Re: Duration/Protocol/Service/Source/flags/Bytes/Dest etc.. bytes needed

Hello!

Snort provides some details about the packet in case of matching the rule.

In a fact, once the rule matched, information about the packet will be printed (be default to stdout, but it depends on the configuration).
Example of ‘-A cvs’ (or ‘alert_csv’) output: 7, TCP, stream_tcp, 0, C2S, 1.1.1.1:80, 1.1.1.2:8000, 1:1:0, allow

Which is 'timestamp pkt_num proto pkt_gen pkt_len dir src_ap dst_ap rule action' by default.

You should use the following command to get more information about possible configuration of the ‘csv’ logger: <path_to_snort_binary> --help-module alert_csv

‘csv’ logger provides not exactly what you’ve mentioned but it can help as well.


Beside it, you can check log_codecs, it’s providing some additional information about the packet.
Example of log_codecs output:
pkt:1          gid:1    sid:1    rev:0
eth(DLT):  01:01:01:01:01:01 -> 01:01:01:01:01:02  type:0x0800
ipv4(0x0800):  1.1.1.1 -> 1.1.1.2
                Next:0x06 TTL:64 TOS:0x0 ID:1 IpLen:20 DgmLen:40
tcp(0x06):  ******S*  SrcPort:50001  DstPort:8
                Seq: 0x1  Ack: 0x0  Win: 0x2000  TcpLen: 20

The get a full list of similar loggers, use the following command: <path_to_snort_binary> --help-modules | grep logger

Just a note: those loggers work only once a rule is matched, so in order to use them, you’ll need to add some specific rules.

Thanks, Yehor.

From: Snort-users <[email protected]> on behalf of Hari Kishore via Snort-users <[email protected]>
Date: Thursday, 16 February 2023, 22:31
To: [email protected] <[email protected]>
Subject: [Snort-users] Duration/Protocol/Service/Source/flags/Bytes/Dest etc.. bytes needed

CAUTION: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.
Hi , I'd like to use snort to log the following information on a connection basis: /duration/protocol/service/src/flags/bytes/dest etc... bytes and possibly time stamp So I could create a data file similar to the data set kddcup99 which contains the following fields .. So is it possible to get all these information in logs using snort?? Is is possible ? if yes then how ?

duration
1
number (default)
protocol_type
2
string (default)
service
3
string (default)
flag
4
string (default)
src_bytes
5
number (default)
dst_bytes
6
any (default)
land
7
number (default)
wrong_fragment
8
number (default)
urgent
9
number (default)
hot
10
number (default)
num_failed_logins
11
number (default)
logged_in
12
number (default)
lnum_compromised
13
number (default)
lroot_shell
14
number (default)
lsu_attempted
15
number (default)
lnum_root
16
number (default)
lnum_file_creations
17
number (default)
lnum_shells
18
number (default)
lnum_access_files
19
number (default)
lnum_outbound_cmds
20
number (default)
is_host_login
21
number (default)
is_guest_login
22
number (default)
count
23
number (default)
srv_count
24
number (default)
serror_rate
25
number (default)
srv_serror_rate
26
number (default)
rerror_rate
27
number (default)
srv_rerror_rate
28
number (default)
same_srv_rate
29
number (default)
diff_srv_rate
30
number (default)
srv_diff_host_rate
31
number (default)
dst_host_count
32
number (default)
dst_host_srv_count
33
number (default)
dst_host_same_srv_rate
34
number (default)
dst_host_diff_srv_rate
35
number (default)
dst_host_same_src_port_rate
36
number (default)
dst_host_srv_diff_host_rate
37
number (default)
dst_host_serror_rate
38
number (default)
dst_host_srv_serror_rate
39
number (default)
dst_host_rerror_rate
40
number (default)
dst_host_srv_rerror_rate
41
number (default)
label
42
string (default)
Thankyou,
Hari

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette