Chapter 3. The snort patch

This patch is needed to activate an output plugin which enables snort to write all alert information and the suspicious network packet to an unix datagram socket. To apply the patch you need only to change to the snort source directory and use the command:

snort-2.x.x$ patch -p1 < /path/to/FLoP-1.6.0/patches/snort-2.x.x_patch

After configure and make the snort program understands a new option in the snort.conf file:

output alert_unixsock_db: /tmp/snort[, all|log|alert]

The parameter of this output plugin describes where the unix domain socket should be found. Since we use unix domain sockets of type datagram it is not required that this socket exists. If there is no such socket, snort will simply write a warning message and continue to work. If the socket gets created in between, snort will use it. So snort is never blocked by this output plugin (except the reading process is explicit blocking).

Since snort-2.1.3 there exists also the possibility to write alternatively the log packets to the socket or both. If all is mentioned then only one packet is written to the socket if they are in both output chains.

Note: FLoP does not distinguish between log and alert. Therefore both kinds are ment if an alert is mentioned in this document!

Further there is the option -Y added to snort to avoid writing any alerts to the file system. (Before snort-2.3 this option was -Q but now -Q is used for the snort-inline part.)

Note: If you use the option all this is not necessary. If an output plugin is activated the normal ouput plugin is disabled. So if all is used then no alert or log data are written to the file system.

If you use alert then you can disable writing of log informations with the snort option -N or the equivalent -K none. If you only use the log then you can disable the alerts with the snort option -A none.

So this additional option -Y is no longer necessary but is still part of the snort patch.

The log facility is necessary if you want to store tagged packets or packets of a dynaimc rule in the database. Take also a look at the program getpacket.

#!/usr/bin/perl
use IO::Socket;
use IO::Handle;
use Socket;
use RRDs;

$UXSOCKADDR="/tmp/stats";

unlink($UXSOCKADDR);
$sock = IO::Socket::UNIX->new( Local => $UXSOCKADDR, Type => SOCK_DGRAM) 
  or die "Can't bind to Unix Socket: $!\n";
  $sock->setsockopt(SOL_SOCKET, SO_RCVBUF, 65440);         
print "Ready to accept conntections!\n";

$RRDrecv="recv.RRD"; 

if (! -e $RRDrecv)                                         
  {
     $CreateRRD=true;
  }
while (1) {
  $len=44;
  $sock->recv($input,$len);
  $TotalEvents++;
  
  @fields=unpack(" L L L L L L L L L L L",$input);
  print "\n";

  if ($CreateRRD eq true) 
    {
      RRDs::create ("$RRDrecv", "--start", "$fields[0]", "--step", "30",
                    "DS:Statistics:GAUGE:61:0:U", "RRA:AVERAGE:0.5:1:100",
                    "RRA:AVERAGE:0.5:10:24", "RRA:AVERAGE:0.5:20:144");
       $CreateRRD=false;
     }

    RRDs::update ($RRDrecv, "$fields[0]:$fields[1]");      
}