52 58\
sunrpc: 18 0\
telnet: 20 2\
tftp: 2 0\
vnc: 1 0\
vnc-server: 1 1\
wins: 2 0\
total: 15160 28992\
--------------------------------------------------\
fast pattern port groups src dst any\
packet: 47 292 4\
--------------------------------------------------\
fast pattern service groups to-srv to-cli\
packet: 40 28\
key: 6 0\
header: 7 6\
body: 2 0\
file: 9 8\
raw_key: 2 0\
method: 2 0\
--------------------------------------------------\
search engine\
instances: 453\
patterns: 47061\
pattern chars: 1147866\
num states: 891354\
num match states: 113144\
memory scale: MB\
total memory: 25.9012\
pattern memory: 2.88949\
match list memory: 12.3289\
transition memory: 10.6275\
--------------------------------------------------\
pcap DAQ configured to read-file.\
Commencing packet processing\
++ [0] /home/mheard/np1-Unmatched_traffic.pcap\
-- [0] /home/mheard/np1-Unmatched_traffic.pcap\
--------------------------------------------------\
Packet Statistics\
--------------------------------------------------\
daq\
pcaps: 1\
received: 98632\
analyzed: 98632\
allow: 95720\
whitelist: 2912\
rx_bytes: 99068358\
expected_flows: 27\
--------------------------------------------------\
codec\
total: 98632 (100.000%)\
arp: 79 ( 0.080%)\
eth: 98632 (100.000%)\
icmp4: 153 ( 0.155%)\
icmp4_ip: 43 ( 0.044%)\
icmp6: 18 ( 0.018%)\
ipv4: 98436 ( 99.801%)\
ipv6: 18 ( 0.018%)\
llc: 117 ( 0.119%)\
tcp: 79224 ( 80.323%)\
teredo: 18 ( 0.018%)\
udp: 19059 ( 19.323%)\
vlan: 97445 ( 98.797%)\
--------------------------------------------------\
Module Statistics\
--------------------------------------------------\
appid\
packets: 98436\
processed_packets: 98266\
ignored_packets: 170\
total_sessions: 6139\
service_cache_adds: 990\
--------------------------------------------------\
arp_spoof\
packets: 79\
--------------------------------------------------\
back_orifice\
packets: 19007\
--------------------------------------------------\
binder\
raw_packets: 366\
new_flows: 6115\
service_changes: 1957\
inspects: 6481\
--------------------------------------------------\
dce_smb\
pdus: 8\
sessions: 14\
packets: 12\
max_outstanding_requests: 1\
v2_setup: 12\
v2_tree_cnct: 12\
v2_crt: 136\
v2_read: 52\
v2_cls: 51\
v2_cls_req_ftrkr_misng: 13\
v2_msgs_uninspected: 340\
v2_session_ignored: 1\
max_concurrent_sessions: 14\
total_smb1_sessions: 6\
total_smb2_sessions: 8\
total_mc_sessions: 6\
--------------------------------------------------\
dce_tcp\
pdus: 24\
binds: 8\
bind_acks: 8\
requests: 8\
tcp_sessions: 8\
tcp_packets: 24\
max_concurrent_sessions: 8\
--------------------------------------------------\
detection\
analyzed: 98632\
raw_searches: 162939\
cooked_searches: 36660\
pkt_searches: 199599\
key_searches: 303\
header_searches: 602\
body_searches: 92\
file_searches: 302\
