[Snort-users] Snort DB Logging Problem

Bill Gercken bgercken at ...12278...
Mon Aug 16 07:50:05 EDT 2004


Hi,
I am trying to use snort to load some of the SANS
libpcap files into an acid database using snort and
the database output plugin. My configuration file
is as follows:

# conf file to log to the database.
#
output database: log, mysql, user=suser password=pass \ dbname=snort 
host=localhost detail=full sensor_name=blah

log tcp any any <> any any (msg:"tcp any";)
log udp any any <> any any (msg:"udp any";)
log icmp any any <> any any (msg:"icmp any";)

from the command line i use:

snort -c db-log.conf -r 2003.12.15.1


When I run the command against a big-endian file it process
the data fine and provides the following output:

<snip>
Snort processed 36562 packets.
=========================================================
Breakdown by protocol:
     TCP: 32906      (90.001%)
     UDP: 141        (0.386%)
    ICMP: 2587       (7.076%)
     ARP: 118        (0.323%)
   EAPOL: 0          (0.000%)
    IPv6: 0          (0.000%)
     IPX: 0          (0.000%)
   OTHER: 730        (1.997%)
DISCARD: 80         (0.219%)
=========================================================
Action Stats:
ALERTS: 80
LOGGED: 33729
PASSED: 0
</snip>

file command output:
2003.12.15.1: tcpdump capture file (big-endian) - version 2.4 
(Ethernet, capture length 96)


but when I run against any of the SANS little-endian files, nothing is 
logged:

snort -c db-log.conf -r 2002.9.9

output:
Snort processed 1051 packets.
=========================================================
Breakdown by protocol:
     TCP: 1051       (100.000%)
     UDP: 0          (0.000%)
    ICMP: 0          (0.000%)
     ARP: 0          (0.000%)
   EAPOL: 0          (0.000%)
    IPv6: 0          (0.000%)
     IPX: 0          (0.000%)
   OTHER: 0          (0.000%)
DISCARD: 0          (0.000%)
=========================================================
Action Stats:
ALERTS: 0
LOGGED: 0
PASSED: 0

file command output:

2002.9.9: tcpdump capture file (little-endian) - version 2.4 (Ethernet, 
capture length 1514)

I can load little-endian files that I have captured locally, so
it appears to be isolated to the SANS files.

I have tried this with snort 2.3 and snort 2.20.
Has any one seen this problem. Am I missing something?

Thanks and Regards,
-bill





More information about the Snort-users mailing list