RE: Snort outputing like tcpdump

["Christopher Lyon" <cslyon () netsvcs com>]

Is there a way not log the payload?


> -----Original Message-----
> From: Erek Adams [mailto:erek () snort org]
> Sent: Friday, January 17, 2003 5:54 AM
> To: Christopher Lyon
> Cc: snort-users () lists sourceforge net
> Subject: Re: [Snort-users] Snort outputing like tcpdump
>
> On Thu, 16 Jan 2003, Christopher Lyon wrote:
>
> > Can I have Snort output all packets that it sees to sql is the same
> > format that tcpdump uses?
>
> [...snip...]
>
> > I don't care about the payload just the raw stats. Any idea?
>
> It depends on what you want.
>
> tcpdump has a snaplen of 68 as a default.  Snort uses 1514 as a
default.
> You can change that with the -P parameter.
>
> Depending on what you want, snort can and will send the same data to
the
> DB.  The output doesn't really matter since it's going into a db.  You
> could modify the db output plugin, but that's a whole different thing!
>
> Cheers!
>
> -----
> Erek Adams
>
>    "When things get weird, the weird turn pro."   H.S. Thompson



-------------------------------------------------------
This SF.NET email is sponsored by: Thawte.com - A 128-bit supercerts will
allow you to extend the highest allowed 128 bit encryption to all your
clients even if they use browsers that are limited to 40 bit encryption.
Get a guide here:http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0030en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users