raw_key_searches: 303\
method_searches: 303\
--------------------------------------------------\
dns\
packets: 1222\
requests: 639\
responses: 281\
max_concurrent_sessions: 9\
--------------------------------------------------\
file_id\
total_files: 251\
total_file_data: 65215\
max_concurrent_files: 4\
--------------------------------------------------\
http_inspect\
flows: 134\
scans: 1377\
reassembles: 1376\
inspections: 1007\
requests: 211\
responses: 167\
get_requests: 117\
head_requests: 1\
post_requests: 92\
connect_requests: 1\
request_bodies: 92\
chunked: 1\
uri_normalizations: 34\
uri_coding: 8\
max_concurrent_sessions: 132\
connect_tunnel_cutovers: 1\
total_bytes: 637751\
--------------------------------------------------\
normalizer\
test_tcp_trim_win: 38510\
test_tcp_ts_nop: 876\
test_tcp_ips_data: 20\
test_tcp_block: 79\
--------------------------------------------------\
pcre\
pcre_rules: 3956\
pcre_native: 3956\
--------------------------------------------------\
port_scan\
packets: 98436\
trackers: 3832\
--------------------------------------------------\
search_engine\
max_queued: 641\
total_flushed: 88653\
total_inserts: 165044\
total_unique: 88653\
non_qualified_events: 88606\
qualified_events: 47\
searched_bytes: 230769116\
--------------------------------------------------\
ssh\
packets: 13\
total_bytes: 2242\
max_concurrent_sessions: 3\
--------------------------------------------------\
ssl\
packets: 10565\
decoded: 10565\
client_hello: 1787\
server_hello: 1704\
certificate: 879\
server_done: 1863\
client_key_exchange: 345\
server_key_exchange: 364\
change_cipher: 2196\
client_application: 2617\
server_application: 2706\
alert: 34\
unrecognized_records: 872\
handshakes_completed: 395\
sessions_ignored: 395\
detection_disabled: 21\
max_concurrent_sessions: 1764\
--------------------------------------------------\
stream\
flows: 6115\
expected_flows: 30\
--------------------------------------------------\
stream_icmp\
sessions: 88\
max: 88\
created: 88\
released: 88\
--------------------------------------------------\
stream_tcp\
sessions: 3959\
max: 3959\
created: 3959\
released: 3959\
instantiated: 3899\
setups: 3959\
restarts: 1956\
discards_skipped: 79\
invalid_seq_num: 38444\
invalid_ack: 5\
events: 79\
syn_trackers: 2429\
syn_ack_trackers: 23\
data_trackers: 1507\
segs_queued: 30433\
segs_released: 30433\
segs_used: 19116\
rebuilt_packets: 13314\
rebuilt_bytes: 13702066\
overlaps: 20\
gaps: 13\
payload_fully_trimmed: 11\
client_cleanups: 280\
server_cleanups: 508\
established: 67\
syns: 3176\
syn_acks: 2214\
resets: 692\
fins: 1257\
inspector_fallbacks: 10\
partial_fallbacks: 76\
max_segs: 835\
max_bytes: 1137129\
--------------------------------------------------\
stream_udp\
sessions: 2068\
max: 2068\
