rendered paste bodyI'm having this problem with MySQL and I can't figure it out. I'm hoping someone else can.
Here is my select statement, it grabs it from a bunch of different snort tables and gives me the data I need.
mysql> select signature.sig_name, signature.sig_id, iphdr.ip_src,iphdr.ip_dst, event.cid FROM signature,event,iphdr where signature.sig_id = event.signature AND iphdr.cid = event.cid;
+------------------------------------------------------------+--------+------------+------------+---------+
| sig_name | sig_id | ip_src | ip_dst | cid |
+------------------------------------------------------------+--------+------------+------------+---------+
| BLEEDING-EDGE POLICY SSH session in progress on usual Port | 509 | 3232236183 | 1122750440 | 1530172 |
+------------------------------------------------------------+--------+------------+------------+---------+
1 row in set (0.00 sec)
However, it's missing a bunch of stuff. There's 4 lines in snort right now, but it only see's one. Here is the breakdown.
mysql> select * from event;
+-----+---------+-----------+---------------------+
| sid | cid | signature | timestamp |
+-----+---------+-----------+---------------------+
| 2 | 1530123 | 20 | 2006-11-27 08:36:21 |
| 2 | 1530124 | 20 | 2006-11-27 08:36:23 |
| 2 | 1530125 | 237 | 2006-11-27 08:36:25 |
| 2 | 1530126 | 255 | 2006-11-27 08:36:26 |
| 2 | 1530127 | 488 | 2006-11-27 08:36:30 |
| 2 | 1530172 | 509 | 2006-11-27 08:39:09 |
+-----+---------+-----------+---------------------+
6 rows in set (0.00 sec)
mysql> select * from signature;
+--------+-------------------------------------------------------------------------+--------------+--------------+---------+---------+---------+
| sig_id | sig_name | sig_class_id | sig_priority | sig_rev | sig_sid | sig_gid |
+--------+-------------------------------------------------------------------------+--------------+--------------+---------+---------+---------+
| 499 | BLEEDING-EDGE POLICY Winamp Streaming User Agent | 18 | 1 | 1 | 2003168 | NULL |
| 500 | BLEEDING-EDGE POLICY TLS/SSL Encrypted Application Data on Unusual Port | 20 | 2 | 5 | 2003020 | NULL |
| 501 | (http_inspect) BARE BYTE UNICODE ENCODING | 0 | 3 | 1 | 4 | NULL |
| 502 | BLEEDING-EDGE POLICY Gmail Message Send | 18 | 1 | 4 | 2001426 | NULL |
| 503 | (portscan) TCP Portsweep | 0 | 3 | NULL | 3 | NULL |
| 504 | (http_inspect) OVERSIZE REQUEST-URI DIRECTORY | 0 | 3 | 1 | 15 | NULL |
| 505 | INFO web bug 0x0 gif attempt | 9 | 3 | 3 | 2925 | NULL |
| 506 | (http_inspect) DOUBLE DECODING ATTACK | 0 | 3 | 1 | 2 | NULL |
| 507 | BLEEDING-EDGE POLICY iTunes User Agent | 18 | 1 | 2 | 2002878 | NULL |
| 508 | BLEEDING-EDGE POLICY SSH session in progress on Unusual Port | 9 | 3 | 4 | 2001984 | NULL |
| 509 | BLEEDING-EDGE POLICY SSH session in progress on usual Port | 9 | 3 | 4 | 2001978 | NULL |
+--------+-------------------------------------------------------------------------+--------------+--------------+---------+---------+---------+
11 rows in set (0.00 sec)
mysql> select * from iphdr;
+-----+---------+------------+------------+--------+---------+--------+--------+-------+----------+--------+--------+----------+---------+
| sid | cid | ip_src | ip_dst | ip_ver | ip_hlen | ip_tos | ip_len | ip_id | ip_flags | ip_off | ip_ttl | ip_proto | ip_csum |
+-----+---------+------------+------------+--------+---------+--------+--------+-------+----------+--------+--------+----------+---------+
| 2 | 1530125 | 1209420570 | 3232236056 | 4 | 5 | 0 | 1500 | 23127 | 0 | 0 | 120 | 6 | 19668 |
| 2 | 1530126 | 3628685108 | 3232236050 | 4 | 5 | 0 | 190 | 51623 | 0 | 0 | 118 | 6 | 18522 |
| 2 | 1530127 | 3232236111 | 1089217591 | 4 | 5 | 0 | 166 | 39161 | 0 | 0 | 128 | 6 | 14654 |
| 2 | 1530172 | 3232236183 | 1122750440 | 4 | 5 | 0 | 40 | 17099 | 0 | 0 | 128 | 6 | 57841 |
+-----+---------+------------+------------+--------+---------+--------+--------+-------+----------+--------+--------+----------+---------+
4 rows in set (0.00 sec)