Snort App -- 'Snort event search' doesn't search all data

[tammi8]

When I click on 'Search', for example the last 15 mins, I see all alerts but 'Snort event search' only allows me to search for a subset of the data. For example I have test rule triggering on ICMP traffic. I have the traffic I am generating by ping command as well as network traffic being generated by running applications. I see all the alerts being created in my Barnyard logs and in Splunk when I use 'Search' but when I click on 'Snort event search', I am only able to see the traffic being generated by the running applications. None of the ping traffic I am generated is searchable in that window.

Am I missing something or is this broken?

Any help appreciated.

[Ayn · Accepted solution]

This is an issue in the app that I've been meaning to address. The search form takes user input, among other things source port and destination port. Default value for these is "*". So if a user simply just uses default values, the search that is created contains among other things src_port=* and dest_port=*, respectively. Splunk interprets this (correctly) as that the src_port and dest_port fields can have any value, as long as they exist in the event. This has the implication that events that do not have source ports and destination ports (such as events related to ICMP data) will not match.

So no, you're not missing something and yes, it is broken. There are ways of addressing this issue, I just frankly forgot to do it. Thanks for the reminder. I'll post an updated version of the app shortly.

[tammi8]

Awesome. Thanks for the quick and detailed response.