[Snort-users] Snort DB query question.

larosa, vjay larosa_vjay at ...3331...
Thu Oct 24 19:24:02 EDT 2002


Hello,

I have a question that has been bugging me since I started using the
database output plugin
with snort. Why are the IP addresses stored in the DB in the 32 bit format?
What is the advantage?
I know there must be something I don't know. I know the SELECT
inet_ntoa(ip_src) ...... trick to convert 
the IP's back to human readable format, but what if I want to search for a
CDIR block like 10.10.0.0/16? 
How would this be done? Is it possible?

Thanks!

vjl



V.Jay LaRosa                           EMC Corporation
Information Security                  171 South Street
(508)249-3355 office                  Hopkinton, MA 01748
(508)498-5575 cell                     www.emc.com
(888-799-9750 pager                  larosa_vjay at ...3331...
(508)497-8082 fax





More information about the Snort-users mailing list