This is a php script which goes to the database (Postgresql) and generate some statistics from the data. For more info see this snortdb page.
221ba130f9735cee45697fe01ed5f6eaec67d1b0ff3fa6bd692e2fdf50096ef5<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<title>Snort Statistics On-Line</title>
<META HTTP-EQUIV="Pragma" CONTENT="no-cache">
<!-- Html Comments begin here
This is Snort Statistics On-Line PHP script. You need to have php with support
of postgresql database. Then just put this file under the directory you allow p
hp to be executed, or name it as foobar.php3. It looks more like https://www.inc
ident.org/ now, but I hope to make it more 'interactive' in the future, or at l
east do something like my snort_stat.pl does. :)
Oh, there is not many comments here. :)
$Id: pgsql.php3,v 1.4 2000/07/25 11:34:43 yenming Exp $
Yen-Ming Chen <chenym@CMU.EDU>
$Log: pgsql.php3,v $
Revision 1.4 2000/07/25 11:34:43 yenming
Contributions from Pinaud Bruno <bpinaud@ifrance.com>
* Add meta tag with no-cache
* Change the pg_connection line
* Add hide_dest and show_dest to indicate hide/show destination ip
* Add protocol details in the summary
* Fix the form action problem of ip addr input
Revision 1.3 2000/07/18 04:29:23 yenming
Just fix the stupid error for last commit to CVS repository.
Revision 1.2 2000/07/18 02:04:44 yenming
Contribution from:
Pinaud Bruno <bpinaud@ifrance.com>
Paul Harrington <paul@pizza.org>
Patrick Audley <paudley@blackcat.ca>
* Bug fixes in postgresql php script
* IDS/CVE links added (using php rather than JavaScript)
* Destination IP input
Revision 1.1 2000/05/02 02:28:59 yenming
Snort Statistic PHP3 script for Postgresql by Yen-Ming Chen
<chenym@CMU.EDU>
New committed for new Snort database scheme.
-->
</head>
<body>
<h1>Snort Statistics On-Line</h1>
<?php
// Turn a postgresql time duration output into seconds
function turn_sec($string) {
$duration = preg_split("/\s/",substr($string,2));
switch(count($duration)) {
case 0:
case 1:
case 3:
case 5:
case 7:
break;
case 2:
$seconds = $duration[0];
break;
case 4:
$seconds = $duration[2] + $duration[0]*60;
break;
case 6:
$seconds = $duration[4] + $duration[2]*60 + $duration[0]*3600;
break;
case 8:
$seconds = $duration[6] + $duration[4]*60 + $duration[2]*3600 + $duration
[0]*86400;
break;
default:
break;
}
return $seconds;
}
/* The parameters here assume you use postgresql on localhost, and run this ph
p script as a valid user to access the database */
// $pg_connection = pg_connect("","","","","snort");
$pg_connection = pg_connect("dbname=snort user=snort");
if(isset($hide_dest))
unset($show_dest);
?>
<h2>Summary</h2>
<?php
$pattern=array( "/(IDS)(\d+)/",
"/(IDS)(0+)(\d+)/",
"/(CVE-\d+-\d+)/"
);
$replace=array( "<A HREF=\"https://www.whitehats.com/\\1/\\2\">\\1\\2</A>",
"<A HREF=\"https://www.whitehats.com/\\1/\\3\">\\1\\2\\3</A>",
"<A HREF=\"https://cve.mitre.org/cgi-bin/cvename.cgi?name=\\1\
