Skip to content

A Python listener to capture Snort event via the UNIX Socket output.

License

Notifications You must be signed in to change notification settings

John-Lin/snortunsock

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

28 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Snortunsock

A Python listener to capture Snort event via the UNIX Socket output.

Snortunsock can parse and show the alert message.

Installation

Install Snortunsock from PyPI:

$ pip install snortunsock

Usage

The basic usage

import dpkt

from snortunsock import snort_listener

for msg in snort_listener.start_recv("/tmp/snort_alert"):
    print('alertmsg: %s' % ''.join(msg.alertmsg))
    buf = msg.pkt

    # buf is a raw packet which can use dpkt library to parsing it

    # Unpack the Ethernet frame (mac src/dst, ethertype)
    eth = dpkt.ethernet.Ethernet(buf)

The complicated examples are in the examples folder

Related

  • See dpkt which is a fast, simple packet creation/parsing, with definitions for the basic TCP/IP protocols.

LICENSE

Apache License, Version 2.0

About

A Python listener to capture Snort event via the UNIX Socket output.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages