├── .gitattributes ├── .gitignore ├── LICENSE ├── README.md ├── S82suricata ├── suricata.yaml ├── suricata_log.sh ├── suricata_manager.sh ├── suricata_stats.sh ├── suricata_update.sh └── suricatastats_www.asp /.gitattributes: -------------------------------------------------------------------------------- 1 | *.md text eol=lf 2 | *.sh text eol=lf 3 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | *.tags 2 | *.tags1 3 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | GNU GENERAL PUBLIC LICENSE 2 | Version 3, 29 June 2007 3 | 4 | Copyright (C) 2007 Free Software Foundation, Inc. 5 | Everyone is permitted to copy and distribute verbatim copies 6 | of this license document, but changing it is not allowed. 7 | 8 | Preamble 9 | 10 | The GNU General Public License is a free, copyleft license for 11 | software and other kinds of works. 12 | 13 | The licenses for most software and other practical works are designed 14 | to take away your freedom to share and change the works. By contrast, 15 | the GNU General Public License is intended to guarantee your freedom to 16 | share and change all versions of a program--to make sure it remains free 17 | software for all its users. We, the Free Software Foundation, use the 18 | GNU General Public License for most of our software; it applies also to 19 | any other work released this way by its authors. You can apply it to 20 | your programs, too. 21 | 22 | When we speak of free software, we are referring to freedom, not 23 | price. Our General Public Licenses are designed to make sure that you 24 | have the freedom to distribute copies of free software (and charge for 25 | them if you wish), that you receive source code or can get it if you 26 | want it, that you can change the software or use pieces of it in new 27 | free programs, and that you know you can do these things. 28 | 29 | To protect your rights, we need to prevent others from denying you 30 | these rights or asking you to surrender the rights. Therefore, you have 31 | certain responsibilities if you distribute copies of the software, or if 32 | you modify it: responsibilities to respect the freedom of others. 33 | 34 | For example, if you distribute copies of such a program, whether 35 | gratis or for a fee, you must pass on to the recipients the same 36 | freedoms that you received. You must make sure that they, too, receive 37 | or can get the source code. And you must show them these terms so they 38 | know their rights. 39 | 40 | Developers that use the GNU GPL protect your rights with two steps: 41 | (1) assert copyright on the software, and (2) offer you this License 42 | giving you legal permission to copy, distribute and/or modify it. 43 | 44 | For the developers' and authors' protection, the GPL clearly explains 45 | that there is no warranty for this free software. For both users' and 46 | authors' sake, the GPL requires that modified versions be marked as 47 | changed, so that their problems will not be attributed erroneously to 48 | authors of previous versions. 49 | 50 | Some devices are designed to deny users access to install or run 51 | modified versions of the software inside them, although the manufacturer 52 | can do so. This is fundamentally incompatible with the aim of 53 | protecting users' freedom to change the software. The systematic 54 | pattern of such abuse occurs in the area of products for individuals to 55 | use, which is precisely where it is most unacceptable. Therefore, we 56 | have designed this version of the GPL to prohibit the practice for those 57 | products. If such problems arise substantially in other domains, we 58 | stand ready to extend this provision to those domains in future versions 59 | of the GPL, as needed to protect the freedom of users. 60 | 61 | Finally, every program is threatened constantly by software patents. 62 | States should not allow patents to restrict development and use of 63 | software on general-purpose computers, but in those that do, we wish to 64 | avoid the special danger that patents applied to a free program could 65 | make it effectively proprietary. To prevent this, the GPL assures that 66 | patents cannot be used to render the program non-free. 67 | 68 | The precise terms and conditions for copying, distribution and 69 | modification follow. 70 | 71 | TERMS AND CONDITIONS 72 | 73 | 0. Definitions. 74 | 75 | "This License" refers to version 3 of the GNU General Public License. 76 | 77 | "Copyright" also means copyright-like laws that apply to other kinds of 78 | works, such as semiconductor masks. 79 | 80 | "The Program" refers to any copyrightable work licensed under this 81 | License. Each licensee is addressed as "you". "Licensees" and 82 | "recipients" may be individuals or organizations. 83 | 84 | To "modify" a work means to copy from or adapt all or part of the work 85 | in a fashion requiring copyright permission, other than the making of an 86 | exact copy. The resulting work is called a "modified version" of the 87 | earlier work or a work "based on" the earlier work. 88 | 89 | A "covered work" means either the unmodified Program or a work based 90 | on the Program. 91 | 92 | To "propagate" a work means to do anything with it that, without 93 | permission, would make you directly or secondarily liable for 94 | infringement under applicable copyright law, except executing it on a 95 | computer or modifying a private copy. Propagation includes copying, 96 | distribution (with or without modification), making available to the 97 | public, and in some countries other activities as well. 98 | 99 | To "convey" a work means any kind of propagation that enables other 100 | parties to make or receive copies. Mere interaction with a user through 101 | a computer network, with no transfer of a copy, is not conveying. 102 | 103 | An interactive user interface displays "Appropriate Legal Notices" 104 | to the extent that it includes a convenient and prominently visible 105 | feature that (1) displays an appropriate copyright notice, and (2) 106 | tells the user that there is no warranty for the work (except to the 107 | extent that warranties are provided), that licensees may convey the 108 | work under this License, and how to view a copy of this License. If 109 | the interface presents a list of user commands or options, such as a 110 | menu, a prominent item in the list meets this criterion. 111 | 112 | 1. Source Code. 113 | 114 | The "source code" for a work means the preferred form of the work 115 | for making modifications to it. "Object code" means any non-source 116 | form of a work. 117 | 118 | A "Standard Interface" means an interface that either is an official 119 | standard defined by a recognized standards body, or, in the case of 120 | interfaces specified for a particular programming language, one that 121 | is widely used among developers working in that language. 122 | 123 | The "System Libraries" of an executable work include anything, other 124 | than the work as a whole, that (a) is included in the normal form of 125 | packaging a Major Component, but which is not part of that Major 126 | Component, and (b) serves only to enable use of the work with that 127 | Major Component, or to implement a Standard Interface for which an 128 | implementation is available to the public in source code form. A 129 | "Major Component", in this context, means a major essential component 130 | (kernel, window system, and so on) of the specific operating system 131 | (if any) on which the executable work runs, or a compiler used to 132 | produce the work, or an object code interpreter used to run it. 133 | 134 | The "Corresponding Source" for a work in object code form means all 135 | the source code needed to generate, install, and (for an executable 136 | work) run the object code and to modify the work, including scripts to 137 | control those activities. However, it does not include the work's 138 | System Libraries, or general-purpose tools or generally available free 139 | programs which are used unmodified in performing those activities but 140 | which are not part of the work. For example, Corresponding Source 141 | includes interface definition files associated with source files for 142 | the work, and the source code for shared libraries and dynamically 143 | linked subprograms that the work is specifically designed to require, 144 | such as by intimate data communication or control flow between those 145 | subprograms and other parts of the work. 146 | 147 | The Corresponding Source need not include anything that users 148 | can regenerate automatically from other parts of the Corresponding 149 | Source. 150 | 151 | The Corresponding Source for a work in source code form is that 152 | same work. 153 | 154 | 2. Basic Permissions. 155 | 156 | All rights granted under this License are granted for the term of 157 | copyright on the Program, and are irrevocable provided the stated 158 | conditions are met. This License explicitly affirms your unlimited 159 | permission to run the unmodified Program. The output from running a 160 | covered work is covered by this License only if the output, given its 161 | content, constitutes a covered work. This License acknowledges your 162 | rights of fair use or other equivalent, as provided by copyright law. 163 | 164 | You may make, run and propagate covered works that you do not 165 | convey, without conditions so long as your license otherwise remains 166 | in force. You may convey covered works to others for the sole purpose 167 | of having them make modifications exclusively for you, or provide you 168 | with facilities for running those works, provided that you comply with 169 | the terms of this License in conveying all material for which you do 170 | not control copyright. Those thus making or running the covered works 171 | for you must do so exclusively on your behalf, under your direction 172 | and control, on terms that prohibit them from making any copies of 173 | your copyrighted material outside their relationship with you. 174 | 175 | Conveying under any other circumstances is permitted solely under 176 | the conditions stated below. Sublicensing is not allowed; section 10 177 | makes it unnecessary. 178 | 179 | 3. Protecting Users' Legal Rights From Anti-Circumvention Law. 180 | 181 | No covered work shall be deemed part of an effective technological 182 | measure under any applicable law fulfilling obligations under article 183 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or 184 | similar laws prohibiting or restricting circumvention of such 185 | measures. 186 | 187 | When you convey a covered work, you waive any legal power to forbid 188 | circumvention of technological measures to the extent such circumvention 189 | is effected by exercising rights under this License with respect to 190 | the covered work, and you disclaim any intention to limit operation or 191 | modification of the work as a means of enforcing, against the work's 192 | users, your or third parties' legal rights to forbid circumvention of 193 | technological measures. 194 | 195 | 4. Conveying Verbatim Copies. 