Re: Tagged Packet ... AAAHHH

[Joel Esler <joel.esler () sourcefire com>]

Dirk is right.  It could be a reassembled packet logging as well.   
There's nothing wrong with having "tag" in a rule (I referenced  
bleedingsnort.com, as there are alot of good rules over there that  
use "tag", to capture more of a referenced alert, it wasn't a hit on  
bleedingsnort.com, it's just a reference)

As a good friend of mine told me, "old snort used to reassemble  
attacks into a "pseudo" packet and that is what you got as an alert.   
These days you will get the member packets instead of the pseudo  
packet".  So if you have an alert that is generated, stream4 will  
give you the "after packets" instead of the "one pseudo" packet.   
Those "after packets" are called "tagged packet"

J




On Oct 30, 2005, at 3:19 AM, Dirk Geschke wrote:

> Hi Michael,
>
>
> > I believe I have suppressed alerts for "Tagged Packet" as I do not  
> > see
> > them in the alert file, however. In the web GUI provided by BASE I  
> > can
> > see that "Tagged Packet" appears to be logged still.
> >
> > I must be misunderstanding something here, can anyone help me out ?
>
> I think this are reassembled packets from stream4. If you use the
> unified output plugin these packets are split to the original size.
> The first packet carries the alert informations, the others are marked
> as tagged packets.
>
> Best regards
>
> Dirk
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by the JBoss Inc.
> Get Certified Today * Register for a JBoss Training Course
> Free Certification Exam for All Training Attendees Through End of 2005
> Visit http://www.jboss.com/services/certification for more information
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.
Get Certified Today * Register for a JBoss Training Course
Free Certification Exam for All Training Attendees Through End of 2005
Visit http://www.jboss.com/services/certification for more information
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users