created: 2068\
released: 2068\
total_bytes: 14871217\
--------------------------------------------------\
wizard\
tcp_scans: 3640\
tcp_hits: 1956\
tcp_misses: 34\
udp_scans: 1452\
udp_misses: 1452\
--------------------------------------------------\
Appid Statistics\
--------------------------------------------------\
detected apps and services\
Application: Services Clients Users Payloads Misc Referred\
amazon: 0 0 0 2 0 0\
apple_update: 0 0 0 3 0 0\
bing: 0 0 0 1 0 0\
bits: 0 1 0 0 0 0\
dropbox: 0 0 0 1 0 0\
google: 0 0 0 24 0 0\
mcafee: 0 0 0 3 0 0\
msn: 0 0 0 7 0 0\
syslog: 1 1 0 0 0 0\
tacacs+: 23 0 0 0 0 0\
yahoo!: 0 0 0 7 0 0\
adobe_software: 0 0 0 1 0 0\
android_browser: 0 5 0 0 0 0\
apple_mail: 0 0 0 2 0 0\
chrome: 0 7 0 0 0 0\
dce/rpc: 4 0 0 0 0 0\
dhcp: 18 0 0 0 0 0\
dns: 276 312 0 0 0 0\
facebook: 0 1 0 34 0 0\
firefox: 0 5 0 0 0 0\
gmail: 0 0 0 229 0 0\
google_analytics: 0 0 0 5 0 0\
http: 134 0 0 0 0 0\
hulu: 0 0 0 2 0 0\
itunes: 0 0 0 15 0 0\
kerberos: 7 6 0 0 0 0\
ldap: 7 0 2 0 0 0\
netbios-ns: 2 2 0 0 0 0\
netbios-ssn_(smb): 6 0 0 0 0 0\
netflix: 0 0 0 7 0 0\
ntp: 16 0 0 0 0 0\
oracle_database: 0 5 5 0 0 0\
tns/oracle: 10 0 0 0 0 0\
radius: 1 0 0 0 0 0\
radius-acct: 3 0 0 0 0 0\
safari: 0 1 0 0 0 0\
schuelervz: 0 0 0 1 0 0\
skype: 0 0 0 4 0 0\
snmp: 13 0 0 0 0 0\
ssh: 1 1 0 0 0 0\
ssl: 60 0 0 0 0 0\
stun: 7 0 0 0 0 0\
twitter: 0 0 0 1 0 0\
youtube: 0 0 0 7 0 0\
cisco_secure_endpoint: 0 1 0 0 0 0\
netflix_stream: 0 0 0 16 0 0\
twitchtv: 0 0 0 8 0 0\
steam: 0 0 0 1 0 0\
realaudio: 0 1 0 0 0 0\
smtps: 2 0 0 0 0 0\
imaps: 229 0 0 0 0 0\
https: 1468 0 0 0 0 0\
zabbix: 6 0 0 0 0 0\
spotify: 0 0 0 3 0 0\
apns: 0 0 0 3 0 0\
apple_sites: 0 0 0 98 0 0\
icloud: 0 0 0 52 0 0\
instagram: 0 5 0 0 0 0\
mozilla: 0 0 0 1 0 0\
avast: 0 0 0 1 0 0\
opera: 0 1 0 0 0 0\
ssl_client: 0 1314 0 0 0 0\
twitter_link_service: 0 0 0 1 0 0\
advertising.com: 0 0 0 1 0 0\
doubleclick: 0 0 0 11 0 0\
ad_nexus: 0 0 0 8 0 0\
pubmatic: 0 0 0 3 0 0\
cloudfront: 0 0 0 5 0 0\
apple_stocks: 0 2 0 0 0 0\
microsoft: 0 0 0 42 0 0\
google_adsense: 0 0 0 1 0 0\
imrworldwide: 0 0 0 1 0 0\
siri: 0 0 0 5 0 0\
akamai: 0 0 0 1 0 0\
line: 0 1 0 0 0 0\
java: 0 1 0 0 0 0\
doubleverify: 0 0 0 7 0 0\
minecraft: 0 0 0 1 0 0\
amazon_ads_system: 0 0 0 3 0 0\
nhl.com: 0 0 0 1 0 0\
roku: 0 0 0 1 0 0\
starbucks: 0 1 0 0 0 0\
yahoo!_calendar: 0 0 0 1 0 0\
microsoft_cryptoapi: 0 1 0 0 0 0\
applecoremedia: 0 1 0 0 0 0\
microsoft_ncsi: 0 1 0 0 0 0\
apple_maps: 0 16 0 0 0 0\
google_ads: 0 0 0 2 0 0\
scorecard_research: 0 0 0 2 0 0\
rubicon_project: 0 0 0 2 0 0\
google_play: 0 0 0 2 0 0\
skype_for_business: 0 0 0 4 0 0\
casale: 0 0 0 7 0 0\
criteo: 0 0 0 2 0 0\
optimizely: 0 0 0 1 0 0\
smart_adserver: 0 0 0 4 0 0\
contextweb: 0 0 0 1 0 0\
mixpanel: 0 0 0 3 0 0\
xbox_live_sites: 0 0 0 4 0 0\