">\\1</A>"
);
if(!isset($ip1)) { //init for the first time the page is loaded
$ip1='128';
$ip2='2';
$ip3='84';
$ip4='43'; /* Change this to the IP you want to watch! */
}
$Selstr="SELECT COUNT(event.cid),MIN(event.timestamp),MAX(event.timestamp) FR
OM event";
$Selstr2="SELECT DISTINCT signature FROM event";
$Selstr3="SELECT ip_src0,ip_src1,ip_src2,ip_src3 FROM iphdr GROUP BY ip_src0,
ip_src1,ip_src2,ip_src3";
$Selstr4="SELECT ip_dst0,ip_dst1,ip_dst2,ip_dst3 FROM iphdr GROUP BY ip_dst0,
ip_dst1,ip_dst2,ip_dst3";
//details of each type of events
$Selstr5="SELECT count(sid) from icmphdr";
$Selstr6="SELECT count(sid) from tcphdr";
$Selstr7="SELECT count(sid) from udphdr";
$Result=pg_exec($pg_connection,$Selstr);
$Result2=pg_exec($pg_connection,$Selstr2);
$Result3=pg_exec($pg_connection,$Selstr3);
$Result4=pg_exec($pg_connection,$Selstr4);
//details
$Result5=pg_exec($pg_connection,$Selstr5);
$Result6=pg_exec($pg_connection,$Selstr6);
$Result7=pg_exec($pg_connection,$Selstr7);
if (pg_NumRows($Result2) != 0) {
$tot_sig = pg_NumRows($Result2);
} else {
$tot_sig = 0;
}
if (pg_NumRows($Result3) != 0) {
$tot_dip = pg_NumRows($Result3);
} else {
$tot_dip = 0;
}
if (pg_NumRows($Result4) != 0) {
$tot_sip = pg_NumRows($Result4);
} else {
$tot_sip = 0;
}
$icmp = pg_result($Result5, 0, 0);
$tcp = pg_result($Result6, 0, 0);
$udp = pg_result($Result7, 0, 0);
if (pg_NumRows($Result) != 0) {
$row = pg_fetch_row($Result,0);
print "Total events: $row[0] (icmp : $icmp, udp : $udp, tcp : $tcp)<br>\n
Timestamp begins at: $row[1]<br>\n
Timestamp ends at: $row[2]<br>\n
Total signatures: $tot_sig<br>\n
Total Destination IP observed: $tot_dip<br>\n
Total Source IP observed: $tot_sip<br>\n";
}
else {
print "Nothing Here\n";
}
pg_freeresult($Result);
pg_freeresult($Result2);
pg_freeresult($Result3);
pg_freeresult($Result4);
?>
<HR>
<H2><a name="top">Table Of Contents</a></H2>
<ul>
<li><a href="#tcp">10 most recent TCP probes</a></li>
<li><a href="#udp">10 most recent UDP probes</a></li>
<li><a href="#icmp">10 most recent ICMP probes</a></li>
<li><a href="#by_signature">Reports by signatures</a></li>
<li><a href="#source_sig">From same source with same signature</a></li>
<li><a href="#yourip">Scans to yourhost</a></li>
</ul>
<?
//choose to see or not the dest ip
if(!isset($show_dest))
{
echo "<br><table><tr>";
echo "<td><FORM NAME=\"destination_ip\" ACTION=\"pgsql.php3\" METHOD=PO
ST></td>";
echo "<td><INPUT TYPE=\"checkbox\" NAME=\"show_dest\" onclick=\"destina
tion_ip.submit()\"></td>";
echo "<td>Click to see Dest ip\n</td>";
}
else
{
echo "<br><table><tr>";
echo "<td><FORM NAME=\"destination_ip_hide\" ACTION=\"pgsql.php3\" METH
OD=POST></td>";
echo "<td><INPUT TYPE=\"checkbox\" NAME=\"hide_dest\" onclick=\"destina
tion_ip_hide.submit()\"></td>";
echo "<td>Click to remove Dest ip\n</td>";
}
echo "</tr></table></form>";
// $show_dest = 1;
?>
