Re: Snort-users digest, Vol 1 #3410 - 2 msgs

["Marc Quibell" <mquibell () fbfs com>]

Hi Paul,
Bwaaahahahahaaaa! (j/k).

I think you're asking Snort to do more than it was designed to do, and sorry, I
don't know if it's really possible. Maybe one of the Snort experts can help
better. I know that when I need more info on a tcp/udp session, I'll run TCPDUMP
to look into it further.

"is there a way to reassemble packets that have been fed from snort to mysql?"
Huh? Really, I don't believe any packets are disassembled in the process. Maybe
you mean, "is there a way to reconstruct the entire session that kicked off this
alert"? If this is the case, I would highly doubt there would be a way to do
that.

Marc



Date: Mon, 04 Aug 2003 20:28:14 -0500
From: Paul Schmehl <pauls () utdallas edu>
Reply-To: Paul Schmehl <pauls () utdallas edu>
To: snort-users () lists sourceforge net
Subject: [Snort-users] Weird question

Now promise you won't laugh......is there a way to reassemble packets that
have been fed from snort to mysql?  Believe or not, the networking guys
want something they can look at in tcpdump or ethereal.  (Yes, I know how
to enable that.  I want to look at stuff that's already in the database.)

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu





-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users