From owner-freebsd-questions@FreeBSD.ORG Tue Feb 19 22:04:53 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 1B34D16A41A for ; Tue, 19 Feb 2008 22:04:53 +0000 (UTC) (envelope-from pauls@utdallas.edu) Received: from smtp3.utdallas.edu (smtp3.utdallas.edu [129.110.10.49]) by mx1.freebsd.org (Postfix) with ESMTP id F2AC313C455 for ; Tue, 19 Feb 2008 22:04:52 +0000 (UTC) (envelope-from pauls@utdallas.edu) Received: from utd59514.utdallas.edu (utd59514.utdallas.edu [129.110.3.28]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp3.utdallas.edu (Postfix) with ESMTP id 6372665504 for ; Tue, 19 Feb 2008 16:04:52 -0600 (CST) Date: Tue, 19 Feb 2008 16:04:51 -0600 From: Paul Schmehl To: FreeBSD Questions Message-ID: In-Reply-To: <6.0.0.22.2.20080219123428.02425ec8@mail.computinginnovations.com> References: <6.0.0.22.2.20080219123428.02425ec8@mail.computinginnovations.com> X-Mailer: Mulberry/4.0.8 (Linux/x86) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Subject: Re: Shell scripting question - incrementing X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Feb 2008 22:04:53 -0000 --On Tuesday, February 19, 2008 12:41:43 -0600 Derek Ragona wrote: Thanks to all who offered suggestions. Here's a working script that creates snort rules *and* a sid-msg.map file: #!/bin/sh cat file.1 | cut -d',' -f9 | sort | uniq > file.nicks i=2000002 j=`wc -l file.nicks | awk '{print $1}'` k=$(( i + j - 1 )) (read line; echo "alert ip \$HOME_NET any -> \$EXTERNAL_NET any ( sid:2000001; msg:\" JOIN $line detected\"; classtype:trojan-activity; content:\"JOIN\"; content:$line; rev:1;)"; while read line && [ $i -le $k ]; do echo "alert ip \$HOME_NET any -> \$EXTERNAL_NET any (sid:$i; msg:\" JOIN $line detected\"; classtype:trojan-activity; content:\"JOIN\"; content:$line; rev:1;)"; i=`expr $i + 1`; done) < file.nicks > file.rules cat file.rules | cut -d':' -f2,3 | cut -d';' -f1,2 | sed 's/; msg:/ || /g' > file-sid-msg.map -- Paul Schmehl (pauls@utdallas.edu) Senior Information Security Analyst The University of Texas at Dallas http://www.utdallas.edu/ir/security/