Importing Snort's tcpdump into mysql

We crated snort database using the schema file "create_mysql" in mysql database.
After running the snort with -L option for some time (ex: snort -L tcpdump.log), we want to import the data in tcpdump.log into snort database which we have created earlier in mysql. How to that ?
raghuniAsked:
Who is Participating?
 
nociSoftware EngineerCommented:
'snort -r tcpdump.log'

from man snort:

    -r tcpdump-file
              Read  the  tcpdump-formatted file tcpdump-file.  This will cause Snort to read and process the file fed to it.  This is useful if,
              for instance, you've got a bunch of SHADOW files that you want to process for content, or even if you've got a bunch  of  reassem-
              bled packet fragments which have been written into a tcpdump formatted file.
0
 
nociSoftware EngineerCommented:
Right..., to fill the database you need to add a special line to the snort config file,
along:

output database: log, mysql, dbname=snort, username=snort.....
or
output database: alert, mysql, dbname=snort, username=snort, password=....

If everything has been install correctly there is a configuration description in the file called README.database
then everything will be put into the database by snort itself....... No need to import.

In the mean time I will look if I can find a solution to the actual question..... ;-)
0
 
nociSoftware EngineerCommented:
If you configure snort to log everything to MySQL according to the docs you should be able to reread
the binary log with 'snort -r tcpdump.log' to process all packets again and get them into the database.

The file has tcpdump format, ethereal et al can read them, but packets are encapsulated within a
"SNORT-protocol" that shows up as ip-proto-255 with some cause code appended.
0
 
raghuniAuthor Commented:
I already had some tcpdump file. I want to dump the content of the this file into snort database.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.