[Snort-users] Snort DB query question.
Kreimendahl, Chad J
Chad.Kreimendahl at ...4716...
Thu Oct 24 21:44:01 EDT 2002
To easily select on it, you could also convert the upper and lower
limits of that block into INT and do it that way. There are tools out
there for most languages that will take IPs and return INTS. This
should also allow for cross-functionality to DBs that don't have
inet_ntoa/aton type functions (Oracle, postgres...)
From: Michael Boman [mailto:michael at ...3137...]
Sent: Thursday, October 24, 2002 9:50 PM
To: larosa, vjay
Cc: 'snort-users at lists.sourceforge.net'
Subject: Re: [Snort-users] Snort DB query question.
On Thu, Oct 24, 2002 at 10:22:57PM -0400, larosa, vjay wrote:
> I have a question that has been bugging me since I started using the
> database output plugin
> with snort. Why are the IP addresses stored in the DB in the 32 bit
> What is the advantage?
I would guess it's speed - it stores the IP addresess in the same format
they are recived from the wire. Doing additional processing would slow
snort down, and when you analyze the data you won't notice the 1/100
sec delay, but snort would.
> I know there must be something I don't know. I know the SELECT
> inet_ntoa(ip_src) ...... trick to convert
> the IP's back to human readable format, but what if I want to search
> CDIR block like 10.10.0.0/16?
> How would this be done? Is it possible?
WHERE inet_ntoa(iphdr.ip_src) > "10.10.0.0" AND
inet_ntoa(iphdr.ip_src) < "10.10.255.255"
WHERE iphdr.ip_src > inet_aton("10.10.0.0") AND
iphdr.ip_src < inet_aton("10.10.255.255")
I think the last example is faster, haven't tried it (wrong OS, not at
work and so on...). And I am sure there are short-cuts for it as well,
check out the documentation for your SQL database (which you failed
Student, Husband, Geek. Not necessary in that order though.
This sf.net email is sponsored by: Influence the future
of Java(TM) technology. Join the Java Community
Process(SM) (JCP(SM)) program now.
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
More information about the Snort-users