hbo: 0 0 0 4 0 0\
lijit: 0 0 0 5 0 0\
apple_music: 0 0 0 1 0 0\
mathworks: 0 0 0 1 0 0\
new_relic: 0 0 0 1 0 0\
ea_games: 0 0 0 3 0 0\
opendns: 0 0 0 1 0 0\
samsung_push_notification: 0 1 0 0 0 0\
exchange_online: 0 0 0 24 0 0\
office_365: 0 0 0 7 0 0\
sharepoint_online: 0 0 0 16 0 0\
microsoft_windows_live_se: 0 0 0 2 0 0\
epmap: 0 4 0 0 0 0\
microsoft_global_catalog: 12 0 0 0 0 0\
technical_analysis_softwa: 1 0 0 0 0 0\
icmp: 87 0 0 0 69 0\
icmp_for_ipv6: 1 0 0 0 0 0\
onedrive: 0 0 0 1 0 0\
playstation_games: 0 0 0 15 0 0\
conviva: 0 0 0 1 0 0\
malwarebytes: 0 0 0 537 0 0\
quic: 17 0 0 0 0 0\
slack: 0 0 0 1 0 0\
office_mobile: 0 0 0 6 0 0\
tiktok: 0 0 0 4 0 0\
bilibili: 0 0 0 1 0 0\
venmo: 0 0 0 1 0 0\
zoom: 0 1 0 0 0 0\
azure_cloud_portal: 0 0 0 1 0 0\
font_awesome: 0 0 0 1 0 0\
grammarly: 0 0 0 2 0 0\
honey: 0 0 0 1 0 0\
tidal: 0 0 0 1 0 0\
microsoft_teams: 0 0 0 3 0 0\
disney_plus: 0 0 0 6 0 0\
apple_news: 0 0 0 5 0 0\
dns_over_https: 1 0 0 6 0 0\
smbv2: 0 0 0 6 0 0\
discord: 0 0 0 1 0 0\
unknown: 3097 0 0 585 0 0\
--------------------------------------------------\
File Statistics\
--------------------------------------------------\
file type stats (files)\
Type Download Upload\
PNG( 69) 2 0\
REG(307) 4 0\
Total 6 0\
--------------------------------------------------\
file type stats (bytes)\
Type Download Upload\
PNG( 69) 0 0\
REG(307) 0 0\
Total 0 0\
--------------------------------------------------\
Summary Statistics\
--------------------------------------------------\
timing\
runtime: 00:00:02\
seconds: 2.988359\
pkts/sec: 49316\
Mbits/sec: 377\
o")~ Snort exiting\
[root@localhost mheard]# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -r /home/mheard/np1-Unmatched_traffic.pcap -l /var/log/snort --plugin-path /usr/local/snort/extra -k none -m 0x1b\
--------------------------------------------------\
o")~ Snort++ 3.1.23.0\
--------------------------------------------------\
Loading /usr/local/snort/etc/snort/snort.lua:\
Loading snort_defaults.lua:\
Finished snort_defaults.lua:\
Loading file_magic.lua:\
Finished file_magic.lua:\
ssh\
hosts\
host_cache\
pop\
so_proxy\
stream_tcp\
smtp\
gtp_inspect\
packets\
dce_http_proxy\
daq\
stream_icmp\
normalizer\
alert_json\
alert_fast\
ips\
binder\
wizard\
appid\
stream_udp\
file_id\
http2_inspect\
search_engine\
http_inspect\
ftp_data\
ftp_server\
port_scan\
dce_http_server\
dce_smb\
dce_tcp\
telnet\
ssl\
sip\
rpc_decode\
netflow\
iec104\
modbus\
host_tracker\
stream_user\
stream_ip\
back_orifice\
classifications\
dnp3\
active\
trace\
ftp_client\
alerts\
decode\
stream\
process\
references\
arp_spoof\
output\
network\
dns\
dce_udp\
imap\
file_policy\
stream_file\
Finished /usr/local/snort/etc/snort/snort.lua:\
Loading ips.rules:\
Loading ../../rules/snort.rules:\
Finished ../../rules/snort.rules:\
