[Snort-users] Snort dont understand pf (openbsd) format

Sean Brown sblinux at ...9344...
Mon Nov 29 17:54:02 EST 2004

On November 29, 2004 5:06 pm, Matt Kettler wrote:
> At 06:27 PM 11/29/2004, Matt Kettler wrote:
> > >     What is wrong with that? Does snort understand the pf log format?
> >
> >No, snort doesn't understand any textual log formats at all, including pf.
> Self correction.. pflogd generates tcpdump binary files. So, theoretically,
> it should work with snort -r.
> My mistake entirely.
> However, looking around, pflogd files aren't exactly tcpdump files.. they
> have (or at least had) a "pftcpdump" to read them in freebsd:
> http://lists.freebsd.org/pipermail/freebsd-current/2004-August/035814.html
> http://lists.sans.org/pipermail/list/2004-November/062633.html
> It's unclear if OpenBSD generates real tcpdump files that any ordinary
> tcpdump can read, or if they patched tcpdump to support them.
It doesn't, it is a modified format that the tcpdump in OpenBSD was patched to 
read. However, in the FAQ:

4.4 Does snort see packets filtered by IPTables/IPChains/IPF/PF?
Under OpenBSD you can snort just the PF rejects by using the /dev/pflogN

Since pflogd simply writes the traffic from pflog, snort should be able to 
understand the log file, but I have tried to have it read the file and 
attached it to /dev/pflog0 and it does not understand the traffic. Perhaps 
the output format changed in one of the recent OpenBSD releases and Snort was 
never updated. If so, the FAQ needs to be fixed.

More information about the Snort-users mailing list