[Snort-users] Snort and Barnyard2

Y M snort at ...15979...
Wed Feb 6 15:39:05 EST 2013

Yes you are right. The acid_event table gets created if/when using BASE and holds data aggregated for populating the base_query_main.php once requested. I wrote that sample query for simplicity and could mistakenly assumed that BASE is in use.

Thanks for pointing this out.

From: beenph<mailto:beenph at ...11827...>
Sent: ‎2/‎6/‎2013 11:30 PM
To: Y M<mailto:snort at ...15979...>
Cc: Josh Bitto<mailto:jbitto at ...16055...>; snort-users at ...3893...t<mailto:snort-users at lists.sourceforge.net>; barnyard2-users at ...14071...<mailto:barnyard2-users at ...14071...>
Subject: Re: [Snort-users] Snort and Barnyard2

On Wed, Feb 6, 2013 at 2:43 PM, Y M <snort at ...15979...> wrote:
> Sorry for not detailing my reply. For  example try querying snort database
> with:
> SELECT ip_src, INET_NTOA(ip_src)
> FROM acid_event;

IP src/dst data in the default schema is not stored in the acid_event table but
the iphdr table.

So a query could look like this:

Assuming mysql:

SELECT INET_NTOA(ip_src),INET_NTOA(ip_dst) FROM iphdr WHERE sid="XXX"
AND cid="XXX";

> From: Josh Bitto
> Sent: 2/6/2013 10:05 PM
> To: snort-users at lists.sourceforge.net
> Subject: [Snort-users] Snort and Barnyard2
> Has anyone else had this issue come up where when you export the data from
> your database the IP's listed do not correspond with the actual IP addresses
> that have been captured when an event happens?

Now, i am not sure i understand what Josh Bitto mean by "the store IP
are not the same as the captured IP".
barnyard2 will store whats found in the unified2 file, did you
validate the content of your unified2 file
using u2spewfoo or u2boat to export contained packets to pcap file and
compare that information?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130206/77495511/attachment.html>

More information about the Snort-users mailing list