Snortunsock
A Python listener to capture Snort event via the UNIX Socket output.
Snortunsock can parse and show the alert message.
Installation
Install Snortunsock from PyPI:
$ pip install snortunsock
Usage
The basic usage
import dpkt
from snortunsock import snort_listener
for msg in snort_listener.start_recv("/tmp/snort_alert"):
print('alertmsg: %s' % ''.join(msg.alertmsg))
buf = msg.pkt
# buf is a raw packet which can use dpkt library to parsing it
# Unpack the Ethernet frame (mac src/dst, ethertype)
eth = dpkt.ethernet.Ethernet(buf)The complicated examples are in the examples folder
LICENSE
Apache License, Version 2.0
1 maintainer
Metadata
1 maintainer
Release files for snortunsock 0.0.5
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| snortunsock-0.0.5.tar.gz | 7.8 kB | Details |
Release files / snortunsock-0.0.5.tar.gz
| Download URL | snortunsock-0.0.5.tar.gz |
|---|---|
| Size | 7.8 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
58feaaf05dee7a85eb203ebdf78860b78fdf59037de678fcd7f243fda01eabc2
|
|
BLAKE2b-256 checksum How to use checksums |
5628aa43b16088385cc585b901eb96322d962e88487a9214890f289925776425
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