Finished ips.rules:\
--------------------------------------------------\
rule counts\
total rules loaded: 17515\
text rules: 17515\
option chains: 17515\
chain headers: 515\
--------------------------------------------------\
port rule counts\
tcp udp icmp ip\
any 318 26 11 5\
src 6383 32 0 0\
dst 10462 293 0 0\
both 2 6 0 0\
total 17165 357 11 5\
--------------------------------------------------\
ips policies rule stats\
id loaded shared enabled file\
0 17515 0 17515 /usr/local/snort/etc/snort/snort.lua\
--------------------------------------------------\
flowbits\
defined: 152\
not checked: 7\
--------------------------------------------------\
service rule counts to-srv to-cli\
dcerpc: 58 7\
dhcp: 6 2\
dns: 135 21\
drda: 2 0\
file: 2 2\
ftp: 23 5\
ftp-data: 50 5430\
http: 4721 6124\
http2: 4721 6124\
ident: 1 0\
imap: 51 5550\
irc: 3 1\
ircd: 0 1\
java_rmi: 18 1\
kerberos: 7 0\
ldap: 11 3\
mysql: 12 2\
netbios-dgm: 5 5\
netbios-ns: 3 1\
netbios-ssn: 180 43\
netware: 2 0\
ntp: 15 3\
openvpn: 16 16\
pop3: 36 5549\
postgresql: 1 0\
printer: 2 0\
radius: 2 2\
rdp: 6 15\
rtmp: 1 4\
rtsp: 4 0\
sip: 6 1\
smtp: 4944 16\
snmp: 8 1\
ssdp: 11 0\
ssh: 1 2\
ssl: 52 58\
sunrpc: 18 0\
telnet: 20 2\
tftp: 2 0\
vnc: 1 0\
vnc-server: 1 1\
wins: 2 0\
total: 15160 28992\
--------------------------------------------------\
fast pattern port groups src dst any\
packet: 47 292 4\
--------------------------------------------------\
fast pattern service groups to-srv to-cli\
packet: 40 28\
key: 6 0\
header: 7 6\
body: 2 0\
file: 9 8\
raw_key: 2 0\
method: 2 0\
--------------------------------------------------\
search engine\
instances: 453\
patterns: 47061\
pattern chars: 1147866\
num states: 891354\
num match states: 113144\
memory scale: MB\
total memory: 25.9012\
pattern memory: 2.88949\
match list memory: 12.3289\
transition memory: 10.6275\
--------------------------------------------------\
pcap DAQ configured to read-file.\
Commencing packet processing\
++ [0] /home/mheard/np1-Unmatched_traffic.pcap\
-- [0] /home/mheard/np1-Unmatched_traffic.pcap\
--------------------------------------------------\
Packet Statistics\
--------------------------------------------------\
daq\
pcaps: 1\
received: 98632\
analyzed: 98632\
allow: 95720\
whitelist: 2912\
rx_bytes: 99068358\
expected_flows: 27\
--------------------------------------------------\
codec\
total: 98632 (100.000%)\
arp: 79 ( 0.080%)\
eth: 98632 (100.000%)\
icmp4: 153 ( 0.155%)\
icmp4_ip: 43 ( 0.044%)\
icmp6: 18 ( 0.018%)\
ipv4: 98436 ( 99.801%)\
ipv6: 18 ( 0.018%)\
llc: 117 ( 0.119%)\
tcp: 79224 ( 80.323%)\
teredo: 18 ( 0.018%)\
udp: 19059 ( 19.323%)\
vlan: 97445 ( 98.797%)\
--------------------------------------------------\
Module Statistics\
--------------------------------------------------\
