Skip to content
Web service for scanning pcaps with snort
Python HTML
Branch: master
Clone or download
Latest commit 19495e8 Jul 4, 2018
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
docs More doco tweaks. Jun 8, 2015
tests
websnort Bump version Jul 4, 2018
.gitignore Ignore .cache files Aug 27, 2016
.travis.yml Python 3.7 unsupported on trusty image Jul 3, 2018
LICENSE Initial upload Mar 1, 2014
MANIFEST.in Path typo Jun 17, 2014
README.rst
requirements-dev.txt Add sphinx documentation and fix up apidocs. Jun 8, 2015
requirements.txt Initial upload Mar 1, 2014
setup.cfg Force universal wheel Aug 27, 2016
setup.py Update supported python versions and travis/tox environments Jul 3, 2018
tox.ini Update supported python versions and travis/tox environments Jul 3, 2018

README.rst

websnort

Web service for analysing pcap files with intrusion detection systems such as snort and suricata.

Current build status Latest PyPI version

Overview

websnort provides a web interface for user and system submission of packet capture files to run against IDS instances. Alerts and details from the analysis are returned as results.

If you are after a web interface for monitoring a live snort instance, see https://www.snort.org/downloads#additional-downloads instead.

While originally developed specifically for snort. Recent releases support a flexible IDS plugin system which also supports suricata out of the box.

websnort can be configured to run the same submitted packet capture against any number of IDS instances, configs and rulesets. This allows broader coverage and comparison between installs and rule versions.

Getting Started

Ubuntu

Install snort if needed:

sudo apt-get install snort

Optional Disable running snort service if only required for this web api:

sudo service snort stop
sudo update-rc.d snort disable

On recent ubuntu/debian releases the default snort.conf is not world readable. Unless planning to run the web service as root (not recommended) you will need to modify the permissions, for example:

sudo chmod a+r /etc/snort/snort.conf

Install web service using pip:

sudo pip install websnort

Start the websnort web server on the default port:

websnort

Browse to http://server:8080 and submit a pcap file for analysis.

Navigate to http://server:8080/api for details of provided json web api.

Documentation

Full project documentation can be found on readthedocs.

Issues

Source code for websnort is hosted on GitHub. Any bug reports or feature requests can be made using GitHub's issues system.

You can’t perform that action at this time.