snort -r output

[Tay Chee Yong <tcy () pacific net sg>]

Hi list,

I am pretty new to snort, and i would like to find out how do I decode the
snort -r output?  Could anyone tell me what does hex value stand for, and
why are there "......."?

Basically, I am trying to find out the patterns of the packets, so that I
can match by the content in my rules.

04/21-16:02:57.719998 210.24.246.13:62764 -> 203.120.90.33:53
UDP TTL:124 TOS:0x0 ID:31492 IpLen:20 DgmLen:70
Len: 42
01 62 01 00 00 01 00 00 00 00 00 00 09 4D 41 52  .b...........MAR
4B 45 54 49 4E 47 07 61 6C 63 6F 74 65 63 00 00  KETING.alcotec..
01 00 01 00 00 00 00 00 00 00                    ..........

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

Appreciate any advise.

Thanks.

Cheeyong


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users