1

I have a snort log file in unified2 format and I am able to view the output using the u2spewfoo utility.

I think that I understand the generator id, signature id, and revision tell me why the alert was generated, but I'm not sure how to make sense out of them.

For instance, I have (sans packet data):

(Event)
sensor id: 0    event id: 3     event second: 1516750250        event microsecond: 585397
sig id: 527     gen id: 1       revision: 8      classification: 3
priority: 2     ip source: 0.0.0.0      ip destination: 255.255.255.255
src port: 68    dest port: 67   protocol: 17    impact_flag: 0  blocked: 0
mpls label: 0   vland id: 0     policy id: 0

I believe what I need is in the third line (sig id:). What does this tell me, and how do I map it to the rule which generated the event?

If it helps, I have a vanilla Debian installation with only the snort and snort-rules-default packages installed. The alert above was generated by processing a pcap file I had from a few months ago using the command:

snort -c /etc/snort/snort.conf -S HOME_NET=[192.168.1.0/24] -r daemonlogger.pcap.1516xxxxxx

This dumped several alerts to /var/log/snort/snort.log, which I then parsed with the u2spewfoo utility.

  • Progress... I've found the sid values listed in the rules files (/etc/snort/rules), but I'm still not clear on the generator. – Jeff W Mar 11 '18 at 14:29
0

When gid is 1, it refers to the rules engine.

Snort maintains its rule files in the /etc/snort/rules directory (debian default). Each rule explicitly declares its sid (signature id).

Drawing from the example above, 'sid' is 527, so a simple grep returns the answer:

root@debian:~# cd /etc/snort/rules/
root@debian:/etc/snort/rules# grep 'sid:527' *.rules
bad-traffic.rules:alert ip any any -> any any (msg:"BAD-TRAFFIC same SRC/DST"; sameip; reference:bugtraq,2666; reference:cve,1999-0016; reference:url,www.cert.org/advisories/CA-1997-28.html; classtype:bad-unknown; sid:527; rev:8;)

This returns all of the required information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.