196 | 197 | You may convey verbatim copies of the Program's source code as you 198 | receive it, in any medium, provided that you conspicuously and 199 | appropriately publish on each copy an appropriate copyright notice; 200 | keep intact all notices stating that this License and any 201 | non-permissive terms added in accord with section 7 apply to the code; 202 | keep intact all notices of the absence of any warranty; and give all 203 | recipients a copy of this License along with the Program. 204 | 205 | You may charge any price or no price for each copy that you convey, 206 | and you may offer support or warranty protection for a fee. 207 | 208 | 5. Conveying Modified Source Versions. 209 | 210 | You may convey a work based on the Program, or the modifications to 211 | produce it from the Program, in the form of source code under the 212 | terms of section 4, provided that you also meet all of these conditions: 213 | 214 | a) The work must carry prominent notices stating that you modified 215 | it, and giving a relevant date. 216 | 217 | b) The work must carry prominent notices stating that it is 218 | released under this License and any conditions added under section 219 | 7. This requirement modifies the requirement in section 4 to 220 | "keep intact all notices". 221 | 222 | c) You must license the entire work, as a whole, under this 223 | License to anyone who comes into possession of a copy. This 224 | License will therefore apply, along with any applicable section 7 225 | additional terms, to the whole of the work, and all its parts, 226 | regardless of how they are packaged. This License gives no 227 | permission to license the work in any other way, but it does not 228 | invalidate such permission if you have separately received it. 229 | 230 | d) If the work has interactive user interfaces, each must display 231 | Appropriate Legal Notices; however, if the Program has interactive 232 | interfaces that do not display Appropriate Legal Notices, your 233 | work need not make them do so. 234 | 235 | A compilation of a covered work with other separate and independent 236 | works, which are not by their nature extensions of the covered work, 237 | and which are not combined with it such as to form a larger program, 238 | in or on a volume of a storage or distribution medium, is called an 239 | "aggregate" if the compilation and its resulting copyright are not 240 | used to limit the access or legal rights of the compilation's users 241 | beyond what the individual works permit. Inclusion of a covered work 242 | in an aggregate does not cause this License to apply to the other 243 | parts of the aggregate. 244 | 245 | 6. Conveying Non-Source Forms. 246 | 247 | You may convey a covered work in object code form under the terms 248 | of sections 4 and 5, provided that you also convey the 249 | machine-readable Corresponding Source under the terms of this License, 250 | in one of these ways: 251 | 252 | a) Convey the object code in, or embodied in, a physical product 253 | (including a physical distribution medium), accompanied by the 254 | Corresponding Source fixed on a durable physical medium 255 | customarily used for software interchange. 256 | 257 | b) Convey the object code in, or embodied in, a physical product 258 | (including a physical distribution medium), accompanied by a 259 | written offer, valid for at least three years and valid for as 260 | long as you offer spare parts or customer support for that product 261 | model, to give anyone who possesses the object code either (1) a 262 | copy of the Corresponding Source for all the software in the 263 | product that is covered by this License, on a durable physical 264 | medium customarily used for software interchange, for a price no 265 | more than your reasonable cost of physically performing this 266 | conveying of source, or (2) access to copy the 267 | Corresponding Source from a network server at no charge. 268 | 269 | c) Convey individual copies of the object code with a copy of the 270 | written offer to provide the Corresponding Source. This 271 | alternative is allowed only occasionally and noncommercially, and 272 | only if you received the object code with such an offer, in accord 273 | with subsection 6b. 274 | 275 | d) Convey the object code by offering access from a designated 276 | place (gratis or for a charge), and offer equivalent access to the 277 | Corresponding Source in the same way through the same place at no 278 | further charge. You need not require recipients to copy the 279 | Corresponding Source along with the object code. If the place to 280 | copy the object code is a network server, the Corresponding Source 281 | may be on a different server (operated by you or a third party) 282 | that supports equivalent copying facilities, provided you maintain 283 | clear directions next to the object code saying where to find the 284 | Corresponding Source. Regardless of what server hosts the 285 | Corresponding Source, you remain obligated to ensure that it is 286 | available for as long as needed to satisfy these requirements. 287 | 288 | e) Convey the object code using peer-to-peer transmission, provided 289 | you inform other peers where the object code and Corresponding 290 | Source of the work are being offered to the general public at no 291 | charge under subsection 6d. 292 | 293 | A separable portion of the object code, whose source code is excluded 294 | from the Corresponding Source as a System Library, need not be 295 | included in conveying the object code work. 296 | 297 | A "User Product" is either (1) a "consumer product", which means any 298 | tangible personal property which is normally used for personal, family, 299 | or household purposes, or (2) anything designed or sold for incorporation 300 | into a dwelling. In determining whether a product is a consumer product, 301 | doubtful cases shall be resolved in favor of coverage. For a particular 302 | product received by a particular user, "normally used" refers to a 303 | typical or common use of that class of product, regardless of the status 304 | of the particular user or of the way in which the particular user 305 | actually uses, or expects or is expected to use, the product. A product 306 | is a consumer product regardless of whether the product has substantial 307 | commercial, industrial or non-consumer uses, unless such uses represent 308 | the only significant mode of use of the product. 309 | 310 | "Installation Information" for a User Product means any methods, 311 | procedures, authorization keys, or other information required to install 312 | and execute modified versions of a covered work in that User Product from 313 | a modified version of its Corresponding Source. The information must 314 | suffice to ensure that the continued functioning of the modified object 315 | code is in no case prevented or interfered with solely because 316 | modification has been made. 317 | 318 | If you convey an object code work under this section in, or with, or 319 | specifically for use in, a User Product, and the conveying occurs as 320 | part of a transaction in which the right of possession and use of the 321 | User Product is transferred to the recipient in perpetuity or for a 322 | fixed term (regardless of how the transaction is characterized), the 323 | Corresponding Source conveyed under this section must be accompanied 324 | by the Installation Information. But this requirement does not apply 325 | if neither you nor any third party retains the ability to install 326 | modified object code on the User Product (for example, the work has 327 | been installed in ROM). 328 | 329 | The requirement to provide Installation Information does not include a 330 | requirement to continue to provide support service, warranty, or updates 331 | for a work that has been modified or installed by the recipient, or for 332 | the User Product in which it has been modified or installed. Access to a 333 | network may be denied when the modification itself materially and 334 | adversely affects the operation of the network or violates the rules and 335 | protocols for communication across the network. 336 | 337 | Corresponding Source conveyed, and Installation Information provided, 338 | in accord with this section must be in a format that is publicly 339 | documented (and with an implementation available to the public in 340 | source code form), and must require no special password or key for 341 | unpacking, reading or copying. 342 | 343 | 7. Additional Terms. 344 | 345 | "Additional permissions" are terms that supplement the terms of this 346 | License by making exceptions from one or more of its conditions. 347 | Additional permissions that are applicable to the entire Program shall 348 | be treated as though they were included in this License, to the extent 349 | that they are valid under applicable law. If additional permissions 350 | apply only to part of the Program, that part may be used separately 351 | under those permissions, but the entire Program remains governed by 352 | this License without regard to the additional permissions. 353 | 354 | When you convey a copy of a covered work, you may at your option 355 | remove any additional permissions from that copy, or from any part of 356 | it. (Additional permissions may be written to require their own 357 | removal in certain cases when you modify the work.) You may place 358 | additional permissions on material, added by you to a covered work, 359 | for which you have or can give appropriate copyright permission. 360 | 361 | Notwithstanding any other provision of this License, for material you 362 | add to a covered work, you may (if authorized by the copyright holders of 363 | that material) supplement the terms of this License with terms: 364 | 365 | a) Disclaiming warranty or limiting liability differently from the 366 | terms of sections 15 and 16 of this License; or 367 | 368 | b) Requiring preservation of specified reasonable legal notices or 369 | author attributions in that material or in the Appropriate Legal 370 | Notices displayed by works containing it; or 371 | 372 | c) Prohibiting misrepresentation of the origin of that material, or 373 | requiring that modified versions of such material be marked in 374 | reasonable ways as different from the original version; or 375 | 376 | d) Limiting the use for publicity purposes of names of licensors or 377 | authors of the material; or 378 | 379 | e) Declining to grant rights under trademark law for use of some 380 | trade names, trademarks, or service marks; or 381 | 382 | f) Requiring indemnification of licensors and authors of that 383 | material by anyone who conveys the material (or modified versions of 384 | it) with contractual assumptions of liability to the recipient, for 385 | any liability that these contractual assumptions directly impose on 386 | those licensors and authors. 