sensor id value about py-idstools HOT 3 CLOSED

A better tool to verify the sensor_id would be Snort's own u2spewfoo. In all my logs, both u2spewfoo and u2json show a sensor_id of 0. I suspect that Barnyard2 is altering this value in some way, or the field you are seeing in the Dashboard is a different sensor id.

I believe the Barnyard database output will create new sensor IDs in the database in an incrementing fashion to distinguish between the different sensors logging to the database. This is outside the scope of a unified2 log file though.

from py-idstools.

In case anyone is curious and to clarify:

1. sensor id is a part of the Unified2 file format and it is in the packet and IDS events, see:
   http://manual.snort.org/node44.html
2. another project offered a clue for handling/setting sensor id,
   see the "Examples" section in readme at:
   https://github.com/mephux/unified2
   ... makes sense ... as these are set in the barnyard2 conf file and it appears barnyard2
   just uses the last digits of the "interface" value for the "sensor id" (sid ?)

from py-idstools.

Yeah, I was curious that there wasn't a Snort command line option or config option to set that sensor_id value in the unified2 file. Could be useful I suppose.

from py-idstools.