https://github.com/shendo/websnort

Web service for scanning pcaps with snort
https://github.com/shendo/websnort

Last synced: 25 days ago
JSON representation

Web service for scanning pcaps with snort

• Host: GitHub
• URL: https://github.com/shendo/websnort
• Owner: shendo
• License: gpl-3.0
• Created: 2014-03-01T12:38:18.000Z (almost 11 years ago)
• Default Branch: master
• Last Pushed: 2018-07-04T10:37:52.000Z (over 6 years ago)
• Last Synced: 2024-10-31T22:17:10.363Z (about 1 month ago)
• Language: Python
• Homepage: https://websnort.readthedocs.io
• Size: 300 KB
• Stars: 108
• Watchers: 7
• Forks: 14
• Open Issues: 1
• Metadata Files:
  • Readme: README.rst
  • License: LICENSE

Awesome Lists containing this project

• awesome-network-stuff - **79**星

README

        
websnort

========

Web service for analysing pcap files with intrusion detection systems such as

``snort`` and ``suricata``.

|build_status| |pypi_version|

Overview

--------

``websnort`` provides a web interface for user and system submission of packet

capture files to run against IDS instances.  Alerts and details from the analysis

are returned as results.

If you are after a web interface for monitoring a live ``snort`` instance,

see https://www.snort.org/downloads#additional-downloads instead.

While originally developed specifically for ``snort``.  Recent releases support

a flexible IDS plugin system which also supports ``suricata`` out of the box.

``websnort`` can be configured to run the same submitted packet capture

against any number of IDS instances, configs and rulesets.  This allows broader

coverage and comparison between installs and rule versions.

Getting Started

---------------

**Ubuntu**

Install ``snort`` if needed: ::

    sudo apt-get install snort

    

*Optional* Disable running snort service if only required for this web api: ::

    sudo service snort stop

    sudo update-rc.d snort disable

On recent ubuntu/debian releases the default *snort.conf* is not world readable.  Unless 

planning to run the web service as root (not recommended) you will need to modify the

permissions, for example: ::

	sudo chmod a+r /etc/snort/snort.conf

Install web service using ``pip``: ::

	sudo pip install websnort

Start the ``websnort`` web server on the default port: ::

	websnort

Browse to http://server:8080 and submit a pcap file for analysis.

Navigate to http://server:8080/api for details of provided json web api.

Documentation

-------------

Full project documentation can be found on `readthedocs`_.

Issues

------

Source code for ``websnort`` is hosted on `GitHub`_. Any bug reports or feature

requests can be made using GitHub's `issues system`_.

.. _GitHub: https://github.com/shendo/websnort

.. _issues system: https://github.com/shendo/websnort/issues

.. _readthedocs: https://websnort.readthedocs.org

.. |build_status| image:: https://secure.travis-ci.org/shendo/websnort.png?branch=master

   :target: https://travis-ci.org/shendo/websnort

   :alt: Current build status

.. |pypi_version| image:: https://img.shields.io/pypi/v/websnort.svg

   :target: https://pypi.python.org/pypi/websnort

   :alt: Latest PyPI version