Beefy Boxes and Bandwidth Generously Provided by pair Networks
Come for the quick hacks, stay for the epiphanies.
 
PerlMonks  

Re^2: Inserting domain name into Snort rule

by miniperl (Initiate)
on Oct 05, 2012 at 14:01 UTC ( [id://997481]=note: print w/replies, xml ) Need Help??


in reply to Re: Inserting domain name into Snort rule
in thread Inserting domain name into Snort rule

Im probably doing something wrong but I pulled out the join statement and plugged it in to a while loop to read the csv file and all I get are a bunch of |00|.


#!/usr/bin/perl

$work = "/var/tmp/work";
$input = "$work/domainlist.csv";

open (IN,"$input");
open (OUT,">domainlist.rules");
while (<IN>) {
  chomp();
  $domain = $_;

    print join '|', '', ( map { sprintf('%02d',length $domain), $domain } split /\./, shift ), '00', '';

}

Replies are listed 'Best First'.
Re^3: Inserting domain name into Snort rule
by aaron_baugher (Curate) on Oct 05, 2012 at 16:01 UTC

    That's because my code uses shift to get the first argument to the subroutine. If you take it out of the subroutine, you'll need to replace that shift with the variable that contains the value you want to split.

    Aaron B.
    Available for small or large Perl jobs; see my home node.

      First of all; thank you very much for your help. I did what you said and its very close but doing some weird stuff.

      Here's what I have:
      #!/usr/bin/perl

      $work = "/var/tmp/work";
      $input = "$work/domainlist.csv";

      open (IN,"$input");
      open (OUT,">domainlist.rules");
      while (<IN>) {
        chomp();
        $domain = $_;

          $dns = join '|', '', ( map { sprintf('%02d',length $_), $_ } split /\./, $domain ), '00', '';
            print "$dns\n";
      }

      What I get is something like this:


      |00|foobar|09|foodomain|04|com

      |00|www|06|foobar|12|foobardomain|03|cc


      If puts the zeros on the front instead of the end and doesn't give a count

      then it counts the next sections correctly

      then it always adds an extra count for the last part, maybe its counting a space or something

        The code as you've quoted it works fine when I give it a hardcoded domain:

        $domain = 'foobar.foodomain.com'; $dns = join '|', '', ( map { sprintf('%02d',length $_), $_ } split /\. +/, $domain ), '00', ''; print "$dns\n"; # prints: |06|foobar|09|foodomain|03|com|00|

        So I'd say you need to look at your input.

        Aaron B.
        Available for small or large Perl jobs; see my home node.

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://997481]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others perusing the Monastery: (5)
As of 2024-03-28 14:49 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found