[Snort-devel] Logging to DB it's done differently than to a file.

Bruno G. San Alejo bgonzalez at ...3012...
Wed Mar 4 09:14:26 EST 2009

Hi, I have found how Snort logs to a file and to the DB and maybe it's
the cause of why I seem to have ICMP redirect packages with the wrong
gateway's IP.

    To make a really long story short, when logging to a file Snort uses
the pcap_dump() function than (if I'm not mistaken) logs the packet as
it gets it from Snort. When logging to the DB, the ICMP packet gets
parsed and the insert is as follows in the Database() func:

ret = SnortSnprintf(query->val, MAX_QUERY_LENGTH,
                                            "INSERT INTO "
                                            "icmphdr (sid, cid,
icmp_type, icmp_code, icmp_csum, icmp_id, icmp_seq) "
                                            "VALUES (%u,%u,%u,%u,%u,%u,%u)",
data->shared->cid, p->icmph->type,

Note the references to p->icmph->s_icmp_seq and p->icmph->s_icmp_id.
Now, ICMP redirect packets don't have those fields, they have the
gateway's IP instead.

    Since the packets are not "decoded" but the actual packet is laid
over the Packet struct which contains unions, those fields have data,
though not valid one. Maybe the IP for the gateway is there.

    The result is that when I see the Snort logged packets in pcap
format, they are correct, but the ones seen through BASE or saved to
pcap through BASE, are not. The ones shown through BASE have wrong
gateway's IPs. Also, BASE gets the gateway's IP from someplace else
which I think is not the IP. So, that is an issue also.

    I'm sorry to be a pain in the neck with this issue but I would like
someone to correct me or maybe there is something to be solved in here.


More information about the Snort-devel mailing list