387 | 388 | All other non-permissive additional terms are considered "further 389 | restrictions" within the meaning of section 10. If the Program as you 390 | received it, or any part of it, contains a notice stating that it is 391 | governed by this License along with a term that is a further 392 | restriction, you may remove that term. If a license document contains 393 | a further restriction but permits relicensing or conveying under this 394 | License, you may add to a covered work material governed by the terms 395 | of that license document, provided that the further restriction does 396 | not survive such relicensing or conveying. 397 | 398 | If you add terms to a covered work in accord with this section, you 399 | must place, in the relevant source files, a statement of the 400 | additional terms that apply to those files, or a notice indicating 401 | where to find the applicable terms. 402 | 403 | Additional terms, permissive or non-permissive, may be stated in the 404 | form of a separately written license, or stated as exceptions; 405 | the above requirements apply either way. 406 | 407 | 8. Termination. 408 | 409 | You may not propagate or modify a covered work except as expressly 410 | provided under this License. Any attempt otherwise to propagate or 411 | modify it is void, and will automatically terminate your rights under 412 | this License (including any patent licenses granted under the third 413 | paragraph of section 11). 414 | 415 | However, if you cease all violation of this License, then your 416 | license from a particular copyright holder is reinstated (a) 417 | provisionally, unless and until the copyright holder explicitly and 418 | finally terminates your license, and (b) permanently, if the copyright 419 | holder fails to notify you of the violation by some reasonable means 420 | prior to 60 days after the cessation. 421 | 422 | Moreover, your license from a particular copyright holder is 423 | reinstated permanently if the copyright holder notifies you of the 424 | violation by some reasonable means, this is the first time you have 425 | received notice of violation of this License (for any work) from that 426 | copyright holder, and you cure the violation prior to 30 days after 427 | your receipt of the notice. 428 | 429 | Termination of your rights under this section does not terminate the 430 | licenses of parties who have received copies or rights from you under 431 | this License. If your rights have been terminated and not permanently 432 | reinstated, you do not qualify to receive new licenses for the same 433 | material under section 10. 434 | 435 | 9. Acceptance Not Required for Having Copies. 436 | 437 | You are not required to accept this License in order to receive or 438 | run a copy of the Program. Ancillary propagation of a covered work 439 | occurring solely as a consequence of using peer-to-peer transmission 440 | to receive a copy likewise does not require acceptance. However, 441 | nothing other than this License grants you permission to propagate or 442 | modify any covered work. These actions infringe copyright if you do 443 | not accept this License. Therefore, by modifying or propagating a 444 | covered work, you indicate your acceptance of this License to do so. 445 | 446 | 10. Automatic Licensing of Downstream Recipients. 447 | 448 | Each time you convey a covered work, the recipient automatically 449 | receives a license from the original licensors, to run, modify and 450 | propagate that work, subject to this License. You are not responsible 451 | for enforcing compliance by third parties with this License. 452 | 453 | An "entity transaction" is a transaction transferring control of an 454 | organization, or substantially all assets of one, or subdividing an 455 | organization, or merging organizations. If propagation of a covered 456 | work results from an entity transaction, each party to that 457 | transaction who receives a copy of the work also receives whatever 458 | licenses to the work the party's predecessor in interest had or could 459 | give under the previous paragraph, plus a right to possession of the 460 | Corresponding Source of the work from the predecessor in interest, if 461 | the predecessor has it or can get it with reasonable efforts. 462 | 463 | You may not impose any further restrictions on the exercise of the 464 | rights granted or affirmed under this License. For example, you may 465 | not impose a license fee, royalty, or other charge for exercise of 466 | rights granted under this License, and you may not initiate litigation 467 | (including a cross-claim or counterclaim in a lawsuit) alleging that 468 | any patent claim is infringed by making, using, selling, offering for 469 | sale, or importing the Program or any portion of it. 470 | 471 | 11. Patents. 472 | 473 | A "contributor" is a copyright holder who authorizes use under this 474 | License of the Program or a work on which the Program is based. The 475 | work thus licensed is called the contributor's "contributor version". 476 | 477 | A contributor's "essential patent claims" are all patent claims 478 | owned or controlled by the contributor, whether already acquired or 479 | hereafter acquired, that would be infringed by some manner, permitted 480 | by this License, of making, using, or selling its contributor version, 481 | but do not include claims that would be infringed only as a 482 | consequence of further modification of the contributor version. For 483 | purposes of this definition, "control" includes the right to grant 484 | patent sublicenses in a manner consistent with the requirements of 485 | this License. 486 | 487 | Each contributor grants you a non-exclusive, worldwide, royalty-free 488 | patent license under the contributor's essential patent claims, to 489 | make, use, sell, offer for sale, import and otherwise run, modify and 490 | propagate the contents of its contributor version. 491 | 492 | In the following three paragraphs, a "patent license" is any express 493 | agreement or commitment, however denominated, not to enforce a patent 494 | (such as an express permission to practice a patent or covenant not to 495 | sue for patent infringement). To "grant" such a patent license to a 496 | party means to make such an agreement or commitment not to enforce a 497 | patent against the party. 498 | 499 | If you convey a covered work, knowingly relying on a patent license, 500 | and the Corresponding Source of the work is not available for anyone 501 | to copy, free of charge and under the terms of this License, through a 502 | publicly available network server or other readily accessible means, 503 | then you must either (1) cause the Corresponding Source to be so 504 | available, or (2) arrange to deprive yourself of the benefit of the 505 | patent license for this particular work, or (3) arrange, in a manner 506 | consistent with the requirements of this License, to extend the patent 507 | license to downstream recipients. "Knowingly relying" means you have 508 | actual knowledge that, but for the patent license, your conveying the 509 | covered work in a country, or your recipient's use of the covered work 510 | in a country, would infringe one or more identifiable patents in that 511 | country that you have reason to believe are valid. 512 | 513 | If, pursuant to or in connection with a single transaction or 514 | arrangement, you convey, or propagate by procuring conveyance of, a 515 | covered work, and grant a patent license to some of the parties 516 | receiving the covered work authorizing them to use, propagate, modify 517 | or convey a specific copy of the covered work, then the patent license 518 | you grant is automatically extended to all recipients of the covered 519 | work and works based on it. 520 | 521 | A patent license is "discriminatory" if it does not include within 522 | the scope of its coverage, prohibits the exercise of, or is 523 | conditioned on the non-exercise of one or more of the rights that are 524 | specifically granted under this License. You may not convey a covered 525 | work if you are a party to an arrangement with a third party that is 526 | in the business of distributing software, under which you make payment 527 | to the third party based on the extent of your activity of conveying 528 | the work, and under which the third party grants, to any of the 529 | parties who would receive the covered work from you, a discriminatory 530 | patent license (a) in connection with copies of the covered work 531 | conveyed by you (or copies made from those copies), or (b) primarily 532 | for and in connection with specific products or compilations that 533 | contain the covered work, unless you entered into that arrangement, 534 | or that patent license was granted, prior to 28 March 2007. 535 | 536 | Nothing in this License shall be construed as excluding or limiting 537 | any implied license or other defenses to infringement that may 538 | otherwise be available to you under applicable patent law. 539 | 540 | 12. No Surrender of Others' Freedom. 541 | 542 | If conditions are imposed on you (whether by court order, agreement or 543 | otherwise) that contradict the conditions of this License, they do not 544 | excuse you from the conditions of this License. If you cannot convey a 545 | covered work so as to satisfy simultaneously your obligations under this 546 | License and any other pertinent obligations, then as a consequence you may 547 | not convey it at all. For example, if you agree to terms that obligate you 548 | to collect a royalty for further conveying from those to whom you convey 549 | the Program, the only way you could satisfy both those terms and this 550 | License would be to refrain entirely from conveying the Program. 551 | 552 | 13. Use with the GNU Affero General Public License. 553 | 554 | Notwithstanding any other provision of this License, you have 555 | permission to link or combine any covered work with a work licensed 556 | under version 3 of the GNU Affero General Public License into a single 557 | combined work, and to convey the resulting work. The terms of this 558 | License will continue to apply to the part which is the covered work, 559 | but the special requirements of the GNU Affero General Public License, 560 | section 13, concerning interaction through a network will apply to the 561 | combination as such. 562 | 563 | 14. Revised Versions of this License. 564 | 565 | The Free Software Foundation may publish revised and/or new versions of 566 | the GNU General Public License from time to time. Such new versions will 567 | be similar in spirit to the present version, but may differ in detail to 568 | address new problems or concerns. 569 | 570 | Each version is given a distinguishing version number. If the 571 | Program specifies that a certain numbered version of the GNU General 572 | Public License "or any later version" applies to it, you have the 573 | option of following the terms and conditions either of that numbered 574 | version or of any later version published by the Free Software 575 | Foundation. If the Program does not specify a version number of the 576 | GNU General Public License, you may choose any version ever published 577 | by the Free Software Foundation. 