I'm pretty new to snort and don't know too much about it. I am trying to put together a report of my snort files but, I only want the connections not the entire flows. For example, say I have a few lines like this:

timedate sid msg {TCP} ipaddr1:port1 -> ipaddr2:port2
timedate sid msg {TCP} ipaddr2:port2 -> ipaddr1:port1

I'd consider that one connection and only want to use either one in my report. I'd also like to know if there was a way to edit the actual output. For example, it would be nice in my case to be able to remove an attribute like the timestamp in my report. Is that possible?


Actually, I figured it out. I can output my alerts as a .csv file by adding a line to my snort.conf file:

output alert_csv: stdout proto,tcpflags,src,srcport,dst,dstport,msg

and then running snort like this:

snort -c /etc/snort/snort.conf -r my_PCAPFILE.pcap > snort-output.log > alerts.csv

As far as determining duplicates I'm sure I can run a little script inside of my .csv editor to filter them out. If anyone else has any better ideas please comment or add your own answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.