Re: 1.8.6 and tcpdump format

[Erek Adams <erek () theadamsfamily net>]

On Wed, 22 May 2002, Jeremy wrote:

>   I recently switched from 1.8.3 to 1.8.6 and I'm running into a problem.
> With 1.8.3 I was able to use the -b flag and also have snort create a
> directory with the attacking IP's name and log the packet. Now when I run
> snort with the -b flag I no longer get the packet logged to the directory.
> In fact the directory is not created at all. If I simply take away the -b
> flag things work as expected.

That was actually a 'bug fix'.  :)  Decoding to disk while also writing in -b
mode was large speed bottleneck.

>   I'm using snort to monitor a honeypot so I'm trying to grab as much info
> as possible, is this combination of features no longer supported?

Not really needed.  If you use -b for binary logging, you get a copy of the
entire packet sent to the output functions.  Assuming you've got 'output
log_tcpdump: snort.log' in your snort.conf there will be a pcap style file in
the log directory.  Once you stop snort, you can run it like 'snort -ader
<filename> -l /logs/snort' and it will dump out all packets into the
directories like you want.

You're still getting all the info, it's just formatted differently.  :)

Cheers!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________________________

Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users