Re: Snort dont understand pf (openbsd) format

[Sean Brown <sblinux () shaw ca>]

On November 29, 2004 5:06 pm, Matt Kettler wrote:
> At 06:27 PM 11/29/2004, Matt Kettler wrote:
> > >     What is wrong with that? Does snort understand the pf log format?
> >
> > No, snort doesn't understand any textual log formats at all, including pf.
>
> Self correction.. pflogd generates tcpdump binary files. So, theoretically,
> it should work with snort -r.
>
> My mistake entirely.
>
> However, looking around, pflogd files aren't exactly tcpdump files.. they
> have (or at least had) a "pftcpdump" to read them in freebsd:
>
> http://lists.freebsd.org/pipermail/freebsd-current/2004-August/035814.html
>
> http://lists.sans.org/pipermail/list/2004-November/062633.html
>
> It's unclear if OpenBSD generates real tcpdump files that any ordinary
> tcpdump can read, or if they patched tcpdump to support them.
It doesn't, it is a modified format that the tcpdump in OpenBSD was patched to 
read. However, in the FAQ:

4.4 Does snort see packets filtered by IPTables/IPChains/IPF/PF?
...
Under OpenBSD you can snort just the PF rejects by using the /dev/pflogN
interface.

Since pflogd simply writes the traffic from pflog, snort should be able to 
understand the log file, but I have tried to have it read the file and 
attached it to /dev/pflog0 and it does not understand the traffic. Perhaps 
the output format changed in one of the recent OpenBSD releases and Snort was 
never updated. If so, the FAQ needs to be fixed.


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users