[Snort-users] DNS on Log Messsages?

Erek Adams erek at ...950...
Tue Jan 14 06:23:03 EST 2003


On Tue, 14 Jan 2003, Mike Koponick wrote:

> I was wondering if there was a way to resolve IP addresses into names from
> the SNORT.LOG file. That is, this is the log that SNORT outputs now:
>
> 01/13-18:39:12.868701 [**] [1:384:4] ICMP PING [**] [Classification: Misc
> activity] [Priority: 3] {ICMP} 192.168.11.21 -> 192.168.11.2
>
> I would like log to look something like:
>
> 01/13-18:39:12.868701 [**] [1:384:4] ICMP PING [**] [Classification: Misc
> activity] [Priority: 3] {ICMP} 192.168.11.21 (MYPC.MYDOMAIN.COM)->
> 192.168.11.2 (THEREPC.MYDOMAIN.COM)

Snort can't do that.  DNS resolution is something that takes _time_.  If
you have to lookup 500 IP's, and there's a 50ms wait for each one...  That
starts to mount up rather quickly.  Snort needs all it's time and power to
snarf packets.

You could use a sed/awk script and post process the logs.  That would be
a bit better as you're not making the Snort process do all the work.  If
you could, I would even suggest doing that off of your sensor.  Do it on a
backend box with a local caching DNS server.

Cheers!

-----
Erek Adams

   "When things get weird, the wierd turn pro."   H.S. Thompson




More information about the Snort-users mailing list