<a name="tcp"><HR></a>
<?php
if(isset($show_dest))
$Selstr="SELECT event.signature,event.timestamp,iphdr.ip_src0,iphdr.ip_
src1,iphdr.ip_src2,iphdr.ip_src3,iphdr.ip_dst0,iphdr.ip_dst1,iphdr.ip_dst2,iphd
r.ip_dst3,tcphdr.th_sport,tcphdr.th_dport FROM event,iphdr,tcphdr WHERE iphdr.s
id = event.sid and iphdr.cid = event.cid and tcphdr.cid = event.cid ORDER BY ev
ent.timestamp DESC LIMIT 10";
else
$Selstr="SELECT event.signature,event.timestamp,iphdr.ip_src0,iphdr.ip_
src1,iphdr.ip_src2,iphdr.ip_src3,tcphdr.th_sport,tcphdr.th_dport FROM event,iph
dr,tcphdr WHERE iphdr.sid = event.sid and iphdr.cid = event.cid and tcphdr.cid
= event.cid ORDER BY event.timestamp DESC LIMIT 10";
$Result=pg_exec($pg_connection,$Selstr);
echo "<TABLE BORDER=\"2\" CELLPADDING=\"5\">";
if(isset($show_dest))
{
echo "<TR BGCOLOR=\"#CCCCCC\"><TH COLSPAN=\"6\" ALIGN=\"center\">10 mos
t recent TCP probe reports</B></TH></TR>";
echo "<TR BGCOLOR=\"#CCCCCC\"><TD>Timestamp</TD><TD>Source IP</TD><TD>S
ource Port</TD><TD>Dest IP</TD><TD>Dest Port</TD><TD>Signature</TD>";
}
else
{
echo "<TR BGCOLOR=\"#CCCCCC\"><TH COLSPAN=\"5\" ALIGN=\"center\">10 mos
t recent TCP probe reports</B></TH></TR>";
echo "<TR BGCOLOR=\"#CCCCCC\"><TD>Timestamp</TD><TD>Source IP</TD><TD>S
ource Port</TD><TD>Dest Port</TD><TD>Signature</TD>";
}
if (pg_NumRows($Result) != 0) {
for ($i = 0; $i < pg_NumRows($Result); $i++ ) {
$row = pg_fetch_row($Result,$i);
$row[0]=preg_replace($pattern,$replace,$row[0]);
if(isset($show_dest))
{
print "<tr bgcolor=\"white\"><td>$row[1]</td>\n
<td>$row[2].$row[3].$row[4].$row[5]</td>\n
<td>$row[10]</td>\n
<td>$row[6].$row[7].$row[8].$row[9]</td>\n
<td>$row[11]</td>\n
<td>$row[0]</td>\n";
}
else
{
print "<tr bgcolor=\"white\"><td>$row[1]</td>\n
<td>$row[2].$row[3].$row[4].$row[5]</td>\n
<td>$row[6]</td>\n
<td>$row[7]</td>\n
<td>$row[0]</td>\n";
}
}
}
else {
if(isset($show_dest))
print "<tr><th colspan=6 align=center>Nothing there!</th></tr>\
n";
else
print "<tr><th colspan=5 align=center>Nothing there!</th></tr>\
n";
}
pg_freeresult($Result);
?>
</TABLE>
<a href="#top">Top</a>
<a name="udp"><HR></a>
<?php
if(isset($show_dest))
$Selstr="SELECT event.signature,event.timestamp,iphdr.ip_src0,iphdr.ip_
src1,iphdr.ip_src2,iphdr.ip_src3,iphdr.ip_dst0,iphdr.ip_dst1,iphdr.ip_dst2,iphd
r.ip_dst3,udphdr.uh_sport,udphdr.uh_dport FROM event,iphdr,udphdr WHERE iphdr.s
id = event.sid AND iphdr.cid = event.cid AND udphdr.sid = iphdr.sid AND udphdr.
cid = iphdr.cid ORDER BY event.timestamp DESC LIMIT 10;";
else
$Selstr="SELECT event.signature,event.timestamp,iphdr.ip_src0,iphdr.ip_
src1,iphdr.ip_src2,iphdr.ip_src3,udphdr.uh_sport,udphdr.uh_dport FROM event,iph
dr,udphdr WHERE iphdr.sid = event.sid AND iphdr.cid = event.cid AND udphdr.sid
= iphdr.sid AND udphdr.cid = iphdr.cid ORDER BY event.timestamp DESC LIMIT 10;"
;
$Result=pg_exec($pg_connection,$Selstr);
?>
<TABLE BORDER="2" CELLPADDING="5">
<?
