[Snort-users] Snort dont understand pf (openbsd) format
sblinux at ...9344...
Mon Nov 29 17:54:02 EST 2004
On November 29, 2004 5:06 pm, Matt Kettler wrote:
> At 06:27 PM 11/29/2004, Matt Kettler wrote:
> > > What is wrong with that? Does snort understand the pf log format?
> >No, snort doesn't understand any textual log formats at all, including pf.
> Self correction.. pflogd generates tcpdump binary files. So, theoretically,
> it should work with snort -r.
> My mistake entirely.
> However, looking around, pflogd files aren't exactly tcpdump files.. they
> have (or at least had) a "pftcpdump" to read them in freebsd:
> It's unclear if OpenBSD generates real tcpdump files that any ordinary
> tcpdump can read, or if they patched tcpdump to support them.
It doesn't, it is a modified format that the tcpdump in OpenBSD was patched to
read. However, in the FAQ:
4.4 Does snort see packets filtered by IPTables/IPChains/IPF/PF?
Under OpenBSD you can snort just the PF rejects by using the /dev/pflogN
Since pflogd simply writes the traffic from pflog, snort should be able to
understand the log file, but I have tried to have it read the file and
attached it to /dev/pflog0 and it does not understand the traffic. Perhaps
the output format changed in one of the recent OpenBSD releases and Snort was
never updated. If so, the FAQ needs to be fixed.
More information about the Snort-users