From: Maicon Melo Alves (mmalvesnet.ucam-campos.br)
Date: Fri Sep 10 2004 - 11:08:32 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hello list,

I wrote this program to receive the alerts sended from the snort by the unix socket. It's working, but I just only receive the message of the alert. I want to receive, also, the ip destination, ip source and others informations, like protocol, priority...

I want to receive the same alerts, emmited on the console (with -A console option).

Is it possible?

The simple code, receive correctly the messages alerts. I didn't receive the rest of the information.

For Example, for the alert relationed with bad-traffic, I receive on console this alert:

Potentially Bad Traffic [Priority: 2] {ICMP} 127.0.0.1 -> 127.0.0.1 .......

By the Unix Socket:

BAD-TRAFFIC loopback traffic



******************************************************************
Code:

#include <sys/socket.h>
#include <sys/un.h>
#include <stdio.h>
#define UNSOCK "/var/log/snort/snort_alert"
main()
{
        int sock, length;
        struct sockaddr_un name;
        char buf[1024];

        sock = socket(AF_UNIX, SOCK_DGRAM, 0);
        if (sock < 0)
        {
                perror("opening datagram socket");
                exit(1);
        }

        name.sun_family = AF_UNIX;
        strcpy(name.sun_path, NAME);

        if (bind(sock, (struct sockaddr *) &name, sizeof(struct sockaddr_un)))
        {
                perror("binding name to datagram socket");
                exit(1);
        }

        printf("socket -->%s\n", NAME);

        while (recvfrom(sock,buf,1024,0,(struct sockaddr *) &name, sizeof(struct sockaddr_un) > 0))
                printf("-->%s\n", buf);
        close(sock);
        unlink(NAME);
}


Thank you,

Maicon Melo Alves.

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]