if(isset($show_dest))
{
echo "<TR BGCOLOR=\"#CCCCCC\"><TH COLSPAN=\"6\" ALIGN=\"center\">10 most rec
ent UDP probe reports</B></TH></TR>";
echo "<TR BGCOLOR=\"#CCCCCC\"><TD>Timestamp</TD><TD>Source IP</TD><TD>Source
Port</TD><TD>Dest IP</TD><TD>Dest Port</TD><TD>Signature</TD>";
}
else
{
echo "<TR BGCOLOR=\"#CCCCCC\"><TH COLSPAN=\"5\" ALIGN=\"center\">10 mos
t recent UDP probe reports</B></TH></TR>";
echo "<TR BGCOLOR=\"#CCCCCC\"><TD>Timestamp</TD><TD>Source IP</TD><TD>Sourc
e Port</TD><TD>Dest Port</TD><TD>Signature</TD>";
}
if (pg_NumRows($Result) != 0) {
for ($i = 0; $i < pg_NumRows($Result); $i++ ) {
$row = pg_fetch_row($Result,$i);
$row[0]=preg_replace($pattern,$replace,$row[0]);
if(isset($show_dest))
{
print "<tr bgcolor=\"white\"><td>$row[1]</td>\n
<td>$row[2].$row[3].$row[4].$row[5]</td>\n
<td>$row[10]</td>\n
<td>$row[6].$row[7].$row[8].$row[9]</td>\n
<td>$row[11]</td>\n
<td>$row[0]</td>\n";
}
else
{
print "<tr bgcolor=\"white\"><td>$row[1]</td>\n
<td>$row[2].$row[3].$row[4].$row[5]</td>\n
<td>$row[6]</td>\n
<td>$row[7]</td>\n
<td>$row[0]</td>\n";
}
}
}
else {
if(isset($show_dest))
print "<tr><th colspan=6 align=center>Nothing there!</th></tr>\
n";
else
print "<tr><th colspan=5 align=center>Nothing there!</th></tr>\
n";
}
pg_freeresult($Result);
?>
</TABLE>
<a href="#top">Top</a>
<a name="icmp"><HR></a>
<?php
if(isset($show_dest))
$Selstr="SELECT event.signature,event.timestamp,iphdr.ip_src0,iphdr.ip
_src1,iphdr.ip_src2,iphdr.ip_src3,iphdr.ip_dst0,iphdr.ip_dst1,iphdr.ip_dst2,iph
dr.ip_dst3,icmphdr.type,icmphdr.code FROM event,iphdr,icmphdr WHERE iphdr.sid =
event.sid AND iphdr.cid = event.cid AND icmphdr.sid = iphdr.sid AND icmphdr.ci
d = iphdr.cid ORDER BY event.timestamp DESC LIMIT 10;";
else
$Selstr="SELECT event.signature,event.timestamp,iphdr.ip_src0,iphdr.ip
_src1,iphdr.ip_src2,iphdr.ip_src3,icmphdr.type,icmphdr.code FROM event,iphdr,ic
mphdr WHERE iphdr.sid = event.sid AND iphdr.cid = event.cid AND icmphdr.sid = i
phdr.sid AND icmphdr.cid = iphdr.cid ORDER BY event.timestamp DESC LIMIT 10;";
$Result=pg_exec($pg_connection,$Selstr);
?>
<TABLE BORDER="2" CELLPADDING="5">
<?
if(isset($show_dest))
{
echo "<TR BGCOLOR=\"#CCCCCC\"><TH COLSPAN=\"6\" ALIGN=\"center\">10 mos
t recent ICMP probe reports</B></TH></TR>";
echo "<TR BGCOLOR=\"#CCCCCC\"><TD>Timestamp</TD><TD>Source IP</TD><TD>Dest
IP</TD><TD>Type</TD><TD>Code</TD><TD>Signature</TD>";
}
else
{
echo "<TR BGCOLOR=\"#CCCCCC\"><TH COLSPAN=\"5\" ALIGN=\"center\">10 mos
t recent ICMP probe reports</B></TH></TR>";