578 | 579 | If the Program specifies that a proxy can decide which future 580 | versions of the GNU General Public License can be used, that proxy's 581 | public statement of acceptance of a version permanently authorizes you 582 | to choose that version for the Program. 583 | 584 | Later license versions may give you additional or different 585 | permissions. However, no additional obligations are imposed on any 586 | author or copyright holder as a result of your choosing to follow a 587 | later version. 588 | 589 | 15. Disclaimer of Warranty. 590 | 591 | THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY 592 | APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT 593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY 594 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, 595 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 596 | PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM 597 | IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF 598 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 599 | 600 | 16. Limitation of Liability. 601 | 602 | IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING 603 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS 604 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY 605 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE 606 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF 607 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD 608 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), 609 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF 610 | SUCH DAMAGES. 611 | 612 | 17. Interpretation of Sections 15 and 16. 613 | 614 | If the disclaimer of warranty and limitation of liability provided 615 | above cannot be given local legal effect according to their terms, 616 | reviewing courts shall apply local law that most closely approximates 617 | an absolute waiver of all civil liability in connection with the 618 | Program, unless a warranty or assumption of liability accompanies a 619 | copy of the Program in return for a fee. 620 | 621 | END OF TERMS AND CONDITIONS 622 | 623 | How to Apply These Terms to Your New Programs 624 | 625 | If you develop a new program, and you want it to be of the greatest 626 | possible use to the public, the best way to achieve this is to make it 627 | free software which everyone can redistribute and change under these terms. 628 | 629 | To do so, attach the following notices to the program. It is safest 630 | to attach them to the start of each source file to most effectively 631 | state the exclusion of warranty; and each file should have at least 632 | the "copyright" line and a pointer to where the full notice is found. 633 | 634 | 635 | Copyright (C) 636 | 637 | This program is free software: you can redistribute it and/or modify 638 | it under the terms of the GNU General Public License as published by 639 | the Free Software Foundation, either version 3 of the License, or 640 | (at your option) any later version. 641 | 642 | This program is distributed in the hope that it will be useful, 643 | but WITHOUT ANY WARRANTY; without even the implied warranty of 644 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 645 | GNU General Public License for more details. 646 | 647 | You should have received a copy of the GNU General Public License 648 | along with this program. If not, see . 649 | 650 | Also add information on how to contact you by electronic and paper mail. 651 | 652 | If the program does terminal interaction, make it output a short 653 | notice like this when it starts in an interactive mode: 654 | 655 | Copyright (C) 656 | This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. 657 | This is free software, and you are welcome to redistribute it 658 | under certain conditions; type `show c' for details. 659 | 660 | The hypothetical commands `show w' and `show c' should show the appropriate 661 | parts of the General Public License. Of course, your program's commands 662 | might be different; for a GUI interface, you would use an "about box". 663 | 664 | You should also get your employer (if you work as a programmer) or school, 665 | if any, to sign a "copyright disclaimer" for the program, if necessary. 666 | For more information on this, and how to apply and follow the GNU GPL, see 667 | . 668 | 669 | The GNU General Public License does not permit incorporating your program 670 | into proprietary programs. If your program is a subroutine library, you 671 | may consider it more useful to permit linking proprietary applications with 672 | the library. If this is what you want to do, use the GNU Lesser General 673 | Public License instead of this License. But first, please read 674 | . 675 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # suricata-merlin 2 | 3 | This repo includes support files used by suricata_manager.sh maintained by juched78. 4 | https://github.com/juched78/suricata-merlin 5 | 6 | Includes scripts to support features like: 7 | - Install and Uninstall Suricata 8 | - Auto update rules nightly at 3AM 9 | - Collect Logs 10 | - Display stats on UI 11 | 12 | ## Pre-requisites 13 | 1. Currently only supports Asus routers running [Merlin firmware](https://github.com/RMerl/asuswrt-merlin.ng) 14 | 2. Asus QoS and AiProtection Trend Micro DISABLED 15 | 3. Entware 16 | 4. USB Storage 17 | 5. JFFS Custom Scripts Enabled 18 | 19 | ## Install/Update Example 20 | 21 | 1. Run the installer: 22 | ```sh 23 | mkdir /jffs/addons 2>/dev/null;mkdir /jffs/addons/suricata 2>/dev/null; curl --retry 3 "https://raw.githubusercontent.com/juched78/suricata-merlin/master/suricata_manager.sh" -o "/jffs/addons/suricata/suricata_manager.sh" && chmod 755 "/jffs/addons/suricata/suricata_manager.sh" && /jffs/addons/suricata/suricata_manager.sh install 24 | ``` 25 | 26 | ## Usage 27 | Usage: suricata_manager ['help'|'-h'] | [ 'debug' ] 28 | [ 'install' | 'uninstall' | 'check' | 'stop' | 'start' | 'logs' | 'config[x]' | 'test' ] 29 | 30 | suricata_manager config: View the suricata.yml file 31 | 32 | suricata_manager configx: Edit the suricata.yml file 33 | 34 | suricata_manager check: Syntax check the suricata.yml file 35 | 36 | suricata_manager test: Generate a spoof HTTPS attack (To see it you will need to enable the http.log) uid=0(root) gid=0(root) groups=0(root) 37 | 38 | suricata_manager logs: View the logs for activity 39 | 40 | /opt/var/log/suricata/fast.log 41 | 42 | /opt/var/log/suricata/stats.log 43 | -------------------------------------------------------------------------------- /S82suricata: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | logger -t S82suricata "Starting Suricata IDS/IPS $0" 3 | # set environment PATH to system binaries 4 | export PATH=/sbin:/bin:/usr/sbin:/usr/bin:$PATH 5 | export TZ=$(cat /etc/TZ) 6 | ENABLED=yes 7 | PROCS=suricata 8 | PIDFILE=/opt/var/run/suricata.pid 9 | ARGS="-c /opt/etc/suricata/suricata.yaml --af-packet -D" 10 | #ARGS="-c /opt/etc/suricata/suricata.yaml --pcap" 11 | POSTCMD="sleep 1" 12 | PREARGS="" 13 | DESC=$PROCS 14 | PATH=/opt/sbin:/opt/bin:/opt/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin 15 | 16 | . /opt/etc/init.d/rc.func 17 | -------------------------------------------------------------------------------- /suricata.yaml: -------------------------------------------------------------------------------- 1 | %YAML 1.1 2 | --- 3 | 4 | # Holds variables that would be used by the engine. 5 | vars: 6 | 7 | # Holds the address group vars that would be passed in a Signature. 8 | address-groups: 9 | HOME_NET: "[HOME_NET/16]" 10 | EXTERNAL_NET: "any" 11 | DNS_SERVERS: "[DNS_IP]" 12 | SMTP_SERVERS: "$HOME_NET" 13 | HTTP_SERVERS: "$HOME_NET" 14 | SQL_SERVERS: "$HOME_NET" 15 | TELNET_SERVERS: "$HOME_NET" 16 | DNP3_SERVER: "$HOME_NET" 17 | DNP3_CLIENT: "$HOME_NET" 18 | MODBUS_SERVER: "$HOME_NET" 19 | MODBUS_CLIENT: "$HOME_NET" 20 | ENIP_SERVER: "$HOME_NET" 21 | ENIP_CLIENT: "$HOME_NET" 22 | FTP_SERVERS: "$HOME_NET" 23 | SSH_SERVERS: "$HOME_NET" 24 | 25 | # Holds the port group vars that would be passed in a Signature. 26 | port-groups: 27 | FTP_PORTS: "21" 28 | HTTP_PORTS: "80" 29 | ORACLE_PORTS: "1521" 30 | SSH_PORTS: "29100" 31 | SHELLCODE_PORTS: "!80" 32 | DNP3_PORTS: "20000" 33 | FILE_DATA_PORTS: "$HTTP_PORTS,110,143" 34 | 35 | # Runmode the engine should use. 36 | runmode: workers 37 | 38 | # If set to auto, the variable is internally switched to 'router' in IPS 39 | # mode and 'sniffer-only' in IDS mode. 40 | host-mode: auto 41 | 42 | # Linux high speed capture support 43 | af-packet: 44 | - interface: ## set your wan interface 45 | # threads: 1 46 | # defrag: no 47 | # cluster-type: cluster_flow 48 | # cluster-id: 99 49 | # copy-mode: ips 50 | # copy-iface: br0 51 | # buffer-size: 3072 52 | # use-mmap: yes 53 | # tpacket-v2: yes 54 | # tpacket-v3: no 55 | # ring-size: 3072 56 | - interface: ## set your lan interface 57 | # threads: 1 58 | # cluster-id: 98 59 | # defrag: no 60 | # cluster-type: cluster_flow 61 | # copy-mode: ips 62 | # copy-iface: eth0 63 | # buffer-size: 3072 64 | # use-mmap: yes 65 | # tpacket-v2: yes 66 | # tpacket-v3: no 67 | # ring-size: 3072 68 | # - interface: wl0.2 69 | 70 | # IPS Mode Configuration 71 | # PCAP 72 | pcap: 73 | - interface: eth0 74 | checksum-checks: auto 75 | promisc: yes 76 | - interface: br0 77 | checksum-checks: auto 78 | promisc: yes 79 | 80 | pid-file: /opt/var/run/suricata.pid 81 | 82 | legacy: 83 | uricontent: enabled 84 | 85 | max-pending-packets: 1024 86 | 87 | # The default logging directory. 88 | default-log-dir: /opt/var/log/suricata 89 | 90 | stats: 91 | enabled: no 92 | # The interval field (in seconds) controls at what interval 93 | # the loggers are invoked. 94 | interval: 8 95 | decoder-events-prefix: "decoder.event" 96 | 97 | # Configure the type of alert (and other) logging. 