Something wrong with the DB plugin?
Paul Schmehl <[email protected]> 14 Feb 2003 16:56:07 -0600
| Newsgroups | gmane.comp.security.ids.snort.snarf |
|---|---|
| Organization | The University of Texas at Dallas |
| Message-ID | <1045263366.16205.202.camel@utd49554> |
In my neverending quest to get some output from snortsnarf I did the
following:
ran it like this:
snortsnarf -d /usr/local/www/snortsnarf/ -homenet x.x.x.x/16
-maxtime=now /var/log/snort/portscan.log
now => 1045262447
This produced a report in record time! Odd thing is, I used "now" for
maxtime, which *should* have been current time, yet the report covered a
four hour period. Our offset from UTC is -6, so it can't be that. The
box is running ntp, and I just checked and time is correct. WTF???
This morning I ran this:
snortsnarf -d /usr/local/www/snortsnarf/ -homenet x.x.x.x/16
-maxtime=10:00:00 snort:xxxxxx@snort@localhost:3306
But I got a boatload of these errors:
Use of uninitialized value at
/usr/local/libdata/snortsnarf//SnortSnarf/MemTimeBase.pm line 69.
And I killed the process after it had been running for 2 hours and 45
minutes!
Looks to me like a problem with the parsing of the time values, but I'm
not a programmer, so I could be way off base.
Line 69 of MemTime.pm is the return statement of this function (if this
helps):
sub time_cmp {
return $_[0]->utime() <=> $_[1]->utime();
}
Anyway, I now know snortsnarf actually works on flat files. :-) Just
don't know why it doesn't work on the db.
Ideas? Suggestions?
--
Paul Schmehl ([email protected])
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/~pauls/
AVIEN Founding Member