1

In my Java based program, I can always attempt to re-invent the wheel to parse own-written Snort rules, using some regex or the like.

However, this approach seems sensitive to ever evolving Snort rules syntax and so I prefer using /usr/bin/snort itself to provide me with the output of its parsing.

Invoking from my program /usr/bin/snort itself (with a myriad of command line arguments) is not an issue.

What I am looking for is a command line argument and/or console output or log file that flags an invalid IP (v4 and v6) address. The rest is trivial parsing by my Java based program.

Is there a way to accomplish that?

datv
  • 585
  • 3
  • 15
  • Maybe these threads could be of some help? (1) https://stackoverflow.com/questions/3477081/how-to-view-snort-log-files (2) https://stackoverflow.com/questions/42891842/why-are-my-snort-logs-empty – ususer Nov 26 '17 at 19:26

0 Answers0