Add ports number for IP src and IP dst

[Hmarionx]

Hi,
Finally a good web ui for snort, working with PHP7 👍 Great Dashboard and nice graphics !
I have quickly modified source code for getting ports with dest and src IP. So, if you're interested.

events.php :
".$event['ip_src'].':'.$event['tcp_sport'].$event['udp_sport']."
".$event['ip_dst'].':'.$event['tcp_dport'].$event['udp_dport']."

db.php :
$sql = "SELECT event.sid, event.cid, sig_name, DATE_FORMAT(timestamp, '%d-%m-%Y') AS date, DATE_FORMAT(timestamp, '%H:%i') AS time, sig_priority, inet_ntoa(ip_src) as ip_src, inet_ntoa(ip_dst) as ip_dst, tcp_sport, tcp_dport, udp_sport, udp_dport
FROM event
INNER JOIN signature on event.signature = signature.sig_id
INNER JOIN iphdr on event.sid = iphdr.sid AND event.cid = iphdr.cid
LEFT JOIN tcphdr on event.sid = tcphdr.sid AND event.cid = tcphdr.cid
LEFT JOIN udphdr on event.sid = udphdr.sid AND event.cid = udphdr.cid

Need to adjust the CSS for better rendering...

Good working :-)

[Ejdamm]

Hi!
I'm glad you like it :)
I have actually thought of that but putting it in the extended info that appears when you click on an event. There will also be other info about the TCP/IP packets. What do you think about that? I'm away this weekend but will try to implement it next week. It will be easier to find motivation now when I know someone likes it.

[Hmarionx]

Yes, I think it will be great to have ports and other informations in the extended view for each events.
You can find here my (big) wishlist :-)

• Extend events with all information from the mysql snort DB for each events
• Link the src IP to open AbuseIPDB or other security website
• Link the SIG id to the snort db knowledge
• Filter events by date / ip src / ip dest / ports / severity
• Refresh number of alerts in the dashboard when selecting different view (24h / week / month / year)
• A login page for authenticiate user (the snort user in the mysql DB for example)
  I'm not a good PHP developper, but have lot of ideas :-)

Pick up from my wishlist, as you want and as you can !

[Ejdamm]

I close this issue now since displaying ports are implemented but your wishlist is noted and will be processed.