Snort mailing list archives
Unified Log Format
From: "Mario D. Santana" <mds () mariosantana net>
Date: Tue, 28 Jun 2005 15:52:46 -0400 (EDT)
Hi, all. I've written a patch to Ethereal to allow it to load unified output and display the alert information as a top-level protocol. This lets you do things like search agains snort.sig_generator, etc.
I'm not sure if this email should go to snort-dev, but I thought I'd give it a shot here first. BTW, if anyone wants to try out the patch, let me know off-list.
The patch is pretty functional, but I've run into a couple of snags. One of these seems to be related to the "fake" packets generated by snort to identify port scans. But sometimes strange things happen, such as finding signal IDs of 527 for generator ID 1 -- is this valid?
I've looked through the snort manual, the code, and other likely places. Any help or pointers would be appreciated.
TIA, mds ------------------------------------------------------- SF.Net email is sponsored by: Discover Easy Linux Migration Strategies from IBM. Find simple to follow Roadmaps, straightforward articles, informative Webcasts and more! Get everything you need to get up to speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Unified Log Format Mario D. Santana (Jun 28)
- Re: Unified Log Format Martin Roesch (Jun 28)
- Re: Unified Log Format Mario D. Santana (Jun 28)
- Re: Unified Log Format Martin Roesch (Jun 28)