Forum Debian Users Gang

test -p /dev/snort || mkfifo /dev/snort

open (ALERT, $alert_file) or die "can't open alert file: $alert_file: $!\n";
@junk=<ALERT>;
# this is the same as a tail -f :)
for (;;) { ....

open (ALERT, "</dev/snort") or die "can't open alert file: $alert_file: $!\n";
@junk=<ALERT>;
# this is the same as a tail -f :)
for (;;) { 
  sleep 1; 
  if (seek(ALERT,0,1)){ 
    while (<ALERT>) { 
      chop;
      if (/snort/) { #syslog file
        if (defined($opt_d)) {print "$_\n";}
        # this was contributed by warlock <warlock@pagetrans.com>, however my 
        # syslog seems diffrent...
        if (/snort:\s*(.*)\s*\:\s*(\d+\.\d+\.\d+\.\d+):\d+\s*->\s*(\d+\.\d+\.\d+\.\d+):\d+$/) {
          &checkem ($2, $3, $1);
        }
        # this should work with my syslog
        if (/snort\[\d+\]:\s*(.*)\s*\:\s*(\d+\.\d+\.\d+\.\d+):\d+\s*->\s*(\d+\.\d+\.\d+\.\d+):\d+$/) {
          &checkem ($2, $3, $1);
        }
        # Not everything has a port assocated with it (ICMP stuff)
        if (/snort\[\d+\]:\s*(.*)\s*\:\s*(\d+\.\d+\.\d+\.\d+)\s*->\s*(\d+\.\d+\.\d+\.\d+)$/) {
          &checkem ($2, $3, $1);
        }
     
      } else { # snort.alert type file for backwards compat
              if (defined($opt_d)) {print "$_\n";}
        if (/\[\*\*\]\s+(.*)\s+\[\*\*\]/){ 
          $type=$1;
        }
        if (/(\d+\.\d+\.\d+\.\d+):\d+ -\> (\d+\.\d+\.\d+\.\d+):\d+/) {
          &checkem ($1, $2, $type);
        }
      }
    } 
  } 
  &remove_blocks; # This might get moved elsewhere, depending on how much load
                  # it puts on the system..
}