Snort mailing list archives
Re: Request for help in changing packet capture filenames under Snort 1.9
From: Frank Knobbe <fknobbe () knobbeits com>
Date: 02 Dec 2002 13:57:08 -0600
On Mon, 2002-12-02 at 12:34, Matt Yackley wrote:
For those of us running snort on linux and then archiving data to a Win32 machine, the "proto:port-port" filename that is created for packet capture files will not work for Windows. In snort 1.8.x this was fairly simple to change by editing a line in the log.c file then compiling, etc. However in snort 1.9 this has changed and I can't find out where to change this option. I've tried posting to this list about a month ago and also to snort-developers but no one has answered yet or have been able to find the answer I should say.
Open spo_log_ascii.c in src/output-plugins. In the OpenLogFile function you'll see: #ifdef WIN32 snprintf(log_file, STD_BUF, "%s/%s_%d-%d%s", log_path, protocol_names[p->iph->ip_proto], p->sp, p->dp, suffix); #else snprintf(log_file, STD_BUF, "%s/%s:%d-%d%s", log_path, protocol_names[p->iph->ip_proto], p->sp, p->dp, suffix); #endif } else { #ifdef WIN32 snprintf(log_file, STD_BUF, "%s/%s_%d-%d%s", log_path, protocol_names[p->iph->ip_proto], p->dp, p->sp, suffix); #else snprintf(log_file, STD_BUF, "%s/%s:%d-%d%s", log_path, protocol_names[p->iph->ip_proto], p->dp, p->sp, suffix); #endif Change those to whatever you want to appear in the log files (i.e. change the : to a - or _ or whatever). Then recompile. Frank
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- Request for help in changing packet capture filenames under Snort 1.9 Matt Yackley (Dec 02)
- Re: Request for help in changing packet capture filenames under Snort 1.9 Frank Knobbe (Dec 02)