[Snort-users] DNS on Log Messsages?

Erek Adams erek at ...950...
Tue Jan 14 06:23:03 EST 2003

On Tue, 14 Jan 2003, Mike Koponick wrote:

> I was wondering if there was a way to resolve IP addresses into names from
> the SNORT.LOG file. That is, this is the log that SNORT outputs now:
> 01/13-18:39:12.868701 [**] [1:384:4] ICMP PING [**] [Classification: Misc
> activity] [Priority: 3] {ICMP} ->
> I would like log to look something like:
> 01/13-18:39:12.868701 [**] [1:384:4] ICMP PING [**] [Classification: Misc
> activity] [Priority: 3] {ICMP} (MYPC.MYDOMAIN.COM)->

Snort can't do that.  DNS resolution is something that takes _time_.  If
you have to lookup 500 IP's, and there's a 50ms wait for each one...  That
starts to mount up rather quickly.  Snort needs all it's time and power to
snarf packets.

You could use a sed/awk script and post process the logs.  That would be
a bit better as you're not making the Snort process do all the work.  If
you could, I would even suggest doing that off of your sensor.  Do it on a
backend box with a local caching DNS server.


Erek Adams

   "When things get weird, the wierd turn pro."   H.S. Thompson

More information about the Snort-users mailing list