[Snort-users] Snort dont understand pf (openbsd) format
mkettler at ...4108...
Mon Nov 29 19:18:00 EST 2004
At 08:52 PM 11/29/2004, Sean Brown wrote:
> > It's unclear if OpenBSD generates real tcpdump files that any ordinary
> > tcpdump can read, or if they patched tcpdump to support them.
>It doesn't, it is a modified format that the tcpdump in OpenBSD was
>read. However, in the FAQ:
>4.4 Does snort see packets filtered by IPTables/IPChains/IPF/PF?
>Under OpenBSD you can snort just the PF rejects by using the /dev/pflogN
>Since pflogd simply writes the traffic from pflog, snort should be able to
>understand the log file, but I have tried to have it read the file and
>attached it to /dev/pflog0 and it does not understand the traffic. Perhaps
>the output format changed in one of the recent OpenBSD releases and Snort was
>never updated. If so, the FAQ needs to be fixed.
Since so many people are responding off list, I'll take a chance to respond
Summary - snort does support PF format log files via -r and pflog devices
However, it only supports said format on a system which has a
libpcap/tcpdump version that is PF aware. If bpf.h doesn't define the PF
datalink type, snort will not handle pf files or devices and will generate
errors if fed them.
The PF log format is an extension of the list of data link formats
available to pcap, and has been merged to the main tree. The PF "data link"
adds a header that defines things like what happened to the packet and what
ruleset is responsible.
Newer releases of libpcap and tcpdump include support for this format,
older ones don't.
The Breno is running snort on a Linux box, and is trying to parse files
gathered from an OpenBSD box. It appears that some Linux distros include
the newer releases, others don't. It appears that Breno's Linux box has a
non-pf-aware version of libpcap/tcpdump. Since snort can't find the defines
it needs when built on such a system, PF support disappears. Running pf
files in generates an unknown data link type error as a result.
As an aside, the FAQ entry is semi-irrelevant to this thread. That faq is
about using snort to listen pflog DEVICES using snort -i /dev/pflog0, not
parse pflog FILES via snort -r /var/log/pflog. Two totally different things.
More information about the Snort-users