appid\
packets: 98436\
processed_packets: 98266\
ignored_packets: 170\
total_sessions: 6139\
service_cache_adds: 990\
--------------------------------------------------\
arp_spoof\
packets: 79\
--------------------------------------------------\
back_orifice\
packets: 19007\
--------------------------------------------------\
binder\
raw_packets: 366\
new_flows: 6115\
service_changes: 1957\
inspects: 6481\
--------------------------------------------------\
dce_smb\
pdus: 8\
sessions: 14\
packets: 12\
max_outstanding_requests: 1\
v2_setup: 12\
v2_tree_cnct: 12\
v2_crt: 136\
v2_read: 52\
v2_cls: 51\
v2_cls_req_ftrkr_misng: 13\
v2_msgs_uninspected: 340\
v2_session_ignored: 1\
max_concurrent_sessions: 14\
total_smb1_sessions: 6\
total_smb2_sessions: 8\
total_mc_sessions: 6\
--------------------------------------------------\
dce_tcp\
pdus: 24\
binds: 8\
bind_acks: 8\
requests: 8\
tcp_sessions: 8\
tcp_packets: 24\
max_concurrent_sessions: 8\
--------------------------------------------------\
detection\
analyzed: 98632\
raw_searches: 162939\
cooked_searches: 36660\
pkt_searches: 199599\
key_searches: 303\
header_searches: 602\
body_searches: 92\
file_searches: 302\
raw_key_searches: 303\
method_searches: 303\
--------------------------------------------------\
dns\
packets: 1222\
requests: 639\
responses: 281\
max_concurrent_sessions: 9\
--------------------------------------------------\
file_id\
total_files: 251\
total_file_data: 65215\
max_concurrent_files: 4\
--------------------------------------------------\
http_inspect\
flows: 134\
scans: 1377\
reassembles: 1376\
inspections: 1007\
requests: 211\
responses: 167\
get_requests: 117\
head_requests: 1\
post_requests: 92\
connect_requests: 1\
request_bodies: 92\
chunked: 1\
uri_normalizations: 34\
uri_coding: 8\
max_concurrent_sessions: 132\
connect_tunnel_cutovers: 1\
total_bytes: 637751\
--------------------------------------------------\
normalizer\
test_tcp_trim_win: 38510\
test_tcp_ts_nop: 876\
test_tcp_ips_data: 20\
test_tcp_block: 79\
--------------------------------------------------\
pcre\
pcre_rules: 3956\
pcre_native: 3956\
--------------------------------------------------\
port_scan\
packets: 98436\
trackers: 3832\
--------------------------------------------------\
search_engine\
max_queued: 641\
total_flushed: 88655\
total_inserts: 165043\
total_unique: 88655\
non_qualified_events: 88608\
qualified_events: 47\
searched_bytes: 230769116\
--------------------------------------------------\
ssh\
packets: 13\
total_bytes: 2242\
max_concurrent_sessions: 3\
--------------------------------------------------\
ssl\
packets: 10565\
decoded: 10565\
client_hello: 1787\
server_hello: 1704\
certificate: 879\
server_done: 1863\
client_key_exchange: 345\
server_key_exchange: 364\
