Project

General

Profile

Actions
Copy link

Bug #235

closed

fast log should fill in protcol name when known by /etc/protocols

Added by Will Metcalf over 13 years ago. Updated over 13 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Gurvinder Singh
Target version:
1.1beta1
Affected Versions:
Effort:
Difficulty:
Label:

Description

Currently the suricata fast.log doesn't match the snort fast log. Currently we only print the protocol number. Snort sets the protocol name if known via /etc/protocols if not it uses the format PROTO:protonumber currently suricata always prints the proto number.

Example snort fast logs (ip addy's have been changed)
12/26-06:44:10.148430 [**] [1:2002750:23] ET POLICY Reserved IP Space Traffic - Bogon Nets 2 [**] [Classification: Potentially Bad Traffic] [Priority: 2] {PROTO:007} 10.1.1.1 -> 10.1.1.2
12/26-11:11:11.012275 [**] [1:2009022:3] ET VIRUS Zlob User Agent - Likely Zlob (securityinternet) [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 10.1.1.1:1033 -> 10.1.1.2:80
12/29-11:11:11.592820 [**] [1:2002750:23] ET POLICY Reserved IP Space Traffic - Bogon Nets 2 [**] [Classification: Potentially Bad Traffic] [Priority: 2] {MANET} 10.1.1.1 -> 10.1.1.2

Files

Download all files
0001-added-support-to-print-the-known-protocols-in-the-al.patch (6.08 KB) 0001-added-support-to-print-the-known-protocols-in-the-al.patch Gurvinder Singh, 09/12/2010 12:06 AM
0001-support-for-printing-protocol-names-for-known-protoc.patch (9.3 KB) 0001-support-for-printing-protocol-names-for-known-protoc.patch Gurvinder Singh, 09/24/2010 09:58 AM
Actions
Copy link

Also available in: Atom PDF