Re: configure snort to drop payloads

[Lyle Sudin <lylesudin () yahoo com>]

Unfortunately the mandate is not to write ANY payload
data to disk so changing the snaplen will not satisfy
the requirements.

No one said this was going to be easy...

Thanks,
Lyle

--- Erek Adams <erek () theadamsfamily net> wrote:
> On Tue, 16 Apr 2002, Lyle Sudin wrote:
>
> > -P 64 prints the headers into the ASCII snort
> > directory hiarchy of ip addresses.  I need to be
> able
> > to print the packet headers (and only packet
> headers)
> > to a single file.  Preferably in the binary
> tcpdump
> > format.
> >
> >
> > Trying -P 64 with -b, seems to be the same as -b.
>
> Well...  Try using 68 instead.  After a bit of code
> digging, I realzied snort
> sets the min snaplen to 68.  I'm not 100% sure why
> (Any developers want to
> comment?), but I'd guess it would be to make sure
> that you have enough info
> from the header to correctly parse the packet thru
> any rules you might be
> running.  When I try it with -b -P 68, I get a
> smaller pcap file with 'some'
> extra data in there....  not much mind you, just a
> few bytes.  Hopefully that
> won't be too much for the privacy issues you were
> concerened with.
>
> Hope that helps!
>
> -----
> Erek Adams
> Nifty-Type-Guy
> TheAdamsFamily.Net


__________________________________________________
Do You Yahoo!?
Yahoo! Tax Center - online filing with TurboTax
http://taxes.yahoo.com/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users