PRADS2SNORT(1)

📦
version 0.3.3 · 2 versions
, in debian bookworm, ubuntu jammy

💖 PRADS2SNORT 💖

okay bestie, welcome to prads2snort — section 1 of the networking manual, coming at you live. this is the lil tool that does Snort autotuning of Frag3 and Stream5, and honestly? it's giving matchmaker. let's get into it 🎀

✨ SYNOPSIS ✨

prads2snort -i /var/log/prads-asset.log -o
/etc/snort/host_attributes.xml -d linux -v

that's the whole vibe. feed it a log, tell it where to write, pick a default OS, and let it yap about what it finds. 💅

🌸 DESCRIPTION 🌸

so, PRADS stands for Passive Real-time Asset Detection System. say that three times fast, i dare you.

here's the tea: it just listens. it passively listens to network traffic and gathers info on the hosts and services it sees out there on the network. and then? you can use all that intel to map your network — so you actually know which services and hosts are alive and in use — OR you can pair it up with your fave IDS/IPS setup for that "event to host/service" correlation. it's giving teamwork. 🤝

the way it gathers info about your hosts in real-time also means you catch the assets that only pop onto the network for a short lil minute. meanwhile an active network scan (think nmap etc.) takes forever and nobody's running those continually, so that asset? missed. gone. ghosted. 💀 PRADS says "not on my watch."

and fun fact, the initial goal of implementing PRADS was to make the host_attribute_table.xml for Snort, automatically. no manual labor, no tears.

and PRADS2SNORT is the tool that does this! that's literally its whole thing. icon behavior. 👑

🦋 OPTIONS 🦋

  • -i, --infile <file> — the file you're feeding to prads2snort.pl. give it the snack. 🍓
  • -o, --outfile <file> — the file where the host_attribute data gets written (this is your host_attribute.xml). the output goes here, periodt.
  • -d, --default <os> — sets the Default OS if it's unknown. your options are linux, bsd, macos, windows. pick one bestie.
  • -v, --verbose — prints out the OS, frag, stream and confidence of the asset. yes she will overshare and we love that for her. 🙈
  • -h, --help — this help message. classic.
  • --version — shows you the prads2snort.pl version. know your queen. 👑

💀 PROBLEMS 💀

  1. Better mapping of less used apps to their correct snort attributes or drop them.

that's it. that's the list. one whole problem, and it's lowkey a to-do note.

🌈 SEE ALSO 🌈

the whole friend group. go say hi. 🫶

🎀 BUGS 🎀

found a bug? don't suffer in silence, report it here:

and for general questions:

we're nice, we promise. ✨

💜 AUTHOR 💜

edwardfjellskaal@gmail.com

GPL

that's the whole page bestie, go forth and autotune your Snort. iykyk 💖

version 0.2, dated 2010-06-21 — and that's the PRADS2SNORT(1) manual page, mwah. 😭🌸

📦 where this page comes from