Changeset 47 for sample/hadoop-0.16/tw/org/nchc/code/SnortParser.java

Timestamp:

Aug 8, 2008, 4:37:54 PM (17 years ago)

Author:

waue

Message:

SnortBase?.java -> tuning some field
SnortParser?.java -> debug and fix

File:

• sample/hadoop-0.16/tw/org/nchc/code/SnortParser.java (modified) (4 diffs)

sample/hadoop-0.16/tw/org/nchc/code/SnortParser.java

@@ -55 +55 @@
     case 4:
       patten_line = Pattern
-          .compile("^([^ ]*) TTL:([^ ]*) TOS:([^ ]*) ID:([^ ]*) IpLen:([^ ]*) DgmLen:([^ ]*)$");
+          .compile("^([^ ]*) [^$]*$");
+      // .compile("^([^ ]*) TTL:([^ ]*) TOS:([^ ]*) ID:([^ ]*) IpLen:([^ ]*) DgmLen:([^ ]*)$");
+
       break;
     default:
@@ -69 +71 @@
         this.logData += (data[j] + ";");
       }
-
+    }else if(i ==1 ){
+      this.logData += "0;0;0;parse error;";
+    }else if(i == 2){
+      this.logData += "Port Scan;3;";
+    }else if(i == 3){
+      this.logData += "01;01;00;00;00;error;error;";
+    }else if(i == 4){
+      this.logData += "0;";
+    }else{
+      this.logData = "*FatalError*";
     }
 
@@ -83 +94 @@
       if (line == null) {
         break;
-      }else if(line.isEmpty()){
+      } else if (line.isEmpty()) {
         fw.write(this.logData.toString() + "\n");
         this.logData = "";
-        count = 0;        
-      }else if (count < 4) {
+        count = 0;
+      } else if (count < 4) {
         // System.out.println(line);
         snortParser(line, count + 1);
@@ -100 +111 @@
   }
 
+  // 需搞定icmp ping 的格式問題
   public static void main(String[] args) throws ParseException, Exception {
-    String in = new String("/home/waue/Desktop/alert_m");
-    String ou = new String("/tmp/alert_SnortBase");
+    String in = new String("/home/waue/Desktop/alert_flex.txt");
+    String ou = new String("/home/waue/Desktop/alert_flex_parsed.txt");
     SnortParser a = new SnortParser(in, ou);
     a.parseToLine();