websnort
Web service for analysing pcap files with intrusion detection systems such as snort and suricata.
Overview
websnort provides a web interface for user and system submission of packet capture files to run against IDS instances. Alerts and details from the analysis are returned as results.
If you are after a web interface for monitoring a live snort instance, see https://www.snort.org/downloads#additional-downloads instead.
While originally developed specifically for snort. Recent releases support a flexible IDS plugin system which also supports suricata out of the box.
websnort can be configured to run the same submitted packet capture against any number of IDS instances, configs and rulesets. This allows broader coverage and comparison between installs and rule versions.
Getting Started
Ubuntu
Install snort if needed:
sudo apt-get install snort
Optional Disable running snort service if only required for this web api:
sudo service snort stop sudo update-rc.d snort disable
On recent ubuntu/debian releases the default snort.conf is not world readable. Unless planning to run the web service as root (not recommended) you will need to modify the permissions, for example:
sudo chmod a+r /etc/snort/snort.conf
Install web service using pip:
sudo pip install websnort
Start the websnort web server on the default port:
websnort
Browse to http://server:8080 and submit a pcap file for analysis.
Navigate to http://server:8080/api for details of provided json web api.
Documentation
Full project documentation can be found on readthedocs.
Issues
Source code for websnort is hosted on GitHub. Any bug reports or feature requests can be made using GitHub’s issues system.
1 maintainer
Metadata
1 maintainer
Release files for websnort 0.8
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| websnort-0.8.tar.gz | 109.2 kB | Without provenance | Details for websnort-0.8.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| websnort-0.8-py2.py3-none-any.whl | Python 2, Python 3 | none | any | Details for websnort-0.8-py2.py3-none-any.whl |
Total release size: 216.4 kB
Release files / websnort-0.8.tar.gz
| Download URL | websnort-0.8.tar.gz |
|---|---|
| Size | 109.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
a635cba9ade9f81f54294b64d1e2d272da2e9f891f8517a8acf3ba30fcd30910
|
|
BLAKE2b-256 checksum How to use checksums |
37616f71c13fac19d8fdb370395d4a2a96fab590381a3115721eaac76f92a68e
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
Release files / websnort-0.8-py2.py3-none-any.whl
| Download URL | websnort-0.8-py2.py3-none-any.whl |
|---|---|
| Size | 107.2 kB |
| Tags | Python 2 Python 3 |
|
SHA-256 checksum How to use checksums |
391c2491405eee46772dd662851488b5c2b1149bf9a5c04de0f5ca27ff9088e7
|
|
BLAKE2b-256 checksum How to use checksums |
7a0ce9cb9b6470f8cc1b0b68500aabec5c696f6aa51bbe7a154fca4cb04088e0
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
Security for websnort 0.8
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
