Home Mudpit Project License Sourceforge |
What is Mudpit?BackgroundThe unified plugin allows Snort to write its alerts and logs into continuous binary files spending no time on binary->text conversions usually performed during alert/log generation process. This feature has a potential to greatly improve Snort's performance/stability, especially if events are collected in a remote relational database. The ProblemSnort has two separate output streams: alert and log. Alerts contain brief description of what's happened. Logs, on the other hand, provide full information about event, but usually are generated less often than alerts. There is no magic Snort parameter allowing one to get all the required information in one stream. With unified plugin you also get two streams; by ignoring one of them you will lose quality or quantity. In general, Snort unified plugin can be configured to produce alert and log files simultaneously, but some events would be duplicated in both files having different level of details. Existing SolutionsThere are programs out there that can read and process files written in Snort's unified format. Most notable project with similar goals is Barnyard. To the best of our knowlegdge, none of the existing programs satisfies requirements for single complete source of output information suitable for event monitoring. MudPitMudpit has been written to satisfy people's needs for the intelligent, modular and reliable processor for Snort's unified format. The following Mudpit features make it exceptionally useful in Snort-based IDS devices hosted on Linux/UNIX:
DetailsMudpit utilizes well-known UNIX parent/child technique to achieve required reliability. Each child process works as a separate Snort spool processor. It reads an alert/log file pair in the specific spool directory and sends an event data to output plugins. Output plugins are implemented as UNIX shared modules and are dynamically loaded by each spool processor at initialization time. Each plugin should export the following set of functions:
See Important NoteIn order for Mudpit to work correctly, Snort should have BOTH unified alert and unified log plugins active. Supported PlatformsCurrently, Linux RH7.3 is the only platform we used for testing. There should be no significant problems to compile/run Mudpit in any modern UNIX environment. Real problems await those who will try to port it to MSWin or MAC OSes v.X. Contributors
|