Snort mailing list archives
RE: increase packet size capture problem
From: "Keith Pachulski" <keithp () corp ptd net>
Date: Tue, 26 Oct 2004 11:33:26 -0400
http://www.snort.org/docs/snort_manual/node16.html#SECTION00426000000000000000 -----Original Message----- From: Jeffrey Starin [mailto:jeffs () speakeasy net] Sent: Tuesday, October 26, 2004 11:28 AM To: snort-users () lists sourceforge net Subject: [Snort-users] increase packet size capture problem I have a rule that captures outgoing data and logs to a seperate file. Problem is that the data is truncated. That is, not all the data is captured. I am aware of the -P option to modify snaplen and also of "session" modifier, but changing these values doesn't seem to work -- I always end up with my outgoing data truncated. I'm presuming that the data that is truncated is being put into a subsequent outing going packet and the alert that generates the first capture cannot say, "Hey, also capture all associated packets." But I figured that's what the "session" keyword is for, but using it doesn't seem to help. Any help much appreciated. Thanks, bulgin ------------------------------------------------------- This SF.net email is sponsored by: IT Product Guide on ITManagersJournal Use IT products in your business? Tell us what you think of them. Give us Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more http://productguide.itmanagersjournal.com/guidepromo.tmpl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=ort-users
Current thread:
- increase packet size capture problem Jeffrey Starin (Oct 26)
- <Possible follow-ups>
- RE: increase packet size capture problem Keith Pachulski (Oct 26)