Re: configure snort to drop payloads

[Erek Adams <erek () theadamsfamily net>]

On Tue, 16 Apr 2002, Lyle Sudin wrote:

> -P 64 prints the headers into the ASCII snort
> directory hiarchy of ip addresses.  I need to be able
> to print the packet headers (and only packet headers)
> to a single file.  Preferably in the binary tcpdump
> format.
>
>
> Trying -P 64 with -b, seems to be the same as -b.

Well...  Try using 68 instead.  After a bit of code digging, I realzied snort
sets the min snaplen to 68.  I'm not 100% sure why (Any developers want to
comment?), but I'd guess it would be to make sure that you have enough info
from the header to correctly parse the packet thru any rules you might be
running.  When I try it with -b -P 68, I get a smaller pcap file with 'some'
extra data in there....  not much mind you, just a few bytes.  Hopefully that
won't be too much for the privacy issues you were concerened with.

Hope that helps!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users