Re: Does snortsnarf work?

On Thu, 2003-02-13 at 11:54, Ed Davison wrote:
> 
> I do not know how much difference it will make or even what version
> of the SnortDBInput.pm code you are running but I have made some changes
> that I have been meaning to post to James Hoagland for inclusion in the
> newer versions of the code.  I am going to attach it here and make sure
> that it is on my website so that it is now publicly available.  Work has
> been done to switch it to a more compatible DBI codebase and there has
> been some speedup code added.  The speed of the queries is a big deal
> but have never seen NO output from the code.  I will see what I can do
> to help with this as well.

Thanks, Ed.  Is this new code compatible with the version of snortsnarf
I'm using?

SnortSnarf version v021017.1

My SnortDBInput.pm file doesn't have a version number, but it states,
"it has been tested with mysql 3.22 and 3.23".  I'm running mysql
3.23.55 from the FreeBSD ports collection.  Snortsnarf was installed
from ports as well.

I just read man (3) Time::ParseDate and configured this commandline:

/usr/local/bin/snortsnarf -d /usr/local/www/snortsnarf/ -homenet
x.x.x.x/16 -maxtime=03/02/13:11:00 snort:xxxxxx@snort@localhost
(IP range and password obfuscated)

and I got this result:

Use of uninitialized value at
/usr/local/libdata/snortsnarf//SnortSnarf/TimeFilters.pm line 39.
03/02/13:11:00 =>
invalid time specification for -mintime: 03/02/13:11:00; ignoring
-mintime

I got the same error whether the maxtime field was quoted or unquoted. 
Why would it be ignoring mintime when I used maxtime?

I'm getting this error with a number of valid time formats, such as
dd/mm/yyyy, now-count, etc.

-- 
Paul Schmehl ([email protected])
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/~pauls/
AVIEN Founding Member