98 | outputs: 99 | 100 | # a line based alerts log similar to Snort's fast.log 101 | - fast: 102 | enabled: yes 103 | filename: fast.log 104 | append: yes 105 | filetype: regular 106 | 107 | # alert output for use with Barnyard2 108 | - unified2-alert: 109 | enabled: no 110 | filename: unified2.alert 111 | limit: 32mb 112 | sensor-id: 0 113 | xff: 114 | enabled: no 115 | 116 | - http-log: 117 | enabled: no 118 | filename: http.log 119 | append: yes 120 | extended: yes 121 | filetype: regular 122 | 123 | - pcap-log: 124 | enabled: no 125 | filename: log.pcap 126 | limit: 32mb 127 | max-files: 1000 128 | mode: normal 129 | 130 | - tls-log: 131 | enabled: no 132 | filename: tls.log 133 | extended: yes 134 | 135 | - tls-store: 136 | enabled: no 137 | certs-log-dir: certs 138 | 139 | - stats: 140 | enabled: yes 141 | filename: stats.log 142 | interval: 10 143 | append: no 144 | 145 | - syslog: 146 | enabled: no 147 | identity: suricata 148 | facility: local1 149 | level: notice 150 | 151 | - drop: 152 | enabled: no 153 | filename: drop.log 154 | append: yes 155 | filetype: regular 156 | 157 | - file-store: 158 | enabled: no 159 | log-dir: files 160 | force-magic: no 161 | 162 | - file-log: 163 | enabled: no 164 | filename: files-json.log 165 | append: yes 166 | filetype: regular 167 | force-magic: no 168 | #force-hash: [md5] 169 | 170 | - dns-log: 171 | enabled: no 172 | filename: dns.log 173 | append: yes 174 | filetype: regular 175 | 176 | - eve-log: 177 | enabled: no 178 | filetype: regular 179 | filename: eve-%Y-%m-%d-%H:%M.json 180 | 181 | types: 182 | - alert: 183 | tagged-packets: yes 184 | app-layer: true 185 | flow: true 186 | rule: true 187 | metadata: true 188 | raw: false 189 | 190 | - drop: 191 | alerts: yes 192 | flows: all 193 | 194 | # - http 195 | # - dns 196 | # - tls 197 | 198 | # Magic file. The extension .mgc is added to the value here. 199 | magic-file: /opt/share/misc/magic 200 | 201 | ## Netfilter configuration 202 | ## 203 | 204 | nflog: 205 | # netlink multicast group 206 | # (the same as the iptables --nflog-group param) 207 | # Group 0 is used by the kernel, so you can't use it 208 | - group: 2 209 | # netlink buffer size 210 | buffer-size: 18432 211 | # put default value here 212 | - group: default 213 | # set number of packet to queue inside kernel 214 | qthreshold: 1 215 | # set the delay before flushing packet in the queue inside kernel 216 | qtimeout: 100 217 | # netlink max buffer size 218 | max-size: 20000 219 | 220 | # Specify a threshold config file 221 | #threshold-file: /usr/local/etc/suricata/suricata_17402_pppoe1/threshold.config 222 | 223 | detect-engine: 224 | - profile: medium 225 | - custom-values: 226 | toclient-src-groups: 2 227 | toclient-dst-groups: 2 228 | toclient-sp-groups: 2 229 | toclient-dp-groups: 3 230 | toserver-src-groups: 2 231 | toserver-dst-groups: 4 232 | toserver-sp-groups: 2 233 | toserver-dp-groups: 25 234 | - sgh-mpm-context: auto 235 | - inspection-recursion-limit: 3000 236 | 237 | 238 | # Suricata is multi-threaded. Here the threading can be influenced. 239 | threading: 240 | set-cpu-affinity: no 241 | detect-thread-ratio: 1.5 242 | 243 | # Defrag settings: 244 | defrag: 245 | memcap: 32mb 246 | hash-size: 65536 247 | trackers: 65535 248 | max-frags: 65535 249 | prealloc: yes 250 | timeout: 60 251 | 252 | # Flow settings: 253 | flow: 254 | memcap: 32mb 255 | hash-size: 65536 256 | prealloc: 10000 257 | emergency-recovery: 30 258 | prune-flows: 5 259 | 260 | # This option controls the use of vlan ids in the flow (and defrag) 261 | # hashing. 262 | vlan: 263 | use-for-tracking: true 264 | 265 | # Specific timeouts for flows. 266 | flow-timeouts: 267 | 268 | default: 269 | new: 30 270 | established: 300 271 | closed: 0 272 | emergency-new: 10 273 | emergency-established: 100 274 | emergency-closed: 0 275 | tcp: 276 | new: 60 277 | established: 3600 278 | closed: 120 279 | emergency-new: 10 280 | emergency-established: 300 281 | emergency-closed: 20 282 | udp: 283 | new: 30 284 | established: 300 285 | emergency-new: 10 286 | emergency-established: 100 287 | icmp: 288 | new: 30 289 | established: 300 290 | emergency-new: 10 291 | emergency-established: 100 292 | 293 | stream: 294 | memcap: 32mb 295 | checksum-validation: yes # reject wrong csums 296 | inline: auto # auto will use inline mode in IPS mode, yes or no set it statically 297 | reassembly: 298 | memcap: 64mb 299 | depth: 1mb # reassemble 1mb into a stream 300 | toserver-chunk-size: 2560 301 | toclient-chunk-size: 2560 302 | randomize-chunk-size: yes 303 | #randomize-chunk-range: 10 304 | #raw: yes 305 | #segment-prealloc: 2048 306 | #check-overlap-different-data: true 307 | 308 | # Host table is used by tagging and per host thresholding subsystems. 309 | host: 310 | hash-size: 4096 311 | prealloc: 1000 312 | memcap: 16554432 313 | 314 | # Host specific policies for defragmentation and TCP stream reassembly. 315 | host-os-policy: 316 | # Make the default policy windows. 317 | windows: [0.0.0.0/0] 318 | bsd: [] 319 | bsd-right: [] 320 | old-linux: [] 321 | linux: [] 322 | old-solaris: [] 323 | solaris: [] 324 | hpux10: [] 325 | hpux11: [] 326 | irix: [] 327 | macos: [] 328 | vista: [] 329 | windows2k3: [] 330 | 331 | # Logging configuration. This is not about logging IDS alerts, but 332 | # IDS output about what its doing, errors, etc. 333 | logging: 334 | 335 | # This value is overriden by the SC_LOG_LEVEL env var. 336 | default-log-level: info 337 | 338 | # Define your logging outputs. 339 | outputs: 340 | - console: 341 | enabled: no 342 | - file: 343 | enabled: no 344 | filename: /opt/var/log/suricata/suricata.log 345 | - syslog: 346 | enabled: no 347 | facility: off 348 | 349 | default-rule-path: /opt/var/lib/suricata/rules 350 | 351 | rule-files: 352 | - botcc.rules 353 | - botcc.portgrouped.rules 354 | - compromised.rules 355 | - drop.rules 356 | - dshield.rules 357 | - emerging-malware.rules 358 | - emerging-mobile_malware.rules 359 | - emerging-worm.rules 360 | - emerging-dos.rules 361 | # - emerging-dns.rules 362 | - ciarmy.rules 363 | - emerging-misc.rules 364 | - emerging-scan.rules 365 | # - emerging-icmp_info.rules 366 | - emerging-icmp.rules 367 | # - emerging-user_agents.rules 368 | # - emerging-policy.rules 369 | - emerging-attack_response.rules 370 | - emerging-ftp.rules 371 | # - emerging-games.rules 372 | 373 | classification-file: /opt/etc/suricata/classification.config 374 | reference-config-file: /opt/etc/suricata/reference.config 375 | threshold-file: /opt/etc/suricata/threshold.config 376 | 377 | # action-order: 378 | # - pass 379 | # - drop 380 | # - reject 381 | # - alert 382 | 383 | # Limit for the maximum number of asn1 frames to decode (default 256) 384 | asn1-max-frames: 256 385 | 386 | engine-analysis: 387 | rules-fast-pattern: yes 388 | rules: yes 389 | 390 | #recursion and match limits for PCRE where supported 391 | pcre: 392 | match-limit: 3500 393 | match-limit-recursion: 1500 394 | 395 | # Holds details on the app-layer. The protocols section details each protocol. 396 | app-layer: 397 | protocols: 398 | krb5: 399 | enabled: no # Requires rust 400 | ikev2: 401 | enabled: yes 402 | tls: 403 | enabled: yes 404 | detection-ports: 405 | dp: "[443,444,465,853,993,995]" 406 | 407 | dcerpc: 408 | enabled: yes 409 | ftp: 410 | enabled: yes 411 | ssh: 412 | enabled: yes 413 | smtp: 414 | enabled: yes 415 | imap: 416 | enabled: detection-only 417 | msn: 418 | enabled: detection-only 419 | smb: 420 | enabled: yes 421 | detection-ports: 422 | dp: 139, 445 423 | dns: 424 | global-memcap: 16777216 425 | state-memcap: 524288 426 | request-flood: 500 427 | 428 | tcp: 429 | enabled: yes 430 | detection-ports: 431 | dp: 53 432 | udp: 433 | enabled: yes 434 | detection-ports: 435 | dp: 53 436 | http: 437 | enabled: yes 438 | memcap: 16108864 439 | 440 | ########################################################################### 441 | # Configure libhtp. 442 | libhtp: 443 | default-config: 444 | personality: IDS 445 | request-body-limit: 2mb 446 | response-body-limit: 2mb 447 | request-body-minimal-inspect-size: 32kb 448 | request-body-inspect-window: 4kb 449 | response-body-minimal-inspect-size: 32kb 450 | response-body-inspect-window: 4kb 451 | http-body-inline: auto 452 | double-decode-path: no 453 | double-decode-query: no 454 | ntp: 455 | enabled: yes 456 | dhcp: 457 | enabled: yes 458 | sip: 459 | enabled: yes 460 | 461 | coredump: 462 | max-dump: unlimited 463 | 464 | # Suricata user pass through configuration 465 | -------------------------------------------------------------------------------- /suricata_log.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | ## 3 | # 4 | # _____ _ __ __ 5 | # / ___/__ _______(_)________ _/ /_____ _ / / ____ ____ _ 6 | # \__ \/ / / / ___/ / ___/ __ `/ __/ __ `/ / / / __ \/ __ `/ 7 | # ___/ / /_/ / / / / /__/ /_/ / /_/ /_/ / / /___/ /_/ / /_/ / 8 | #/____/\__,_/_/ /_/\___/\__,_/\__/\__,_/ /_____/\____/\__, / 9 | # /____/ 10 | # 11 | ## @juched - Process logs into SQLite3 for stats generation 12 | ##suricata_log.sh 13 | ## - v1.0 - Aug 8 2020 - Initial version 14 | readonly SCRIPT_VERSION="v1.0" 15 | 16 | Say(){ 17 | echo -e $$ $@ | logger -st "($(basename $0))" 18 | } 19 | 20 | ScriptHeader(){ 21 | printf "\\n" 22 | printf "##\\n" 23 | printf "##Suricata Log\\n" 24 | printf "## by @juched - Process logs into SQLite3 for stats generation - %s \\n" "$SCRIPT_VERSION" 25 | printf "\\n" 26 | printf "suricata_log.sh\\n" 27 | } 28 | 29 | ScriptHeader 30 | 31 | # default to non-syslog location and variable positions 32 | suricata_logfile="/opt/var/log/suricata/fast.log" 33 | n_threat_id=3 34 | n_threat_desc=4 35 | n_threat_class=6 36 | n_threat_priority=8 37 | n_threat_connection=9 38 | n_threat_connection_src=2 39 | n_threat_connection_dst=4 40 | 41 | echo "Logfile used is $suricata_logfile" 42 | 43 | #other variables 44 | tmpSQL="/tmp/suricata_log.sql" 45 | dbLogFile="/opt/var/lib/suricata/suricata_log.db" 46 | dateString=$(date '+%F') 47 | olddateString30=$(date -D %s -d $(( $(date +%s) - 30*86400)) '+%F') 48 | echo "Date used is $dateString (30 days ago is $olddateString30)" 49 | 50 | #create table to track threats detected from fast.log 51 | echo "Creating threat_log table if needed..." 52 | printf "CREATE TABLE IF NOT EXISTS [threat_log] ([threat_id] VARCHAR(32) NOT NULL,[threat_desc] VARCHAR(255) NOT NULL,[threat_class] VARCHAR(255) NOT NULL, [threat_priority] VARCHAR(32) NOT NULL, [threat_src_ip] VARCHAR(16) NOT NULL, [threat_dst_ip] VARCHAR(16) NOT NULL, [date] DATE NOT NULL, [count] INTEGER NOT NULL, PRIMARY KEY(threat_id,date));" | sqlite3 $dbLogFile 53 | 54 | #delete old records > 30 days ago 55 | echo "Deleting old threat_log records older than 30 days..." 56 | printf "DELETE FROM threat_log WHERE date < '$olddateString30';" | sqlite3 $dbLogFile 57 | 58 | 59 | # Add to SQLite all reply domains (log-replies must be yes) 60 | if [ -f "$suricata_logfile" ]; then # only if log exists 61 | 62 | # process reply logs - for top daily replies table 63 | echo "BEGIN;" > $tmpSQL 64 | cat $suricata_logfile | awk -v vardate="$dateString" -v varthreatid="$n_threat_id" -v varthreatdesc="$n_threat_desc" -v varthreatclass="$n_threat_class" -v varthreatpriority="$n_threat_priority" -v varthreatconnect="$n_threat_connection" -v vartheatconnection_src="$n_threat_connection_src" -v varthreatconnection_dst="$n_threat_connection_dst" -F' \\[\\*\\*\\] |\\[|\\] ' '/\[\*\*\]/{split($varthreatconnect,a_conn,"\\{*\\} | -> |:");print "INSERT OR IGNORE INTO threat_log ([threat_id],[threat_desc],[threat_class],[threat_priority],[threat_src_ip],[threat_dst_ip],[date],[count]) VALUES (\x27" $varthreatid "\x27, \x27" $varthreatdesc "\x27, \x27" $varthreatclass "\x27, \x27" $varthreatpriority "\x27, \x27" a_conn[vartheatconnection_src] "\x27, \x27" a_conn[varthreatconnection_dst] "\x27, \x27" vardate "\x27, 0);\nUPDATE threat_log SET count = count + 1 WHERE threat_id = \x27" $varthreatid "\x27 AND threat_src_ip = \x27" a_conn[vartheatconnection_src] "\x27 AND threat_dst_ip = \x27" a_conn[varthreatconnection_dst] "\x27 AND date = \x27" vardate "\x27;"}' >> $tmpSQL 65 | echo "COMMIT;" >> $tmpSQL 66 | 67 | # log out the processed nodes 68 | threat_count=$(grep -c "\[\*\*\]" $suricata_logfile) 69 | Say "Processed $threat_count threat records..." 