Snort Statistics On-Line
Summary
\\1\\2",
"\\1\\2\\3 ",
"\\1 "
);
if(!isset($ip1)) { //init for the first time the page is loaded
$ip1='128';
$ip2='2';
$ip3='84';
$ip4='43'; /* Change this to the IP you want to watch! */
}
$Selstr="SELECT COUNT(event.cid),MIN(event.timestamp),MAX(event.timestamp) FR
OM event";
$Selstr2="SELECT DISTINCT signature FROM event";
$Selstr3="SELECT ip_src0,ip_src1,ip_src2,ip_src3 FROM iphdr GROUP BY ip_src0,
ip_src1,ip_src2,ip_src3";
$Selstr4="SELECT ip_dst0,ip_dst1,ip_dst2,ip_dst3 FROM iphdr GROUP BY ip_dst0,
ip_dst1,ip_dst2,ip_dst3";
//details of each type of events
$Selstr5="SELECT count(sid) from icmphdr";
$Selstr6="SELECT count(sid) from tcphdr";
$Selstr7="SELECT count(sid) from udphdr";
$Result=pg_exec($pg_connection,$Selstr);
$Result2=pg_exec($pg_connection,$Selstr2);
$Result3=pg_exec($pg_connection,$Selstr3);
$Result4=pg_exec($pg_connection,$Selstr4);
//details
$Result5=pg_exec($pg_connection,$Selstr5);
$Result6=pg_exec($pg_connection,$Selstr6);
$Result7=pg_exec($pg_connection,$Selstr7);
if (pg_NumRows($Result2) != 0) {
$tot_sig = pg_NumRows($Result2);
} else {
$tot_sig = 0;
}
if (pg_NumRows($Result3) != 0) {
$tot_dip = pg_NumRows($Result3);
} else {
$tot_dip = 0;
}
if (pg_NumRows($Result4) != 0) {
$tot_sip = pg_NumRows($Result4);
} else {
$tot_sip = 0;
}
$icmp = pg_result($Result5, 0, 0);
$tcp = pg_result($Result6, 0, 0);
$udp = pg_result($Result7, 0, 0);
if (pg_NumRows($Result) != 0) {
$row = pg_fetch_row($Result,0);
print "Total events: $row[0] (icmp : $icmp, udp : $udp, tcp : $tcp)Top
10 most rec
ent UDP probe reports ";
echo "Timestamp Source IP Source
Port Dest IP Dest Port Signature ";
}
else
{
echo "10 mos
t recent UDP probe reports Timestamp Source IP Sourc
e Port Dest Port Signature ";
}
if (pg_NumRows($Result) != 0) {
for ($i = 0; $i < pg_NumRows($Result); $i++ ) {
$row = pg_fetch_row($Result,$i);
$row[0]=preg_replace($pattern,$replace,$row[0]);
if(isset($show_dest))
{
print "$row[1] \n
$row[2].$row[3].$row[4].$row[5] \n
$row[10] \n
$row[6].$row[7].$row[8].$row[9] \n
$row[11] \n
$row[0] \n";
}
else
{
print "$row[1] \n
$row[2].$row[3].$row[4].$row[5] \n
$row[6] \n
$row[7] \n
$row[0] \n";
}
}
}
else {
if(isset($show_dest))
print "Nothing there! Nothing there!
Top
10 mos
t recent ICMP probe reports ";
echo "Timestamp Source IP Dest
IP Type Code Signature ";
}
else
{
echo "10 mos
t recent ICMP probe reports Timestamp Source IP Type<
/TD> Code Signature ";
}
if (pg_NumRows($Result) != 0) {
for ($i = 0; $i < pg_NumRows($Result); $i++ ) {
$row = pg_fetch_row($Result,$i);
$row[0] = preg_replace($pattern,$replace,$row[0]);
if(isset($show_dest))
{
print "$row[1] \n
$row[2].$row[3].$row[4].$row[5] \n
$row[6].$row[7].$row[8].$row[9] \n
$row[10] \n
$row[11] \n
$row[0] \n";
}
else
{
print "$row[1] \n
$row[2].$row[3].$row[4].$row[5] \n
$row[6] \n
$row[7] \n
$row[0] \n";
}
}
}
else {
if(isset($show_dest))
print "Nothing there! Nothing there!
Top
# of Reports
on each signature Numbers Signature La
test Timestamp $row[1] \n
$row[0] \n
$row[2] ";
}
}
else {
print "Nothing there!
Top
From the sam
e source IP with the same signature Reports Source IP Signature Frequency First Timestamp Latest Timestamp $row[4] \n
$row[0].$row[1].$row[2].$row[3] \n
$row[5] \n
Once every $freq seconds \n
$row[7] \n
$row[6] \n";
}
}
else {
print "Nothing there!
Top
";
echo "Type the ip adress of a computer to see details :\n ";
echo " ";
//to be sure that the type is integer, so the value will be 0 if the user's inp
ut is not an int
$ip1 = intval($ip1);
$ip2 = intval($ip2);
$ip3 = intval($ip3);
$ip4 = intval($ip4);
if( (($ip1<=0)||($ip1>255)) ||
(($ip2<=0)||($ip2>255)) ||
(($ip3<=0)||($ip3>255)) ||
(($ip4<=0)||($ip4>255)) )
{
echo "ERROR Please use integer between 0 and 255
SCANS to the specified IP ($name) "
?>
Reports started at s
ource IP last recorded timestamp Signature Frequency $row[7] \n
$row[1] \n
$row[3].$row[4].$row[5].$row[6] \n
$row[2] \n
$row[0] \n
Once every $freq seconds\n";
}
}
else {
print " Nothing there!
Top
Yen-Ming Chen