Nsm on Inliniac

Suricata Flow Logging

Mon, 28 Jul 2014 19:09:07 +0000

Pretty much from the start of the project, Suricata has been able to track flows. In Suricata the term ‘flow’ means the bidirectional flow of packets with the same 5 tuple. Or 7 tuple when vlan tags are counted as well.

Such a flow is created when the first packet comes in and is stored in the flow hash. Each new packet does a hash look-up and attaches the flow to the packet. Through the packet’s flow reference we can access all that is stored in the flow: TCP session, flowbits, app layer state data, protocol info, etc.

Closing in on Suricata 1.4

Thu, 29 Nov 2012 16:50:15 +0000

I just made Suricata 1.4rc1 available with some pretty exciting features: unix socket mode and IP reputation.

Unix socket

First of all, Eric Leblond’s work on the Unix socket was merged. The unix socket work consists of two parts. The unix socket protocol implementation and a new runmode.

The protocol implementation is based on JSON messages over unix socket. Eric will be fully documenting it soon. Currently the commands are limited to shutting down and getting some basic stats. This part isn’t very exciting yet, but the groundwork for many future extensions has been laid.

Recovering the email/username in Snorby

Wed, 22 Feb 2012 15:16:46 +0000

I use a Snorby setup that comes with Security Onion. Recently I had changed the username, but I couldn’t remember what I had set it to.

To recover the username, we can look it up in the database, like this:

mysql -uroot -B -e 'use snorby; select email from users;'

Thanks to Doug Burks and Dustin Webber for helping me recover it.

Friendly pcap parsing

Mon, 08 Oct 2007 22:47:28 +0000

Over at his weblog node5, William Metcalf has written about a nice script he created for automagically extracting full content data for certain ip’s and ip ranges from large amounts of pcap data. It will also create some nice output for the data. Check out his post at node5 and the script here at bleedingthreats. Great to see you blogging Will! :)