Recipe 9.25 Partitioning Snort Logs Into Separate Files

9.25.1 Problem

You want to split Snort's log output into separate files, based on the IP addresses and protocols detected.

9.25.2 Solution

# snort -l /var/log/snort -h network -r snort.log.timestamp

9.25.3 Discussion

Snort can split its formatted output into separate files, with names based on the remote IP address and protocols used: these files contain the same information printed by snort -v. Select this mode of operation by using the -l option without -b, plus the -h option to specify the "home network" for identification of the remote packets:

# cd /var/log/snort
# snort -l /var/log/snort -h 10.22.33.0/24 -r snort.log.1047160213
...
# find [0-9A-Z]* -type f -print | sort
10.30.188.28/TCP:1027-22
192.168.33.1/IP_FRAG
192.168.33.1/UDP:2049-800
192.168.33.2/TCP:6000-1050
192.168.33.2/TCP:6000-1051
192.168.33.2/TCP:6000-1084
ARP

The digits following the filenames for TCP and UDP traffic refer to the remote and local port numbers, respectively. Information about fragmented IP packets that could not otherwise be classified is stored in files named IP_FRAG. Details for ARP packets are stored in a file named ARP in the top-level logging directory.

Don't use split formatted output for logging while sniffing packets from the network —it's inefficient and discards information. For logging, we recommend binary libpcap-format files (produced by the -b option) for speed and flexibility. [Recipe 9.16] You can always split and format the output later, using the technique in this recipe.

9.25.4 See Also

snort(8). The Snort home page is http://www.snort.org.