Snort mailing list archives
Re: Capturing incoming packets?
From: guano () hackerfactor com
Date: Fri, 13 Jun 2003 21:42:12 -0600 (MDT)
Hi Erek, Unfortunately, the option you provided will not work:
snort -l <logdir> -b 'not net <local_lan>'
This will filter out things that I want to capture, such as someone initiating a port scan against my network. In addition, this command does not take sessions or initiation direction into account. What I have is a WAN connection (e.g., cable modem or DSL) and a firewall with NAT protecting the LAN. The firewall logs only the basics (when, what) but not the details (packet content, fractional packets, anything TCP beyond SYN). My Linux IDS is tapped into the area between the WAN connection and the firewall (e.g., DMZ). So it is in a position to see all traffic leaving the firewall, as well as everything that comes toward the firewall. In particular, it is in a position to see everything that does not make it though the firewall. What I want to capture are only the packets that are: (1) Heading toward the firewall from the WAN, *and* (2) Not in reply to anything sent out from the firewall/NAT. Thus, only unrequested packets (sniffs, attacks, "something unexpected") will be captured. Are there other options? -guano
On Fri, 13 Jun 2003 guano () hackerfactor com wrote: [...snip...]I really want to capture "everything that is initiated from the outside world". Including UDP, TCP, and ICMP (ARP isn't important to me). Basically, I want to capture everything that is not part of a session initiated by me. - Keeping track of TCP sessions is feasible. - Keeping track of UDP and ICMP sessions (since they are stateless) is a little more difficult. I'm thinking it would keep track of host/port in a finite timeframe. Is this possible already?Yep. snort -l <logdir> -b 'not net <local_lan>' Cheers! ----- Erek Adams "When things get weird, the weird turn pro." H.S. Thompson
------------------------------------------------------- This SF.NET email is sponsored by: eBay Great deals on office technology -- on eBay now! Click here: http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Capturing incoming packets? guano (Jun 13)
- Re: Capturing incoming packets? Erek Adams (Jun 13)
- Re: Capturing incoming packets? guano (Jun 13)
- Re: Capturing incoming packets? Erek Adams (Jun 14)
- Re: Capturing incoming packets? guano (Jun 14)
- Re: Capturing incoming packets? Erek Adams (Jun 16)
- Re: Capturing incoming packets? guano (Jun 13)
- Re: Capturing incoming packets? Erek Adams (Jun 13)