Something wrong with the DB plugin?

Paul Schmehl <[email protected]> 14 Feb 2003 16:56:07 -0600
Newsgroups gmane.comp.security.ids.snort.snarf
Organization The University of Texas at Dallas
Message-ID <1045263366.16205.202.camel@utd49554>
In my neverending quest to get some output from snortsnarf I did the
following:
ran it like this:

snortsnarf -d /usr/local/www/snortsnarf/ -homenet x.x.x.x/16
-maxtime=now /var/log/snort/portscan.log
now => 1045262447

This produced a report in record time!  Odd thing is, I used "now" for
maxtime, which *should* have been current time, yet the report covered a
four hour period.  Our offset from UTC is -6, so it can't be that.  The
box is running ntp, and I just checked and time is correct.  WTF???

This morning I ran this:

snortsnarf -d /usr/local/www/snortsnarf/ -homenet x.x.x.x/16
-maxtime=10:00:00 snort:xxxxxx@snort@localhost:3306

But I got a boatload of these errors:
Use of uninitialized value at
/usr/local/libdata/snortsnarf//SnortSnarf/MemTimeBase.pm line 69.

And I killed the process after it had been running for 2 hours and 45
minutes!

Looks to me like a problem with the parsing of the time values, but I'm
not a programmer, so I could be way off base.

Line 69 of MemTime.pm is the return statement of this function (if this
helps):

sub time_cmp {
    return $_[0]->utime() <=> $_[1]->utime();
}

Anyway, I now know snortsnarf actually works on flat files.  :-)  Just
don't know why it doesn't work on the db.

Ideas?  Suggestions?

-- 
Paul Schmehl ([email protected])
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/~pauls/
AVIEN Founding Member