Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am just getting started with learning and testing snort.

I have some snort data in snort.u2.timestamp files. What is the best way to view / read these files? I have found some info via Google search but it discusses how to capture traffic using snort, parse it using barnyard2 and then load it into a mysql database. I can't find anything clear on how to read existing snort.u2 files. Also, I should mention that I have a barnyard2.waldo file along with the snort.u2.timestamp files. Not sure where this file comes in.

Also, is it possible to view snort.u2 files on Windows? It would be convient, but not a big deal if it is not possible.

share|improve this question
    
Which stackexchange site would be better for this question? Is somebody able to migrate it to the appropriate site? –  user695752 Mar 16 '13 at 20:47
add comment

1 Answer

Not really the best stackexchange site to ask that question, but snort comes with the u2spewfoo command for that:

u2spewfoo /path/to/file.unified2

See also the u2boat command to extract the pcap.

There is also a SnortUnified module for perl which can allow you to do fancier stuff with the unified2 log. A quick example to emulate u2spewfoo:

#!/usr/bin/perl

use SnortUnified(qw(:ALL));
use Socket;
use POSIX;

$| = 1;
$file = shift;

$UF_Data = openSnortUnified($file) or die;

while ($record = readSnortUnifiedRecord()) {

  print(++$i);;

  foreach $field ( @{$record->{'FIELDS'}} ) {
    my $v = $record->{$field};
    if ($field =~ /^.ip$/) {
      $v = inet_ntoa(pack("N", $v));
    } elsif ( $field =~ /_sec$/) {
      $v = strftime("%F_%T", localtime $v);
    } elsif ( $field eq 'pkt' ) {
      $v = unpack("H*", $v);
    }
    print(", $field=" . $v);
  }
  print("\n");
}

closeSnortUnified();
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.