Snort mailing list archives
Re: Query on log_tcpdump
From: waldo kitty <wkitty42 () windstream net>
Date: Mon, 01 Sep 2014 22:00:09 -0400
On 9/1/2014 3:20 AM, Balasubramaniam Natarajan wrote:
Hi Would it be possible to write a rule on snort which will use "log_tcpdmp" from [1] if the rule matches the signature ? Else continue logging to the normal place where it was already.
i'm not aware of /snort/ being able to do this but external tools might be able to... consider that some of them can send alerts to one's portable device when certain alerts are emitted... -- NOTE: No off-list assistance is given without prior approval. Please *keep mailing list traffic on the list* unless private contact is specifically requested and granted. ------------------------------------------------------------------------------ Slashdot TV. Video for Nerds. Stuff that matters. http://tv.slashdot.org/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Query on log_tcpdump Balasubramaniam Natarajan (Sep 01)
- Re: Query on log_tcpdump waldo kitty (Sep 01)
- Re: Query on log_tcpdump Y M (Sep 01)
- Re: Query on log_tcpdump Balasubramaniam Natarajan (Sep 01)