pevma / rule2alert Goto Github PK

python r2a.py -C /etc/suricata/suricata-debian.yaml -f rules/emerging-all.rules -e 1.2.3.4 -m 10.0.0.123 -w test.pcap -v
using Linux Mint
python-yaml, python-scapy are installed. Python 2.7.6 is installed.
Output errors from the above command can be found here: http://justpaste.it/obsk

This project should be rewritten in Python3 to be still valid nowadays...
Thanks!

I cat'd a bunch of rules into one file, and when r2a got to the flowbit's it error'd out.

Here is the last few lines:
Loaded 11277 rules succesfully!
Loading flowbits rules...
found only SET in flowbit name ET.HTTP.at.SSL 2013933,set,2013931,set,2013927,set,2013929,set,2013926,set,2013928,set,2013930,set,2013932,set
found only SET in flowbit name ms.rdp.established 2014386,set
found only SET in flowbit name ET.ass.request 2010757,set
found only SET in flowbit name ET.BotccIP 2404101,set,2404103,set,2404105,set,2404107,set,2404109,set,2404111,set,2404113,set,2404115,set,2404117,set,2404119,set,2404121,set,2404123,set,2404125,set,2404127,set,2404129,set,2404131,set,2404133,set,2404135,set,2404137,set,2404139,set,2404141,set,2404143,set,2404145,set,2404147,set
found only SET in flowbit name ET.zbot.ua.2106509 2016509,set
found only SET in flowbit name ET.bd1 2009240,set

I cloned the git and started the r2a out of the box, but it gave me the error of constructor returning value on following command.

sudo python r2a.py -m "192.168.1.170" -e "192.168.120.240" -f ~/rule2alert/rules/blacklist.rules -w blacklist.pcap

`Traceback (most recent call last):
File "r2a.py", line 96, in main
r = Rule(snort_rule)
TypeError: init() should return None
Parser failed - skipping rule

Loaded 0 rules succesfully!`
I tried to fix the code but to no avail. It build rules now but produces malformed packets. Could you please fix the issue.

Best regards