echo "<TR BGCOLOR=\"#CCCCCC\"><TD>Timestamp</TD><TD>Source IP</TD><TD>Type<
/TD><TD>Code</TD><TD>Signature</TD>";
}
if (pg_NumRows($Result) != 0) {
for ($i = 0; $i < pg_NumRows($Result); $i++ ) {
$row = pg_fetch_row($Result,$i);
$row[0] = preg_replace($pattern,$replace,$row[0]);
if(isset($show_dest))
{
print "<tr bgcolor=\"white\"><td>$row[1]</td>\n
<td>$row[2].$row[3].$row[4].$row[5]</td>\n
<td>$row[6].$row[7].$row[8].$row[9]</td>\n
<td>$row[10]</td>\n
<td>$row[11]</td>\n
<td>$row[0]</td>\n";
}
else
{
print "<tr bgcolor=\"white\"><td>$row[1]</td>\n
<td>$row[2].$row[3].$row[4].$row[5]</td>\n
<td>$row[6]</td>\n
<td>$row[7]</td>\n
<td>$row[0]</td>\n";
}
}
}
else {
if(isset($show_dest))
print "<tr><th colspan=6 align=center>Nothing there!</th></tr>\n";
else
print "<tr><th colspan=5 align=center>Nothing there!</th></tr
>\n";
}
pg_freeresult($Result);
?>
</TABLE>
<a href="#top">Top</a>
<a name="by_signature"><HR></a>
<?php
$Selstr="SELECT signature,COUNT(cid) as tot_id ,MAX(timestamp) FROM event GRO
UP BY signature ORDER BY tot_id DESC LIMIT 30";
$Result=pg_exec($pg_connection,$Selstr);
?>
<TABLE BORDER=2 CELLPADDING="5">
<TR ROWSPAN="2" BGCOLOR="#CCCCCC"><TH COLSPAN="3" ALIGN="center"># of Reports
on each signature</TH></TR>
<TR BGCOLOR="#CCCCCC"><TD>Numbers</TD><TD ALIGN="center">Signature</TD><TD>La
test Timestamp</TD></TR>
<?php
if (pg_NumRows($Result) != 0) {
for ($i = 0; $i < pg_NumRows($Result); $i++ ) {
$row = pg_fetch_row($Result,$i);
$row[0] = preg_replace($pattern,$replace,$row[0]);
print "<tr bgcolor=\"white\"><td>$row[1]</td>\n
<td>$row[0]</td>\n
<td>$row[2]</td></tr>";
}
}
else {
print "<tr><th colspan=3 align=center>Nothing there!</th></tr>\n";
}
pg_freeresult($Result);
?>
</TABLE>
<a href="#top">Top</a>
<a name="source_sig"><HR></a>
<?php
$Selstr="SELECT iphdr.ip_src0,iphdr.ip_src1,iphdr.ip_src2,iphdr.ip_src3,COUNT
(iphdr.cid) as total,event.signature,MAX(event.timestamp), MIN(event.timestamp)
, AGE(MAX(event.timestamp), MIN(event.timestamp)) FROM iphdr,event WHERE event.
sid = iphdr.sid AND event.cid = iphdr.cid GROUP BY iphdr.ip_src0,iphdr.ip_src1,
iphdr.ip_src2,iphdr.ip_src3,event.signature ORDER BY total DESC LIMIT 30";
$Result = pg_exec($pg_connection,$Selstr);
?>
<TABLE BORDER=2 CELLPADDING="5">
<TR ROWSPAN="2" BGCOLOR="#CCCCCC"><TH COLSPAN="6" ALIGN="center">From the sam
e source IP with the same signature</TH></TR>
<TR BGCOLOR="$CCCCCC"><TD>Reports</TD><TD>Source IP</TD><TD>Signature</TD><TD
>Frequency</TD><TD>First Timestamp</TD><TD>Latest Timestamp</TD></TR>
<?