change_cipher: 2196\
client_application: 2617\
server_application: 2706\
alert: 34\
unrecognized_records: 872\
handshakes_completed: 395\
sessions_ignored: 395\
detection_disabled: 21\
max_concurrent_sessions: 1764\
--------------------------------------------------\
stream\
flows: 6115\
expected_flows: 30\
--------------------------------------------------\
stream_icmp\
sessions: 88\
max: 88\
created: 88\
released: 88\
--------------------------------------------------\
stream_tcp\
sessions: 3959\
max: 3959\
created: 3959\
released: 3959\
instantiated: 3899\
setups: 3959\
restarts: 1956\
discards_skipped: 79\
invalid_seq_num: 38444\
invalid_ack: 5\
events: 79\
syn_trackers: 2429\
syn_ack_trackers: 23\
data_trackers: 1507\
segs_queued: 30433\
segs_released: 30433\
segs_used: 19116\
rebuilt_packets: 13314\
rebuilt_bytes: 13702066\
overlaps: 20\
gaps: 13\
payload_fully_trimmed: 11\
client_cleanups: 280\
server_cleanups: 508\
established: 67\
syns: 3176\
syn_acks: 2214\
resets: 692\
fins: 1257\
inspector_fallbacks: 10\
partial_fallbacks: 76\
max_segs: 835\
max_bytes: 1137129\
--------------------------------------------------\
stream_udp\
sessions: 2068\
max: 2068\
created: 2068\
released: 2068\
total_bytes: 14871217\
--------------------------------------------------\
wizard\
tcp_scans: 3640\
tcp_hits: 1956\
tcp_misses: 34\
udp_scans: 1452\
udp_misses: 1452\
--------------------------------------------------\
Appid Statistics\
--------------------------------------------------\
detected apps and services\
Application: Services Clients Users Payloads Misc Referred\
amazon: 0 0 0 2 0 0\
apple_update: 0 0 0 3 0 0\
bing: 0 0 0 1 0 0\
bits: 0 1 0 0 0 0\
dropbox: 0 0 0 1 0 0\
google: 0 0 0 24 0 0\
mcafee: 0 0 0 3 0 0\
msn: 0 0 0 7 0 0\
syslog: 1 1 0 0 0 0\
tacacs+: 23 0 0 0 0 0\
yahoo!: 0 0 0 7 0 0\
adobe_software: 0 0 0 1 0 0\
android_browser: 0 5 0 0 0 0\
apple_mail: 0 0 0 2 0 0\
chrome: 0 7 0 0 0 0\
dce/rpc: 4 0 0 0 0 0\
dhcp: 18 0 0 0 0 0\
dns: 276 312 0 0 0 0\
facebook: 0 1 0 34 0 0\
firefox: 0 5 0 0 0 0\
gmail: 0 0 0 229 0 0\
google_analytics: 0 0 0 5 0 0\
http: 134 0 0 0 0 0\
hulu: 0 0 0 2 0 0\
itunes: 0 0 0 15 0 0\
kerberos: 7 6 0 0 0 0\
ldap: 7 0 2 0 0 0\
netbios-ns: 2 2 0 0 0 0\
netbios-ssn_(smb): 6 0 0 0 0 0\
netflix: 0 0 0 7 0 0\
ntp: 16 0 0 0 0 0\
oracle_database: 0 5 5 0 0 0\
tns/oracle: 10 0 0 0 0 0\
radius: 1 0 0 0 0 0\
radius-acct: 3 0 0 0 0 0\
safari: 0 1 0 0 0 0\
schuelervz: 0 0 0 1 0 0\
skype: 0 0 0 4 0 0\
snmp: 13 0 0 0 0 0\
ssh: 1 1 0 0 0 0\
ssl: 60 0 0 0 0 0\
stun: 7 0 0 0 0 0\
twitter: 0 0 0 1 0 0\
youtube: 0 0 0 7 0 0\
cisco_secure_endpoint: 0 1 0 0 0 0\
netflix_stream: 0 0 0 16 0 0\
twitchtv: 0 0 0 8 0 0\
steam: 0 0 0 1 0 0\
realaudio: 0 1 0 0 0 0\
smtps: 2 0 0 0 0 0\
imaps: 229 0 0 0 0 0\
https: 1468 0 0 0 0 0\
