Tag Feature question

[Josh Blender <jsblists () gmail com>]

Hi, I'm a pretty new Snort user and I'm trying to get the "tag:" feature to
work so that I can capture the entire connection once a packet triggers a
rule.

Unfortunately, I've tested this in several ways, and I simply can't get this
tag feature to work.  In local.rules, I have:

tagtest tcp any any -> {ip address} 80 (content:"/{url}";
tag:host,5,packets,src; sid:100002; rev:1)

and I have a dedicated log file for catching this rule:

ruletype tagtest
{
        type log
        output log_tcpdump: tagtest.log
}

I've also tried using "tag:session,10,seconds" and various output methods
(not database, as I understand that does not work properly).

No matter what I do, I can not get Snort to log more than the first packet.
 The rule works perfectly - it triggers on traffic that I want it to trigger
on, and it writes to the log files perfectly, but it just will NOT log
anything more than 1 packet no matter what I do.  Are there any preprocessor
directives that are required to let tagging work?  Anything else I might be
missing that might prevent this from working?

Thank you,
Josh B

------------------------------------------------------------------------------
Free Software Download: Index, Search & Analyze Logs and other IT data in 
Real-Time with Splunk. Collect, index and harness all the fast moving IT data 
generated by your applications, servers and devices whether physical, virtual
or in the cloud. Deliver compliance at lower cost and gain new business 
insights. http://p.sf.net/sfu/splunk-dev2dev

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users