if (pg_NumRows($Result) !=0 ) {
for ($i = 0; $i < pg_NumRows($Result); $i++ ) {
$row = pg_fetch_row($Result,$i);
$row[5] = preg_replace($pattern,$replace,$row[5]);
$freq = turn_sec($row[8]) / $row[4];
print "<tr bgcolor=\"white\"><td>$row[4]</td>\n
<td>$row[0].$row[1].$row[2].$row[3]</td>\n
<td>$row[5]</td>\n
<td>Once every $freq seconds</td>\n
<td>$row[7]</td>\n
<td>$row[6]</td>\n";
}
}
else {
print "<tr><th colspan=6 align=center>Nothing there!</th></tr>\n";
}
pg_freeresult($Result);
?>
</TABLE>
<a href="#top">Top</a>
<a name="yourip"><HR></a>
<?php
echo "<table><tr>";
echo "<td>Type the ip adress of a computer to see details :\n</td>";
echo "<td><FORM NAME=\"adresse\" ACTION=\"pgsql.php3\" METHOD=POST></td>";
echo "<td><INPUT TYPE=\"text\" NAME=\"ip1\" VALUE=\"$ip1\" SIZE=3>.</td>";
echo "<td><INPUT TYPE=\"text\" NAME=\"ip2\" VALUE=\"$ip2\" SIZE=3>.</td>";
echo "<td><INPUT TYPE=\"text\" NAME=\"ip3\" VALUE=\"$ip3\" SIZE=3>.</td>";
echo "<td><INPUT TYPE=\"text\" NAME=\"ip4\" VALUE=\"$ip4\" SIZE=3></td>";
echo "<td><INPUT TYPE=\"submit\" NAME=\"valid\" value=\"Ok\"></td>";
echo "</tr></table></form>";
//to be sure that the type is integer, so the value will be 0 if the user's inp
ut is not an int
$ip1 = intval($ip1);
$ip2 = intval($ip2);
$ip3 = intval($ip3);
$ip4 = intval($ip4);
if( (($ip1<=0)||($ip1>255)) ||
(($ip2<=0)||($ip2>255)) ||
(($ip3<=0)||($ip3>255)) ||
(($ip4<=0)||($ip4>255)) )
{
echo "<tr><td><h2>ERROR</h2></td></tr>";
echo "<tr><td><h2>Please use integer between 0 and 255</td></tr></h2>";
} else {
$Selstr="SELECT
event.signature,MIN(event.timestamp),MAX(event.timestamp),iphdr.ip_src0,iphdr
.ip_src1,iphdr.ip_src2,iphdr.ip_src3,COUNT(iphdr.cid) as
total, AGE(MAX(event.timestamp), MIN(event.timestamp)) FROM event,iphdr WHERE
iphdr.ip_src0 = $ip1 AND iphdr.ip_src1 = $ip2 AND iphdr.ip_src2 = $ip3 AND iph
dr.ip_src3 = $ip4 AND event.sid = iphdr.sid AND event.cid=iphdr.cid GROUP BY ip
hdr.ip_src0,iphdr.ip_src1,iphdr.ip_src2,iphdr.ip_src3,event.signature ORDER BY
total DESC LIMIT 30";
$Result=pg_exec($pg_connection,$Selstr);
}
?>
<TABLE BORDER=2 CELLPADDING="5">
<?
$ip_add = $ip1.".".$ip2.".".$ip3.".".$ip4;
$name = gethostbyaddr($ip_add);
echo " <TR ROWSPAN=\"2\" BGCOLOR=\"#CCCCCC\"><TH COLSPAN=\"6\" ALIGN=\"center\
"> SCANS to the specified IP ($name)</TH></TR>"
?>
<TR BGCOLOR="#CCCCCC"><TD>Reports</TD><TD ALIGN="center">started at</TD><TD>s
ource IP</TD><TD>last recorded timestamp</TD><TD>Signature</TD><TD>Frequency</T
D></TR>
<?php
if (pg_NumRows($Result) != 0) {
for ($i = 0; $i < pg_NumRows($Result); $i++ ) {
$row = pg_fetch_row($Result,$i);
$row[0] = preg_replace($pattern,$replace,$row[0]);
if ($row[7] != 0)
$freq = turn_sec($row[8]) / $row[7];
print "<tr bgcolor=\"white\"><td>$row[7]</td>\n
<td>$row[1]</td>\n
<td>$row[3].$row[4].$row[5].$row[6]</td>\n
<td>$row[2]</td>\n
<td>$row[0]</td>\n
<td>Once every $freq seconds\n";
}
}
else {
print "<tr><th colspan=6 align=center>Nothing there!</th></tr>\n";
}
?>
</TABLE>
<a href="#top">Top</a>
<?php
pg_close($pg_connection);
?>
<hr>
<address><a href="mailto:chenym@CMU.EDU">Yen-Ming Chen</a></address>
<!-- Created: Fri Feb 25 10:15:02 EST 2000 -->
<!-- hhmts start -->
Last modified: $Date: 2000/07/25 11:34:43 $
<!-- hhmts end -->
</body>
</html>
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed