Re: Logging Reassembled Packets

[Martin Roesch <roesch () sourcefire com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I haven't looked at tcpdump's code in a long time but I think  
Daemonlogger and tcpdump's performance will be very similar.  I  
haven't taken any pains to accelerate anything in Daemonlogger, it's  
simply an interface between libpcap, libdnet and the disk.  IIRC,  
tcpdump when in "-w" mode wrote pretty directly to the disk with  
almost no code overhead if it wasn't being asked to do anything else.   
The chief advantage of Daemonlogger is that it's only about 900 lines  
of code and it probably has more logfile management features than  
tcpdump, although I haven't been keeping up with recent releases of  
that codebase.

        -Marty


On Mar 14, 2008, at 12:07 AM, Jeremy wrote:

> Not trying to steal the thread here, but I have to ask since I have
> never really stress tested damonlogger. Do you all think it performs
> better than tcpdump at writing packets to disk?  This never crossed my
> mine to evaluate before now, as I have only used damonlogger to play
> traffic out another interface....  If yes, any document on this claim
> out there?  Running to Google now to see if I can't find something on
> this while I wait for responses ;)
>
> --jeremy
>
> On Thu, Mar 13, 2008 at 8:40 PM, Martin Roesch  
> <roesch () sourcefire com> wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > Correction.  You should use Daemonlogger!
> >
> > :)
> >
> >        -Marty
> >
> >
> >
> > On Mar 13, 2008, at 8:20 PM, Jason wrote:
> >
> > > snort is not intended to log full reassembled streams, it is
> > > intended to
> > > detect intrusion attempts and log the relevant data associated with
> > > those attempts. If you want full session logging you should use
> > > tcpdump.
> > >
> > > Kamran Shafi wrote:
> > > > I notice that there is a show_rebuilt_packets option in  
> > > > steam5_global
> > > > configuration, which I have turned on but don't know if it is
> > > > producing
> > > > anything. I run snort on some traffic collected on a web/dns/mysql
> > > > server
> > > > using -r flag. The log shows that snort filters out the server's
> > > > response
> > > > and keeps only the inbound traffic - I am not sure if this
> > > > behaviour is
> > > > because of the stream 5 processor or else?
> > > >
> > > > On Fri, Mar 14, 2008 at 12:56 AM, Joel Esler <joel.esler () sourcefire com
> > > > >
> > > > wrote:
> > > >
> > > > > Again, a visit to the readme's in the doc/ directory should help
> > > > > you.
> > > > > Look up "log_flushed_streams" in the stream4 readme.
> > > > > Joel
> > > > >
> > > > >  On Mar 13, 2008, at 2:36 AM, Kamran Shafi wrote:
> > > > >
> > > > > Hi All,
> > > > >
> > > > > Is there a way to log the reassembled (TCP/UDP/ICMP) sessions in
> > > > > Snort?
> > > > >
> > > > > --
> > > > > Regards
> > > > > Kam
> > > > > -------------------------------------------------------------------------
> > > > > This SF.net email is sponsored by: Microsoft
> > > > > Defy all challenges. Microsoft(R) Visual Studio 2008.
> > > > >
> > > > > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/_______________________________________________
> > > > > Snort-users mailing list
> > > > > Snort-users () lists sourceforge net
> > > > > Go to this URL to change user options or unsubscribe:
> > > > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > > > Snort-users list archive:
> > > > > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> > > > >
> > > > >
> > > > >
> > > > > --
> > > > > Joel Esler  joel.esler () sourcefire com
> > > >
> > > >
> > > >
> > > > ------------------------------------------------------------------------
> > > >
> > > > -------------------------------------------------------------------------
> > > > This SF.net email is sponsored by: Microsoft
> > > > Defy all challenges. Microsoft(R) Visual Studio 2008.
> > > > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> > > >
> > > >
> > > > ------------------------------------------------------------------------
> > > >
> > > > _______________________________________________
> > > > Snort-users mailing list
> > > > Snort-users () lists sourceforge net
> > > > Go to this URL to change user options or unsubscribe:
> > > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > > Snort-users list archive:
> > > > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> > >
> > > -------------------------------------------------------------------------
> > > This SF.net email is sponsored by: Microsoft
> > > Defy all challenges. Microsoft(R) Visual Studio 2008.
> > > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> > > _______________________________________________
> > > Snort-users mailing list
> > > Snort-users () lists sourceforge net
> > > Go to this URL to change user options or unsubscribe:
> > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > Snort-users list archive:
> > > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >
> > - --
> > Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
> > Sourcefire - Security for the Real World - http://www.sourcefire.com
> > Snort: Open Source IDP - http://www.snort.org
> >
> >
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.4.7 (Darwin)
> >
> > iD8DBQFH2degqj0FAQQ3KOARAoGaAJ0Qunysz07riv/NwgSEyvkXuaKmvwCfRmjD
> > 9vfsXaAbtb93a6aPRD4QPso=
> > =dxrz
> > -----END PGP SIGNATURE-----
> >
> >
> >
> > -------------------------------------------------------------------------
> > This SF.net email is sponsored by: Microsoft
> > Defy all challenges. Microsoft(R) Visual Studio 2008.
> > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

- --
Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
Sourcefire - Security for the Real World - http://www.sourcefire.com
Snort: Open Source IDP - http://www.snort.org


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (Darwin)

iD8DBQFH2oVeqj0FAQQ3KOARAqIFAJ4ut4S/IUJAnMA6BNkAyDtrLB/hSACeLs+3
Dfumb249lxumVuVDMEJrkMw=
=D0iq
-----END PGP SIGNATURE-----

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users