I'm having this problem with MySQL and I can't figure it out.  I'm hoping someone else can. 

Here is my select statement, it grabs it from a bunch of different snort tables and gives me the data I need.

mysql> select signature.sig_name, signature.sig_id, iphdr.ip_src,iphdr.ip_dst, event.cid FROM signature,event,iphdr where signature.sig_id = event.signature AND iphdr.cid = event.cid;
+------------------------------------------------------------+--------+------------+------------+---------+
| sig_name                                                   | sig_id | ip_src     | ip_dst     | cid     |
+------------------------------------------------------------+--------+------------+------------+---------+
| BLEEDING-EDGE POLICY SSH session in progress on usual Port |    509 | 3232236183 | 1122750440 | 1530172 |
+------------------------------------------------------------+--------+------------+------------+---------+
1 row in set (0.00 sec)

However, it's missing a bunch of stuff.  There's 4 lines in snort right now, but it only see's one.   Here is the breakdown.

mysql> select * from event;
+-----+---------+-----------+---------------------+
| sid | cid     | signature | timestamp           |
+-----+---------+-----------+---------------------+
|   2 | 1530123 |        20 | 2006-11-27 08:36:21 |
|   2 | 1530124 |        20 | 2006-11-27 08:36:23 |
|   2 | 1530125 |       237 | 2006-11-27 08:36:25 |
|   2 | 1530126 |       255 | 2006-11-27 08:36:26 |
|   2 | 1530127 |       488 | 2006-11-27 08:36:30 |
|   2 | 1530172 |       509 | 2006-11-27 08:39:09 |
+-----+---------+-----------+---------------------+
6 rows in set (0.00 sec)

mysql> select * from signature;
+--------+-------------------------------------------------------------------------+--------------+--------------+---------+---------+---------+
| sig_id | sig_name                                                                | sig_class_id | sig_priority | sig_rev | sig_sid | sig_gid |
+--------+-------------------------------------------------------------------------+--------------+--------------+---------+---------+---------+
|    499 | BLEEDING-EDGE POLICY Winamp Streaming User Agent                        |           18 |            1 |       1 | 2003168 |    NULL |
|    500 | BLEEDING-EDGE POLICY TLS/SSL Encrypted Application Data on Unusual Port |           20 |            2 |       5 | 2003020 |    NULL |
|    501 | (http_inspect) BARE BYTE UNICODE ENCODING                               |            0 |            3 |       1 |       4 |    NULL |
|    502 | BLEEDING-EDGE POLICY Gmail Message Send                                 |           18 |            1 |       4 | 2001426 |    NULL |
|    503 | (portscan) TCP Portsweep                                                |            0 |            3 |    NULL |       3 |    NULL |
|    504 | (http_inspect) OVERSIZE REQUEST-URI DIRECTORY                           |            0 |            3 |       1 |      15 |    NULL |
|    505 | INFO web bug 0x0 gif attempt                                            |            9 |            3 |       3 |    2925 |    NULL |
|    506 | (http_inspect) DOUBLE DECODING ATTACK                                   |            0 |            3 |       1 |       2 |    NULL |
|    507 | BLEEDING-EDGE POLICY iTunes User Agent                                  |           18 |            1 |       2 | 2002878 |    NULL |
|    508 | BLEEDING-EDGE POLICY SSH session in progress on Unusual Port            |            9 |            3 |       4 | 2001984 |    NULL |
|    509 | BLEEDING-EDGE POLICY SSH session in progress on usual Port              |            9 |            3 |       4 | 2001978 |    NULL |
+--------+-------------------------------------------------------------------------+--------------+--------------+---------+---------+---------+
11 rows in set (0.00 sec)

mysql> select * from iphdr;
+-----+---------+------------+------------+--------+---------+--------+--------+-------+----------+--------+--------+----------+---------+
| sid | cid     | ip_src     | ip_dst     | ip_ver | ip_hlen | ip_tos | ip_len | ip_id | ip_flags | ip_off | ip_ttl | ip_proto | ip_csum |
+-----+---------+------------+------------+--------+---------+--------+--------+-------+----------+--------+--------+----------+---------+
|   2 | 1530125 | 1209420570 | 3232236056 |      4 |       5 |      0 |   1500 | 23127 |        0 |      0 |    120 |        6 |   19668 |
|   2 | 1530126 | 3628685108 | 3232236050 |      4 |       5 |      0 |    190 | 51623 |        0 |      0 |    118 |        6 |   18522 |
|   2 | 1530127 | 3232236111 | 1089217591 |      4 |       5 |      0 |    166 | 39161 |        0 |      0 |    128 |        6 |   14654 |
|   2 | 1530172 | 3232236183 | 1122750440 |      4 |       5 |      0 |     40 | 17099 |        0 |      0 |    128 |        6 |   57841 |
+-----+---------+------------+------------+--------+---------+--------+--------+-------+----------+--------+--------+----------+---------+
4 rows in set (0.00 sec)