70 | 71 | #echo "Removing threat lines from log file..." 72 | sed -i '\~\[\*\*\]~d' $suricata_logfile 73 | 74 | # HUP to restart logs 75 | /bin/kill -HUP `cat /opt/var/run/suricata.pid 2>/dev/null` 2>/dev/null 76 | 77 | echo "Running SQLite to import new reply records..." 78 | sqlite3 $dbLogFile < $tmpSQL 79 | 80 | #cleanup 81 | if [ -f $tmpSQL ]; then rm $tmpSQL; fi 82 | 83 | fi 84 | 85 | echo "All done!" 86 | -------------------------------------------------------------------------------- /suricata_manager.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # suricata-manager - Suricata port for Merlin firmware supported routers 3 | # Site: https://github.com/ttgapers/suricata-merlin 4 | # Thread: hhttps://www.snbforums.com/threads/suricata-ids-ips-on-asuswrt-merlin.63280/ 5 | # Credits: juched, rgnldo, Martineau, ttgapers, Adamm 6 | 7 | # shellcheck disable=SC2086,SC2068,SC2039,SC2242,SC2027,SC2155,SC2046 8 | # shellcheck disable=SC2034 # Unused variables left for readability 9 | 10 | VER="v1.2" 11 | GITHUB="https://raw.githubusercontent.com/juched78/suricata-merlin/master/" 12 | #======================================================================================================= © 2020 Martineau, v1.03 13 | # Install 'suricata - Real-time Intrusion Detection System (IDS), Intrusion Prevention System (IPS) package from Entware on Asuswrt-Merlin firmware. 14 | # 15 | # Pre-reqs: 4.x kernel e.g. HND-models RT-AC86U,RT-AX88U or RT-AX56U,RT-AX58U 16 | # QoS and AiProtection Trend Micro DISABLED 17 | # Skynet DISABLED recommended but may run concurrently 18 | # 19 | # Usage: suricata_manager ['help'|'-h'] | [ 'debug' ] 20 | # [ 'install' | 'uninstall' | 'check' | 'stop' | 'start' | 'logs' | 'config[x]' | 'test' ] 21 | # 22 | # suricata_manager config 23 | # View the suricata.yml file 24 | # suricata_manager configx 25 | # Edit the suricata.yml file 26 | # suricata_manager check 27 | # Syntax check the suricata.yml file 28 | # suricata_manager test 29 | # Generate a spoof HTTPS attack (To see it you will need to enable the http.log) 30 | # 31 | # uid=0(root) gid=0(root) groups=0(root) 32 | # suricata_manager logs 33 | # View the default three logs for activity 34 | # 35 | # ==> /opt/var/log/suricata/fast.log <== 36 | # 37 | # ==> /opt/var/log/suricata/stats.log <== 38 | 39 | 40 | # Print between line beginning with'#==' to first blank line inclusive 41 | ShowHelp() { 42 | awk '/^#==/{f=1} f{print; if (!NF) exit}' $0 43 | } 44 | Say() { 45 | # shellcheck disable=SC2068 46 | echo -e $$ $@ | logger -st "($(basename $0))" 47 | } 48 | SayT() { 49 | # shellcheck disable=SC2068 50 | echo -e $$ $@ | logger -t "($(basename $0))" 51 | } 52 | # shellcheck disable=SC2034 53 | ANSIColours () { 54 | cRESET="\e[0m";cBLA="\e[30m";cRED="\e[31m";cGRE="\e[32m";cYEL="\e[33m";cBLU="\e[34m";cMAG="\e[35m";cCYA="\e[36m";cGRA="\e[37m";cFGRESET="\e[39m" 55 | cBGRA="\e[90m";cBRED="\e[91m";cBGRE="\e[92m";cBYEL="\e[93m";cBBLU="\e[94m";cBMAG="\e[95m";cBCYA="\e[96m";cBWHT="\e[97m" 56 | aBOLD="\e[1m";aDIM="\e[2m";aUNDER="\e[4m";aBLINK="\e[5m";aREVERSE="\e[7m" 57 | aBOLDr="\e[21m";aDIMr="\e[22m";aUNDERr="\e[24m";aBLINKr="\e[25m";aREVERSEr="\e[27m" 58 | cWRED="\e[41m";cWGRE="\e[42m";cWYEL="\e[43m";cWBLU="\e[44m";cWMAG="\e[45m";cWCYA="\e[46m";cWGRA="\e[47m" 59 | cYBLU="\e[93;48;5;21m" 60 | cRED_="\e[41m";cGRE_="\e[42m" 61 | xHOME="\e[H";xERASE="\e[2J";xERASEDOWN="\e[J";xERASEUP="\e[1J";xCSRPOS="\e[s";xPOSCSR="\e[u";xERASEEOL="\e[K" 62 | xGoto="\e[Line;Columnf" 63 | } 64 | Get_Router_Model() { 65 | 66 | # Contribution by @thelonelycoder as odmpid is blank for non SKU hardware, 67 | local HARDWARE_MODEL 68 | [ -z "$(nvram get odmpid)" ] && HARDWARE_MODEL=$(nvram get productid) || HARDWARE_MODEL=$(nvram get odmpid) 69 | 70 | echo $HARDWARE_MODEL 71 | 72 | return 0 73 | } 74 | Chk_Entware() { 75 | 76 | # ARGS [wait attempts] [specific_entware_utility] 77 | READY="1" # Assume Entware Utilities are NOT available 78 | ENTWARE_UTILITY="" # Specific Entware utility to search for 79 | MAX_TRIES="30" 80 | 81 | if [ -n "$2" ] && [ "$2" -eq "$2" ] 2>/dev/null; then 82 | MAX_TRIES="$2" 83 | elif [ -z "$2" ] && [ "$1" -eq "$1" ] 2>/dev/null; then 84 | MAX_TRIES="$1" 85 | fi 86 | 87 | if [ -n "$1" ] && ! [ "$1" -eq "$1" ] 2>/dev/null; then 88 | ENTWARE_UTILITY="$1" 89 | fi 90 | 91 | # Wait up to (default) 30 seconds to see if Entware utilities available..... 92 | TRIES="0" 93 | 94 | while [ "$TRIES" -lt "$MAX_TRIES" ]; do 95 | if [ -f "/opt/bin/opkg" ]; then 96 | if [ -n "$ENTWARE_UTILITY" ]; then # Specific Entware utility installed? 97 | if [ -n "$(opkg list-installed "$ENTWARE_UTILITY")" ]; then 98 | READY="0" # Specific Entware utility found 99 | else 100 | # Not all Entware utilities exists as a stand-alone package e.g. 'find' is in package 'findutils' 101 | if [ -d /opt ] && [ -n "$(find /opt/ -name "$ENTWARE_UTILITY")" ]; then 102 | READY="0" # Specific Entware utility found 103 | fi 104 | fi 105 | else 106 | READY="0" # Entware utilities ready 107 | fi 108 | break 109 | fi 110 | sleep 1 111 | logger -st "($(basename "$0"))" "$$ Entware $ENTWARE_UTILITY not available - wait time $((MAX_TRIES - TRIES-1)) secs left" 112 | TRIES=$((TRIES + 1)) 113 | done 114 | return "$READY" 115 | } 116 | # shellcheck disable=2143 117 | # shellcheck disable=2015 118 | Is_HND() { 119 | # Use the following at the command line otherwise 'return X' makes the SSH session terminate! 120 | #[ -n "$(uname -m | grep "aarch64")" ] && echo Y || echo N 121 | [ -n "$(uname -m | grep "aarch64")" ] && { echo Y; return 0; } || { echo N; return 1; } 122 | } 123 | # shellcheck disable=2143 124 | # shellcheck disable=2015 125 | Is_AX() { 126 | # Kernel is '4.1.52+' (i.e. isn't '2.6.36*') and it isn't HND 127 | # Use the following at the command line otherwise 'return X' makes the SSH session terminate! 128 | # [ -n "$(uname -r | grep "^4")" ] && [ -z "$(uname -m | grep "aarch64")" ] && echo Y || echo N 129 | [ -n "$(uname -r | grep "^4")" ] && [ -z "$(uname -m | grep "aarch64")" ] && { echo Y; return 0; } || { echo N; return 1; } 130 | } 131 | # shellcheck disable=SC2034 132 | Get_WAN_IF_Name () { 133 | 134 | # echo $([ -n "$(nvram get wan0_pppoe_ifname)" ] && echo $(nvram get wan0_pppoe_ifname) || echo $(nvram get wan0_ifname)) 135 | # nvram get wan0_gw_ifname 136 | # nvram get wan0_proto 137 | 138 | local IF_NAME=$(nvram get wan0_ifname) # DHCP/Static ? 139 | 140 | # Usually this is probably valid for both eth0/ppp0e ? 141 | if [ "$(nvram get wan0_gw_ifname)" != "$IF_NAME" ]; then 142 | local IF_NAME=$(nvram get wan0_gw_ifname) 143 | fi 144 | 145 | # if [ ! -z "$(nvram get wan0_pppoe_ifname)" ];then 146 | # local IF_NAME="$(nvram get wan0_pppoe_ifname)" # PPPoE 147 | # fi 148 | if [ -n "$(nvram get wan0_pppoe_ifname)" ]; then 149 | local IF_NAME="$(nvram get wan0_pppoe_ifname)" # PPPoE 150 | fi 151 | 152 | echo $IF_NAME 153 | 154 | } 155 | 156 | # shellcheck disable=SC2034 157 | Get_LAN_IF_Name () { 158 | 159 | local IF_NAME=$(nvram get lan_ifname) # DHCP/Static ? 160 | 161 | echo $IF_NAME 162 | 163 | } 164 | 165 | _quote() { 166 | echo $1 | sed 's/[]\/()$*.^|[]/\\&/g' 167 | } 168 | Check_GUI_NVRAM() { 169 | 170 | local ERROR_CNT=0 171 | local ENABLED_OPTIONS=" " 172 | 173 | if [ "$1" == "active" ];then 174 | STATUSONLY="StatusOnly" 175 | else 176 | echo -e $cBCYA"\n\tRouter Configuration recommended pre-reqs status:\n" 2>&1 177 | 178 | if [ "$(Is_HND)" == "N" ] && [ "$(Is_AX)" == "N" ];then 179 | echo -e $cBRED"\a\t[✖] Warning ${cRESET}Router $HARDWARE_MODEL$cBRED isn't fully supported ${cBGRE}(Only HND-models RT-AC86U,RT-AX88U or RT-AX56U,RT-AX58U)"$cRESET 180 | ERROR_CNT=$((ERROR_CNT + 1)) 181 | fi 182 | 183 | # Check GUI 'TrendMicro' 184 | [ "$(nvram get TM_EULA)" == "1" ] && { echo -e $cBRED"\a\t[✖] ***ERROR TrendMicro ENABLED $cRESET \t\t\t\tsee $HTTP_TYPE://$(nvram get lan_ipaddr):$HTTP_PORT/Advanced_Privacy.asp ->Administration Privacy"$cRESET 2>&1; ERROR_CNT=$((ERROR_CNT + 1)); } || echo -e $cBGRE"\t[✔] TrendMicro DISABLED" 2>&1 185 | 186 | # QoS 187 | [ "$(nvram get qos_enable)" == "1" ] && { echo -e $cBRED"\a\t[✖] ***ERROR QoS ENABLED $cRESET \t\t\t\t\tsee $HTTP_TYPE://$(nvram get lan_ipaddr):$HTTP_PORT/QoS_EZQoS.asp ->QoS - QoS to configuration"$cRESET 2>&1; ERROR_CNT=$((ERROR_CNT + 1)); } || echo -e $cBGRE"\t[✔] QoS DISABLED" 2>&1 188 | 189 | # Check Skynet 190 | #[ -f /jffs/scripts/firewall ] && echo -e $cBRED"\a\t[✖] ***Warning Skynet installed" || echo -e $cBGRE"\t[✔] Skynet not Installed" 2>&1 191 | 192 | echo -e $cBCYA"\n\tOptions:${TXT}$DESC\n" 2>&1 193 | 194 | fi 195 | 196 | local TXT= 197 | unset $TXT 198 | #echo -e $cRESET 2>&1 199 | 200 | if [ -z "$STATUSONLY" ];then 201 | [ $ERROR_CNT -ne 0 ] && { return 1; } || return 0 202 | else 203 | return 0 204 | fi 205 | } 206 | 207 | #=============================================Main============================================================= 208 | # shellcheck disable=SC2068 209 | Main() { true; } # Syntax that is Atom Shellchecker compatible! 210 | 211 | ANSIColours 212 | 213 | # shellcheck disable=SC2005 # Useless echo 214 | FIRMWARE=$(echo $(nvram get buildno) | awk 'BEGIN { FS = "." } {printf("%03d%02d",$1,$2)}') 215 | HARDWARE_MODEL=$(Get_Router_Model) 216 | 217 | # Global Router URL 218 | HTTP_TYPE="http" 219 | HTTP_PORT=$(nvram get http_lanport) 220 | [ "$(nvram get http_enable)" == "1" ] && { HTTP_TYPE="https"; HTTP_PORT=$(nvram get https_lanport) ; } 221 | 222 | 223 | # Need assistance ? 224 | if [ "$1" == "-h" ] || [ "$1" == "help" ];then 225 | clear # v1.21 226 | echo -e $cBWHT 227 | ShowHelp 228 | echo -e $cRESET 229 | exit 0 230 | fi 231 | 232 | if [ "$1" == "debug" ];then # v3.10 233 | DEBUGMODE="$(echo -e ${cRESET}$cWRED"Debug mode enabled"$cRESET)" 234 | shift 235 | set +x 236 | fi 237 | 238 | echo -e $cRESET"\n"$VER" Suricata IDS/IPS Manager.....\n" 239 | 240 | case "$1" in 241 | install) 242 | 243 | ACTION="Install" 244 | 245 | Check_GUI_NVRAM "install" 246 | # shellcheck disable=2181 247 | if [ $? -gt 0 ];then 248 | echo -e $cRESET"\n\tThe router does not currently meet ALL of the recommended pre-reqs as shown above." 249 | echo -e "\tHowever, whilst they are recommended, you may proceed with the suricata ${cBGRE}${ACTION}$cRESET" 250 | echo -e "\tas the recommendations are NOT usually FATAL if they are NOT strictly followed.\n" 251 | 252 | echo -e "\tPress$cBGRE Y$cRESET to$cBGRE continue suricata $ACTION $cRESET or press$cBRED [Enter] to ABORT"$cRESET 253 | read -r "CONTINUE_INSTALLATION" 254 | [ "$CONTINUE_INSTALLATION" != "Y" ] && { echo -e $cBRED"\a\n\tsuricata $ACTION CANCELLED!....."$cRESET; return 1; } # v2.06 255 | fi 256 | 257 | echo -e $cBGRA 258 | 259 | opkg update 260 | opkg install suricata 261 | 262 | mkdir /opt/var/lib/ 2>/dev/null 263 | mkdir /opt/var/lib/suricata/ 2>/dev/null 264 | mkdir /jffs/addons/suricata/ 2>/dev/null 265 | 266 | echo "Fetching suricata.yaml..." 267 | FN="/opt/etc/suricata/suricata.yaml" 268 | curl --progress-bar -o $FN $(echo $GITHUB"suricata.yaml") 269 | 270 | # Customise 'suricata.yaml' 271 | echo "Updating suricata.yaml..." 272 | # HOME_NET: "[192.168.0.0/24]" 273 | LANIPADDR=$(nvram get lan_ipaddr) 274 | LAN_SUBNET=${LANIPADDR%.