Re: writing to log file and running a script at once???

[Erek Adams <erek () theadamsfamily net>]

On Mon, 22 Apr 2002, Lookman Fazal wrote:

> I have snort (1.8.3) running on linux.  The linux machine is connected
> on the mirror port and monitoring traffic just fine.  For example, when
> someone goes to yahoo, it creates a directory with the sender's IP
> address in /var/log/snort directory
>
> Now what I want to do is, when it writes the sender's IP address in this
> /var/log/snort directory I want to, at the same time run a script, which
> will take the sender's IP address and telnet to my router and add an
> access-list to deny this sender. I can work on the script, how do I do
> the other part?
>
> Is there a way to do this?  Any help will be greatly appreciated

Ok....  I'm not going to re-write the message, but before you decide to do
this, please check this out:

        http://marc.theaimsgroup.com/?l=snort-users&m=101872552332464&w=2


Anyway...  Onto your question:  Use a unix socket alerts and have the code on
the other side read from the socket as the data comes in.  It's quite a bit
cleaner and will work a bit faster since it's not hitting the disk.  Check the
archives, there's been some talk of doing that on the list recently.

Good luck!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users