[Snort-users] This has real potential

Crook, Parker Parker_Crook at ...14786...
Fri Feb 26 16:59:17 EST 2010


Thanks for putting the word out there; I was planning on announcing this over the weekend.  I guess word gets out quick... I was just looking over a large nmap dataset and its resultant XML file and noticed that currently you want to disable DNS resolution during your nmap scan (-n switch).  I should have some revised data up on the site and in the README over the weekend.

I hope everyone enjoys it, and let me know if you have any suggestions or notice any errors,



From: Alex Tatistcheff [mailto:alex.tatistcheff at ...11827...]
Sent: Friday, February 26, 2010 3:37 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] This has real potential

There's a new Perl script on the block and it has HUGE potential to help Snort admins tune their installations.  You're probably aware of the host attribute table feature where you create an .XML file describing the hosts on your network, then feed that into Snort.  The key phrase here is "you create".  In the past this was a very labor intensive process and could prove daunting if you have a large or fairly dynamic network.  Just recently Parker Crook (one sharp individual) has written a script to create this host attribute .XML file from output obtained from the nmap scanner.  The script is new and could use some testing from the community.  However, the concept is sound and the value of automatically creating this file is significant.  It's mentioned in a blog at


The project, which is called Hogger (what a cool name) is available on Google Code at http://code.google.com/p/hogger

Alex Tatistcheff
alext at ...492...<mailto:alext at ...492...>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20100226/7ab66237/attachment.html>

More information about the Snort-users mailing list