*} 275 | LAN_CIDR=$(_quote "$(echo -e "[$LAN_SUBNET.0/24]")") 276 | sed -i "/HOME_NET:/ s/[^ ]*[^ ]/\\\"$LAN_CIDR\\\"/2" $FN 277 | echo "LAN IP is set to $LAN_CIDR" 278 | 279 | # DNS_SERVERS: "[192.168.1.1]" 280 | # shellcheck disable=2005 281 | DNS_IP=$(echo "$(nvram get wan0_dns)" | awk '{print $1}') # Beware wan0_dns will usually be two IP's 282 | [ -n "$(pidof unbound)" ] && DNS_IP=$(nvram get lan_ipaddr_rt) 283 | #DNS_IP="127.0.0.1" 284 | DNS=$(_quote "$(echo -e "[$DNS_IP]")") 285 | sed -i "/DNS_SERVERS:/ s/[^ ]*[^ ]/\\\"$DNS\\\"/2" $FN 286 | echo "DSN Server is set to $DNS" 287 | 288 | # af-packet: 289 | # - interface: ## set your wan interface 290 | WAN_IF=$(Get_WAN_IF_Name) 291 | sed -i "s/interface:.*set your wan interface/interface: $WAN_IF/" $FN 292 | echo "WAN IF is set to $WAN_IF" 293 | LAN_IF=$(Get_LAN_IF_Name) 294 | sed -i "s/interface:.*set your lan interface/interface: $LAN_IF/" $FN 295 | echo "LAN IF is set to $LAN_IF" 296 | 297 | # Download services file for init.d 298 | curl --progress-bar -o /opt/etc/init.d/S82suricata $(echo $GITHUB"S82suricata") 299 | chmod +x /opt/etc/init.d/S82suricata 300 | 301 | # Download Rules 302 | mkdir /opt/var/lib/suricata/rules 2>/dev/null 303 | curl --progress-bar -o /opt/etc/suricata/classification.config https://rules.emergingthreats.net/open/suricata-4.0/rules/classification.config 304 | curl --progress-bar -SL https://rules.emergingthreats.net/open/suricata-4.0/emerging.rules.tar.gz | tar -zxC /opt/var/lib/suricata/ 305 | 306 | # Download Update Script 307 | curl --progress-bar -o /jffs/addons/suricata/suricata_update.sh $(echo $GITHUB"suricata_update.sh") 308 | chmod +x /jffs/addons/suricata/suricata_update.sh 309 | 310 | # Create 03:00 Daily cron job to update the rules 311 | if [ ! -f /jffs/scripts/services-start ];then 312 | echo -e "#!/bin/sh\n" > /jffs/scripts/services-start 313 | chmod +x /jffs/scripts/services-start 314 | fi 315 | # shellcheck disable=2143 316 | [ -z "$(grep "Suricata_Update.sh" /jffs/scripts/services-start)" ] && echo -e "cru a Suricata_Update.sh \"0 3 * * * /jffs/addons/suricata/suricata_update.sh\"" >> /jffs/scripts/services-start 317 | cru a Suricata_Update.sh "0 3 * * * /jffs/addons/suricata/suricata_update.sh" 318 | 319 | # Download stats processing 320 | curl --progress-bar -o /jffs/addons/suricata/suricata_log.sh $(echo $GITHUB"suricata_log.sh") 321 | chmod +x /jffs/addons/suricata/suricata_log.sh 322 | curl --progress-bar -o /jffs/addons/suricata/suricata_stats.sh $(echo $GITHUB"suricata_stats.sh") 323 | chmod +x /jffs/addons/suricata/suricata_stats.sh 324 | curl --progress-bar -o /jffs/addons/suricata/suricatastats_www.asp $(echo $GITHUB"suricatastats_www.asp") 325 | 326 | # install stats 327 | /jffs/addons/suricata/suricata_stats.sh install 328 | 329 | 330 | # Perform a test compile of the config 331 | suricata -T 332 | 333 | #start services 334 | /opt/etc/init.d/S82suricata restart 335 | 336 | #cat /opt/var/log/suricata/suricata.log 337 | ;; 338 | stop) 339 | /opt/etc/init.d/S82suricata stop 340 | ;; 341 | start) 342 | /opt/etc/init.d/S82suricata start 343 | ;; 344 | logs) 345 | echo -e $cBMAG"\tLog watch\t\t${cBGRE}Press CTRL-C to stop\n"$cRESET 346 | # shellcheck disable=2012 347 | tail -f /opt/var/log/suricata/fast.log /opt/var/log/suricata/stats.log $EVELOG # recommended 348 | ;; 349 | config|configx) 350 | [ "$1" == "config" ] && ACCESS="--view" || ACCESS="--unix" 351 | PRE_MD5="$(md5sum /opt/etc/suricata/suricata.yaml | awk '{print $1}')" 352 | nano $ACCESS /opt/etc/suricata/suricata.yaml 353 | # Has the user edited 'suricata.yaml'..... 354 | if [ "$ACCESS" == "--unix" ];then 355 | POST_MD5="$(md5sum /opt/etc/suricata/suricata.yaml | awk '{print $1}')" 356 | if [ "$PRE_MD5" != "$POST_MD5" ];then 357 | echo -e "\nDo you want to restart suricata to apply your config changes?\n\n\tReply$cBRED 'y' ${cBGRE}or press [Enter] $cRESET to skip" 358 | read -r "ANS" 359 | [ "$ANS" == "y" ] && /opt/etc/init.d/S82suricata restart 360 | fi 361 | fi 362 | ;; 363 | test) 364 | curl http://testmyids.com/ 365 | ;; 366 | uninstall|remove) 367 | [ -f /opt/etc/init.d/S82suricata ] && /opt/etc/init.d/S82suricata stop 368 | /jffs/addons/suricata/suricata_stats.sh uninstall 369 | # [ -n "$(opkg list-installed | grep suricata)" ] && opkg --force-remove --force-depends remove suricata 370 | opkg --autoremove remove suricata 371 | cru d Suricata_Update.sh 372 | sed -i '/Suricata_Manager.sh/d' /jffs/scripts/services-start 373 | rm -rf /opt/var/lib/suricata 2>/dev/null 374 | rm /opt/etc/init.d/S82suricata 2>/dev/null 375 | rm -rf /opt/var/log/suricata/ 2>/dev/null 376 | rm -rf /opt/etc/suricata/ 2>/dev/null 377 | rm -rf /jffs/addons/suricata/ 2>/dev/null 378 | rm /opt/var/run/suricata.pid 2>/dev/null 379 | ;; 380 | syntax|check) 381 | # Perform a test compile of the config 382 | suricata -T 383 | ;; 384 | *) 385 | Check_GUI_NVRAM 386 | ;; 387 | esac -------------------------------------------------------------------------------- /suricata_stats.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | ## 3 | # 4 | # __ __ 5 | # (_ ` _ o _ _ _)_ _ (_ ` _)_ _ _)_ _ 6 | #.__) (_( ) ( (_ (_( (_ (_( .__) (_ (_( (_ ( 7 | # _) 8 | # 9 | ## by @juched - Generate Stats for GUI tab 10 | ## with credit to @JackYaz for his shared scripts 11 | ## v1.0 - initial stats 12 | readonly SCRIPT_VERSION="v1.0" 13 | 14 | #define www script names 15 | readonly SCRIPT_WEBPAGE_DIR="$(readlink /www/user)" 16 | readonly SCRIPT_NAME="Suricata_Stats.sh" 17 | readonly LOGSCRIPT_NAME="Suricata_Log.sh" 18 | readonly SCRIPT_NAME_LOWER="suricata_stats.sh" 19 | readonly LOGSCRIPT_NAME_LOWER="suricata_log.sh" 20 | readonly SCRIPT_WEB_DIR="$SCRIPT_WEBPAGE_DIR/$SCRIPT_NAME_LOWER" 21 | 22 | readonly SCRIPT_DIR="/jffs/addons/suricata" 23 | 24 | #needed for shared jy graph files from @JackYaz 25 | readonly SHARED_DIR="/jffs/addons/shared-jy" 26 | readonly SHARED_REPO="https://raw.githubusercontent.com/jackyaz/shared-jy/master" 27 | readonly SHARED_WEB_DIR="$SCRIPT_WEBPAGE_DIR/shared-jy" 28 | 29 | 30 | 31 | #define data file names 32 | statsTitleFile="$SCRIPT_WEB_DIR/suricatastatstitle.txt" 33 | statsTitleFileJS="$SCRIPT_WEB_DIR/suricatastatstitle.js" 34 | statsThreatsFileJS="$SCRIPT_WEB_DIR/suricatastats.js" 35 | statsThreatsHitsFileJS="$SCRIPT_WEB_DIR/suricatahits.js" 36 | 37 | #DB file to hold data for uptime graph 38 | dbLogs="/opt/var/lib/suricata/suricata_log.db" 39 | 40 | #save md5 of last installed www ASP file so you can find it again later (in case of www ASP update) 41 | installedMD5File="$SCRIPT_DIR/www-installed.md5" 42 | 43 | #get sqlite path 44 | [ -f /opt/bin/sqlite3 ] && SQLITE3_PATH=/opt/bin/sqlite3 || SQLITE3_PATH=/usr/sbin/sqlite3 45 | 46 | #function to create JS file with data 47 | WriteStats_ToJS(){ 48 | [ -f $2 ] && rm -f "$2" 49 | echo "function $3(){" >> "$2" 50 | html='document.getElementById("'"$4"'").innerHTML="' 51 | while IFS='' read -r line || [ -n "$line" ]; do 52 | html="$html""$line""\\r\\n" 53 | done < "$1" 54 | html="$html"'"' 55 | printf "%s\\r\\n}\\r\\n" "$html" >> "$2" 56 | } 57 | 58 | WriteData_ToJS(){ 59 | { 60 | echo "var $3;" 61 | echo "$3 = [];"; } >> "$2" 62 | contents="$3"'.unshift( ' 63 | while IFS='' read -r line || [ -n "$line" ]; do 64 | if echo "$line" | grep -q "NaN"; then continue; fi 65 | if [ "$4" == "date-day" ]; then 66 | datapoint="{ x: moment(\"""$(echo "$line" | awk 'BEGIN{FS=","}{ print $1 }' | awk '{$1=$1};1')""\", \"YYYY-MM-DD\"), y: ""$(echo "$line" | awk 'BEGIN{FS=","}{ print $2 }' | awk '{$1=$1};1')"" }" 67 | else 68 | datapoint="{ x: moment.unix(""$(echo "$line" | awk 'BEGIN{FS=","}{ print $1 }' | awk '{$1=$1};1')""), y: ""$(echo "$line" | awk 'BEGIN{FS=","}{ print $2 }' | awk '{$1=$1};1')"" }" 69 | fi 70 | contents="$contents""$datapoint""," 71 | done < "$1" 72 | contents=$(echo "$contents" | sed 's/.$//') 73 | contents="$contents"");" 74 | printf "%s\\r\\n\\r\\n" "$contents" >> "$2" 75 | } 76 | 77 | 78 | #$1sql table $2 label column $3 count column $4 limit count $5 csv file $6 sql file $7 where clasue if needed 79 | WriteSuricataSqlLog_ToFile(){ 80 | { 81 | echo ".mode csv" 82 | echo ".output $5" 83 | } > "$6" 84 | echo "SELECT $2 FROM $1 $7 GROUP BY $2 ORDER BY $3 LIMIT $4;" >> "$6" 85 | } 86 | 87 | #$1 csv file $2 JS file $3 JS func name $4 html tag 88 | WriteSuricataCSV_ToJS_Table() { 89 | #clean up any null (or "") strings with null string 90 | sed -i 's/""/null/g' "$1" 91 | sed -i 's/"//g' "$1" 92 | 93 | [ -f $2 ] && rm -f "$2" 94 | echo "function $3(){" >> "$2" 95 | html='document.getElementById("'"$4"'").outerHTML="' 96 | numLines="$(wc -l < $1)" 97 | if [ "$numLines" -lt 1 ]; then 98 | html="$html""No data to display" 99 | else 100 | html="$html""$(cat "$1" | awk 'BEGIN{FS=","}{ print "" $1 "" $2 ""$3 "" $4 "" $5 "" $6 "" $7 "" $8 " \\" }' | awk '{$1=$1};1')" 101 | fi 102 | html=${html%?} 103 | html="$html"'"' 104 | printf "%s}" "$html" >> "$2" 105 | } 106 | 107 | #$1 fieldname $2 tablename $3 frequency (hours) $4 length (days) $5 outputfile $6 sqlfile 108 | WriteSql_ToFile(){ 109 | { 110 | echo ".mode csv" 111 | echo ".output $5" 112 | } >> "$6" 113 | COUNTER=0 114 | timenow="$(date '+%s')" 115 | until [ $COUNTER -gt "$((24*$4/$3))" ]; do 116 | echo "select $timenow - ((60*60*$3)*($COUNTER)),IFNULL(avg([$1]),'NaN') from $2 WHERE ([Timestamp] >= $timenow - ((60*60*$3)*($COUNTER+1))) AND ([Timestamp] <= $timenow - ((60*60*$3)*$COUNTER));" >> "$6" 117 | COUNTER=$((COUNTER + 1)) 118 | done 119 | } 120 | 121 | Generate_SuricataStats () { 122 | 123 | echo "Suricata Stats generated on $(date +"%c")" > $statsTitleFile 124 | WriteStats_ToJS "$statsTitleFile" "$statsTitleFileJS" "SetSuricataStatsTitle" "suricatastatstitle" 125 | 126 | #generate Threat Events 127 | echo "Calculating Threats data..." 128 | { 129 | echo ".mode csv" 130 | echo ".output /tmp/suricata-threats-monthly.csv" 131 | echo "select [date],SUM(count) from threat_log GROUP BY date ORDER BY date;" 132 | } > /tmp/suricata-threats-monthly.sql 133 | 134 | "$SQLITE3_PATH" "$dbLogs" < /tmp/suricata-threats-monthly.sql 135 | [ -f $statsThreatsFileJS ] && rm -f "$statsThreatsFileJS" 136 | WriteData_ToJS "/tmp/suricata-threats-monthly.csv" "$statsThreatsFileJS" "DatadivLineChartThreatsMonthly" "date-day" 137 | 138 | #generate table data for all known Threats 139 | echo "Outputting Threats ..." 140 | [ -f $statsThreatsHitsFileJS ] && rm -f $statsThreatsHitsFileJS 141 | whereString="" 142 | WriteSuricataSqlLog_ToFile "threat_log" "date, threat_id, threat_desc, threat_class, threat_priority, threat_src_ip, threat_dst_ip, count" "date DESC, count DESC" "250" "/tmp/suricata-threats.csv" "/tmp/suricata-threats.sql" "$whereString" 143 | "$SQLITE3_PATH" "$dbLogs" < /tmp/suricata-threats.sql 144 | dos2unix "/tmp/suricata-threats.csv" 145 | WriteSuricataCSV_ToJS_Table "/tmp/suricata-threats.csv" $statsThreatsHitsFileJS "LoadThreatsTable" "DatadivTableThreats" 146 | 147 | #cleanup temp files 148 | rm -f "/tmp/suricata-"*".csv" 149 | rm -f "/tmp/suricata-"*".sql" 150 | [ -f $statsTitleFile ] && rm -f $statsTitleFile 151 | } 152 | 153 | Auto_Startup(){ 154 | case $1 in 155 | create) 156 | if [ -f /jffs/scripts/post-mount ]; then 157 | STARTUPLINECOUNTEX=$(grep -cx "$SCRIPT_DIR/$SCRIPT_NAME_LOWER startup"' # '"$SCRIPT_NAME" /jffs/scripts/post-mount) 158 | 159 | if [ "$STARTUPLINECOUNTEX" -eq 0 ]; then 160 | echo "$SCRIPT_DIR/$SCRIPT_NAME_LOWER startup"' # '"$SCRIPT_NAME" >> /jffs/scripts/post-mount 161 | fi 162 | else 163 | echo "#!