Snort mailing list archives
Re: log single packet vs reassmbled stream
From: "Alex Butcher, ISC/ISYS" <Alex.Butcher () bristol ac uk>
Date: Tue, 05 Oct 2004 08:42:02 +0100
--On 04 October 2004 12:23 +0100 "Alex Butcher, ISC/ISYS" <Alex.Butcher () bristol ac uk> wrote:
--On 04 October 2004 03:57 -0700 Thomas Anderson <neo_ait () yahoo com> wrote:I know about the tag keyword..... Is there any other way so that the entire session can be logged, if alert is generated in any of its packet.... The tag keyword only log packets after the alert generated.. and that to i have to specify the number of packets to log afterwards.. Actually I want to log the content of the entire session when any of its packet is alerted......sguil can integrate snort with tcpdump, apparently. I've thought about doing something similar using flexresp, tethereal (in ring-log-file mode) and a shell script or similar.
Oh, and if you have real money to spend, then Niksun's <http://www.niksun.com/> NetVCR might be handy. Never used it, but I have had conversations with their engineers in the past.
Regards Thomas
Best Regards, Alex. -- Alex Butcher: Security & Integrity, Personal Computer Systems Group Information Systems and Computing GPG Key ID: F9B27DC9 GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9 ------------------------------------------------------- This SF.net email is sponsored by: IT Product Guide on ITManagersJournal Use IT products in your business? Tell us what you think of them. Give us Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more http://productguide.itmanagersjournal.com/guidepromo.tmpl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- log single packet vs reassmbled stream Thomas Anderson (Oct 03)
- Re: log single packet vs reassmbled stream Alex Butcher, ISC/ISYS (Oct 04)
- Re: log single packet vs reassmbled stream Thomas Anderson (Oct 04)
- Re: log single packet vs reassmbled stream Alex Butcher, ISC/ISYS (Oct 04)
- Re: log single packet vs reassmbled stream Jason Haar (Oct 04)
- Re: log single packet vs reassmbled stream Thomas Anderson (Oct 04)
- Re: log single packet vs reassmbled stream Alex Butcher, ISC/ISYS (Oct 05)
- Re: log single packet vs reassmbled stream Thomas Anderson (Oct 04)
- Re: log single packet vs reassmbled stream Alex Butcher, ISC/ISYS (Oct 04)