[Snort-users] Re: converting hex data to ascii

Jed Pickel jed at ...1826...
Fri Apr 13 20:40:29 EDT 2001


On Fri, Apr 13, 2001 at 02:27:56PM -0500, jaba_cha at ...1823... wrote:
> I was wondering if someone could help me with the
> command to convert hex logs to ascii for snort?
>
> I seem to be having problems getting this to
> work. The log I am trying to convert is...
> "snortxml-0410 at ...1824..."

You can actually log in ascii directly if you add "encoding=ascii" to the
configuration line for the xml plugin.

I don't know of any public/finished tools that parse this xml yet.

If you just need a quick and dirty fix to read the hex try something like this.

$ cat snortxml-0410 at ...1824... | perl -e 'while(<>){foreach $m ($_ =~ /[0-9a-fA-F]{2}/g) { print chr(hex($m));} print "\n";}'

* Jed




More information about the Snort-users mailing list