/bin/sh" > /jffs/scripts/post-mount 164 | echo "" >> /jffs/scripts/post-mount 165 | echo "$SCRIPT_DIR/$SCRIPT_NAME_LOWER startup"' # '"$SCRIPT_NAME" >> /jffs/scripts/post-mount 166 | chmod 0755 /jffs/scripts/post-mount 167 | fi 168 | ;; 169 | delete) 170 | if [ -f /jffs/scripts/post-mount ]; then 171 | STARTUPLINECOUNT=$(grep -c '# '"$SCRIPT_NAME" /jffs/scripts/post-mount) 172 | 173 | if [ "$STARTUPLINECOUNT" -gt 0 ]; then 174 | sed -i -e '/# '"$SCRIPT_NAME"'/d' /jffs/scripts/post-mount 175 | fi 176 | fi 177 | ;; 178 | esac 179 | } 180 | 181 | Auto_Cron(){ 182 | case $1 in 183 | create) 184 | STARTUPLINECOUNT=$(cru l | grep -c "$SCRIPT_NAME") 185 | 186 | if [ "$STARTUPLINECOUNT" -eq 0 ]; then 187 | cru a "$SCRIPT_NAME" "14 * * * * $SCRIPT_DIR/$SCRIPT_NAME_LOWER generate" 188 | fi 189 | STARTUPLINECOUNT=$(cru l | grep -c "$LOGSCRIPT_NAME") 190 | 191 | if [ "$STARTUPLINECOUNT" -eq 0 ]; then 192 | cru a "$LOGSCRIPT_NAME" "13 * * * * $SCRIPT_DIR/$LOGSCRIPT_NAME_LOWER" 193 | fi 194 | ;; 195 | delete) 196 | STARTUPLINECOUNT=$(cru l | grep -c "$SCRIPT_NAME") 197 | 198 | if [ "$STARTUPLINECOUNT" -gt 0 ]; then 199 | cru d "$SCRIPT_NAME" 200 | fi 201 | STARTUPLINECOUNT=$(cru l | grep -c "$LOGSCRIPT_NAME") 202 | 203 | if [ "$STARTUPLINECOUNT" -gt 0 ]; then 204 | cru d "$LOGSCRIPT_NAME" 205 | fi 206 | ;; 207 | esac 208 | } 209 | 210 | Auto_ServiceEvent(){ 211 | case $1 in 212 | create) 213 | if [ -f /jffs/scripts/service-event ]; then 214 | # shellcheck disable=SC2016 215 | STARTUPLINECOUNTEX=$(grep -cx "$SCRIPT_DIR/$SCRIPT_NAME_LOWER generate"' "$1" "$2" &'' # '"$SCRIPT_NAME" /jffs/scripts/service-event) 216 | 217 | if [ "$STARTUPLINECOUNTEX" -eq 0 ]; then 218 | # shellcheck disable=SC2016 219 | echo "$SCRIPT_DIR/$SCRIPT_NAME_LOWER generate"' "$1" "$2" &'' # '"$SCRIPT_NAME" >> /jffs/scripts/service-event 220 | fi 221 | else 222 | echo "#!/bin/sh" > /jffs/scripts/service-event 223 | echo "" >> /jffs/scripts/service-event 224 | # shellcheck disable=SC2016 225 | echo "/jffs/scripts/$SCRIPT_NAME_LOWER generate"' "$1" "$2" &'' # '"$SCRIPT_NAME" >> /jffs/scripts/service-event 226 | chmod 0755 /jffs/scripts/service-event 227 | fi 228 | ;; 229 | delete) 230 | if [ -f /jffs/scripts/service-event ]; then 231 | STARTUPLINECOUNT=$(grep -c '# '"$SCRIPT_NAME" /jffs/scripts/service-event) 232 | 233 | if [ "$STARTUPLINECOUNT" -gt 0 ]; then 234 | sed -i -e '/# '"$SCRIPT_NAME"'/d' /jffs/scripts/service-event 235 | fi 236 | fi 237 | ;; 238 | esac 239 | } 240 | 241 | 242 | Create_Dirs(){ 243 | 244 | if [ ! -d "$SCRIPT_WEBPAGE_DIR" ]; then 245 | mkdir -p "$SCRIPT_WEBPAGE_DIR" 246 | fi 247 | 248 | if [ ! -d "$SCRIPT_WEB_DIR" ]; then 249 | mkdir -p "$SCRIPT_WEB_DIR" 250 | fi 251 | } 252 | 253 | Get_WebUI_Installed () { 254 | md5_installed="0" 255 | if [ -f $installedMD5File ]; then 256 | md5_installed="$(cat $installedMD5File)" 257 | fi 258 | } 259 | 260 | Get_WebUI_Page () { 261 | for i in 1 2 3 4 5 6 7 8 9 10; do 262 | page="$SCRIPT_WEBPAGE_DIR/user$i.asp" 263 | if [ ! -f "$page" ] || [ "$(md5sum < "$1")" = "$(md5sum < "$page")" ] || [ "$2" = "$(md5sum < "$page")" ]; then 264 | MyPage="user$i.asp" 265 | return 266 | fi 267 | done 268 | MyPage="none" 269 | } 270 | 271 | Mount_WebUI(){ 272 | if nvram get rc_support | grep -qF "am_addons"; then 273 | Get_WebUI_Installed 274 | Get_WebUI_Page "$SCRIPT_DIR/suricatastats_www.asp" "$md5_installed" 275 | if [ "$MyPage" = "none" ]; then 276 | echo "Unable to mount $SCRIPT_NAME WebUI page, exiting" 277 | exit 1 278 | fi 279 | echo "Mounting $SCRIPT_NAME WebUI page as $MyPage" 280 | cp -f "$SCRIPT_DIR/suricatastats_www.asp" "$SCRIPT_WEBPAGE_DIR/$MyPage" 281 | echo "Saving MD5 of installed file $SCRIPT_DIR/suricatastats_www.asp to $installedMD5File" 282 | md5sum < "$SCRIPT_DIR/suricatastats_www.asp" > $installedMD5File 283 | 284 | if [ ! -f "/tmp/index_style.css" ]; then 285 | cp -f "/www/index_style.css" "/tmp/" 286 | fi 287 | 288 | if ! grep -q '.menu_Addons' /tmp/index_style.css ; then 289 | echo ".menu_Addons { background: url(ext/shared-jy/addons.png); }" >> /tmp/index_style.css 290 | fi 291 | 292 | umount /www/index_style.css 2>/dev/null 293 | mount -o bind /tmp/index_style.css /www/index_style.css 294 | 295 | if [ ! -f "/tmp/menuTree.js" ]; then 296 | cp -f "/www/require/modules/menuTree.js" "/tmp/" 297 | fi 298 | 299 | sed -i "\\~$MyPage~d" /tmp/menuTree.js 300 | 301 | if ! grep -q 'menuName: "Addons"' /tmp/menuTree.js ; then 302 | lineinsbefore="$(( $(grep -n "exclude:" /tmp/menuTree.js | cut -f1 -d':') - 1))" 303 | sed -i "$lineinsbefore"'i,\n{\nmenuName: "Addons",\nindex: "menu_Addons",\ntab: [\n{url: "ext/shared-jy/redirect.htm", tabName: "Help & Support"},\n{url: "NULL", tabName: "__INHERIT__"}\n]\n}' /tmp/menuTree.js 304 | fi 305 | 306 | if ! grep -q "javascript:window.open('/ext/shared-jy/redirect.htm'" /tmp/menuTree.js ; then 307 | sed -i "s~ext/shared-jy/redirect.htm~javascript:window.open('/ext/shared-jy/redirect.htm','_blank')~" /tmp/menuTree.js 308 | fi 309 | sed -i "/url: \"javascript:window.open('\/ext\/shared-jy\/redirect.htm'/i {url: \"$MyPage\", tabName: \"Suricata\"}," /tmp/menuTree.js 310 | 311 | umount /www/require/modules/menuTree.js 2>/dev/null 312 | mount -o bind /tmp/menuTree.js /www/require/modules/menuTree.js 313 | fi 314 | } 315 | 316 | Unmount_WebUI(){ 317 | Get_WebUI_Installed 318 | Get_WebUI_Page "$SCRIPT_DIR/suricatastats_www.asp" "$md5_installed" 319 | echo "$MyPage" 320 | if [ -n "$MyPage" ] && [ "$MyPage" != "none" ] && [ -f "/tmp/menuTree.js" ]; then 321 | sed -i "\\~$MyPage~d" /tmp/menuTree.js 322 | umount /www/require/modules/menuTree.js 323 | mount -o bind /tmp/menuTree.js /www/require/modules/menuTree.js 324 | rm -rf "$SCRIPT_WEBPAGE_DIR/$MyPage" 325 | rm -rf "$SCRIPT_WEB_DIR" 326 | fi 327 | } 328 | 329 | # $1 show commands 330 | ScriptHeader() { 331 | printf "\\n" 332 | printf "##\\n" 333 | printf "##Suricata Stats\\n" 334 | printf "## by @juched - Generate Stats for GUI tab - %s \\n" "$SCRIPT_VERSION" 335 | printf "## with credit to @JackYaz for his shared scripts \\n" 336 | printf "\\n" 337 | if [ ! -z $1 ]; then 338 | printf "suricata_stats.sh\\n" 339 | printf " install - Installs the needed files to show UI and update stats\\n" 340 | printf " generate - enerates statistics now for UI\\n" 341 | printf " uninstall - Removes files needed for UI and stops stats update\\n" 342 | fi 343 | } 344 | 345 | Download_File(){ 346 | /usr/sbin/curl -fsL --retry 3 "$1" -o "$2" 347 | } 348 | 349 | Install_Dependancies(){ 350 | #install SQLite if not installed 351 | if [ ! -f /opt/bin/sqlite3 ]; then 352 | echo "Installing required version of sqlite3 from Entware" 353 | opkg update 354 | opkg install sqlite3-cli 355 | fi 356 | 357 | # make shared JY charts directory, and download if needed 358 | if [ ! -d "$SHARED_DIR" ]; then 359 | echo "Shared JY directory doesn't exist, let's make it..." 360 | mkdir "$SHARED_DIR" 361 | fi 362 | if [ ! -f "$SHARED_DIR/shared-jy.tar.gz.md5" ]; then 363 | Download_File "$SHARED_REPO/shared-jy.tar.gz" "$SHARED_DIR/shared-jy.tar.gz" 364 | Download_File "$SHARED_REPO/shared-jy.tar.gz.md5" "$SHARED_DIR/shared-jy.tar.gz.md5" 365 | tar -xzf "$SHARED_DIR/shared-jy.tar.gz" -C "$SHARED_DIR" 366 | rm -f "$SHARED_DIR/shared-jy.tar.gz" 367 | echo "New version of shared-jy.tar.gz downloaded" 368 | else 369 | localmd5="$(cat "$SHARED_DIR/shared-jy.tar.gz.md5")" 370 | remotemd5="$(curl -fsL --retry 3 "$SHARED_REPO/shared-jy.tar.gz.md5")" 371 | if [ "$localmd5" != "$remotemd5" ]; then 372 | Download_File "$SHARED_REPO/shared-jy.tar.gz" "$SHARED_DIR/shared-jy.tar.gz" 373 | Download_File "$SHARED_REPO/shared-jy.tar.gz.md5" "$SHARED_DIR/shared-jy.tar.gz.md5" 374 | tar -xzf "$SHARED_DIR/shared-jy.tar.gz" -C "$SHARED_DIR" 375 | rm -f "$SHARED_DIR/shared-jy.tar.gz" 376 | echo "New version of shared-jy.tar.gz downloaded" 377 | fi 378 | fi 379 | 380 | #Symlink the shared jy folder if it doesn't exist 381 | if [ ! -d "$SHARED_WEB_DIR" ]; then 382 | ln -s "$SHARED_DIR" "$SHARED_WEB_DIR" 2>/dev/null 383 | fi 384 | } 385 | 386 | #Main loop 387 | if [ -z "$1" ]; then 388 | ScriptHeader show_commands 389 | exit 0 390 | fi 391 | 392 | ScriptHeader 393 | case "$1" in 394 | install) 395 | Install_Dependancies 396 | Auto_Startup create 397 | Auto_ServiceEvent create 398 | Auto_Cron create 399 | Mount_WebUI 400 | Create_Dirs 401 | sh /jffs/addons/suricata/suricata_log.sh 402 | Generate_SuricataStats 403 | exit 0 404 | ;; 405 | startup) 406 | Auto_Cron create 407 | Mount_WebUI 408 | Create_Dirs 409 | Generate_SuricataStats 410 | exit 0 411 | ;; 412 | generate) 413 | if [ -z "$2" ] && [ -z "$3" ]; then 414 | Generate_SuricataStats 415 | elif [ "$2" = "start" ] && [ "$3" = "$SCRIPT_NAME_LOWER" ]; then 416 | Generate_SuricataStats 417 | fi 418 | exit 0 419 | ;; 420 | uninstall) 421 | Auto_Startup delete 422 | Auto_ServiceEvent delete 423 | Auto_Cron delete 424 | Unmount_WebUI 425 | [ -f $installedMD5File ] && rm -f $installedMD5File 426 | [ -f $dbLogs ] && rm -f $dbLogs 427 | exit 0 428 | ;; 429 | esac 430 | -------------------------------------------------------------------------------- /suricata_update.sh: -------------------------------------------------------------------------------- 1 | #! /bin/sh 2 | curl -o /opt/etc/suricata/classification.config https://rules.emergingthreats.net/open/suricata-4.0/rules/classification.config 3 | curl -SL https://rules.emergingthreats.net/open/suricata-4.0/emerging.rules.tar.gz | tar -zxC /opt/var/lib/suricata/ 4 | sleep 2s 5 | /opt/etc/init.d/S82suricata stop 6 | sleep 2s 7 | /opt/etc/init.d/S82suricata start 8 | -------------------------------------------------------------------------------- /suricatastats_www.asp: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | Suricata Statistics 11 | 12 | 13 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 784 | 785 | 786 |
787 | 788 | 789 |
790 | 791 | 792 | 793 | 794 | 795 | 796 | 797 | 798 | "> 799 | "> 800 | 801 | 802 | 803 | 804 | 807 | 887 | 888 |
  805 | 806 | 808 | 809 | 810 | 811 | 884 | 885 |
812 | 813 | 814 | 815 | 881 | 882 | 883 |
816 |
 
817 |
Suricata Statistics
818 | 819 | 820 | 827 | 828 |
821 | 822 |       823 | 824 |       825 | 826 |
829 | 830 | 831 | 832 | 833 | 834 | 835 | 836 | 837 | 838 | 841 | 842 |
Threats Detected Last 30 days (click to expand/collapse)
839 |
840 |
843 |
 
844 | 845 | 846 | 847 | 848 | 849 | 850 | 876 | 877 |
Threats Detected Last 30 days (click to expand/collapse) - limited to 250
851 | 852 | 853 | 854 | 855 | 856 | 857 | 858 | 859 | 860 | 861 | 862 | 863 | 864 | 865 | 866 | 867 | 868 | 869 | 870 | 871 | 872 | 873 | 874 |
DateIDDescriptionClassificationPrioritySource IPDestintation IPCount
875 |
878 |
 
879 | 880 |
886 |
889 |
890 | 892 | 893 | 894 | --------------------------------------------------------------------------------