zabbix: 6 0 0 0 0 0\
spotify: 0 0 0 3 0 0\
apns: 0 0 0 3 0 0\
apple_sites: 0 0 0 98 0 0\
icloud: 0 0 0 52 0 0\
instagram: 0 5 0 0 0 0\
mozilla: 0 0 0 1 0 0\
avast: 0 0 0 1 0 0\
opera: 0 1 0 0 0 0\
ssl_client: 0 1314 0 0 0 0\
twitter_link_service: 0 0 0 1 0 0\
advertising.com: 0 0 0 1 0 0\
doubleclick: 0 0 0 11 0 0\
ad_nexus: 0 0 0 8 0 0\
pubmatic: 0 0 0 3 0 0\
cloudfront: 0 0 0 5 0 0\
apple_stocks: 0 2 0 0 0 0\
microsoft: 0 0 0 42 0 0\
google_adsense: 0 0 0 1 0 0\
imrworldwide: 0 0 0 1 0 0\
siri: 0 0 0 5 0 0\
akamai: 0 0 0 1 0 0\
line: 0 1 0 0 0 0\
java: 0 1 0 0 0 0\
doubleverify: 0 0 0 7 0 0\
minecraft: 0 0 0 1 0 0\
amazon_ads_system: 0 0 0 3 0 0\
nhl.com: 0 0 0 1 0 0\
roku: 0 0 0 1 0 0\
starbucks: 0 1 0 0 0 0\
yahoo!_calendar: 0 0 0 1 0 0\
microsoft_cryptoapi: 0 1 0 0 0 0\
applecoremedia: 0 1 0 0 0 0\
microsoft_ncsi: 0 1 0 0 0 0\
apple_maps: 0 16 0 0 0 0\
google_ads: 0 0 0 2 0 0\
scorecard_research: 0 0 0 2 0 0\
rubicon_project: 0 0 0 2 0 0\
google_play: 0 0 0 2 0 0\
skype_for_business: 0 0 0 4 0 0\
casale: 0 0 0 7 0 0\
criteo: 0 0 0 2 0 0\
optimizely: 0 0 0 1 0 0\
smart_adserver: 0 0 0 4 0 0\
contextweb: 0 0 0 1 0 0\
mixpanel: 0 0 0 3 0 0\
xbox_live_sites: 0 0 0 4 0 0\
hbo: 0 0 0 4 0 0\
lijit: 0 0 0 5 0 0\
apple_music: 0 0 0 1 0 0\
mathworks: 0 0 0 1 0 0\
new_relic: 0 0 0 1 0 0\
ea_games: 0 0 0 3 0 0\
opendns: 0 0 0 1 0 0\
samsung_push_notification: 0 1 0 0 0 0\
exchange_online: 0 0 0 24 0 0\
office_365: 0 0 0 7 0 0\
sharepoint_online: 0 0 0 16 0 0\
microsoft_windows_live_se: 0 0 0 2 0 0\
epmap: 0 4 0 0 0 0\
microsoft_global_catalog: 12 0 0 0 0 0\
technical_analysis_softwa: 1 0 0 0 0 0\
icmp: 87 0 0 0 69 0\
icmp_for_ipv6: 1 0 0 0 0 0\
onedrive: 0 0 0 1 0 0\
playstation_games: 0 0 0 15 0 0\
conviva: 0 0 0 1 0 0\
malwarebytes: 0 0 0 537 0 0\
quic: 17 0 0 0 0 0\
slack: 0 0 0 1 0 0\
office_mobile: 0 0 0 6 0 0\
tiktok: 0 0 0 4 0 0\
bilibili: 0 0 0 1 0 0\
venmo: 0 0 0 1 0 0\
zoom: 0 1 0 0 0 0\
azure_cloud_portal: 0 0 0 1 0 0\
font_awesome: 0 0 0 1 0 0\
grammarly: 0 0 0 2 0 0\
honey: 0 0 0 1 0 0\
tidal: 0 0 0 1 0 0\
microsoft_teams: 0 0 0 3 0 0\
disney_plus: 0 0 0 6 0 0\
apple_news: 0 0 0 5 0 0\
dns_over_https: 1 0 0 6 0 0\
smbv2: 0 0 0 6 0 0\
discord: 0 0 0 1 0 0\
unknown: 3097 0 0 585 0 0\
--------------------------------------------------\
File Statistics\
--------------------------------------------------\
file type stats (files)\
Type Download Upload\
PNG( 69) 2 0\
REG(307) 4 0\
Total 6 0\
--------------------------------------------------\
file type stats (bytes)\
Type Download Upload\
PNG( 69) 0 0\
REG(307) 0 0\
Total 0 0\
--------------------------------------------------\
Summary Statistics\
--------------------------------------------------\
timing\
runtime: 00:00:02\
seconds: 2.925791\
pkts/sec: 49316\
Mbits/sec: 377\
o")~ Snort exiting}