RE: Rules Question

["Nelson, Ben" <bnelson () rightnow com>]

Try increasing the snap-length using the '-P' option.  If you set this
to 0, you'll capture whole packets, but you may be able to tune the snap
length up enough to get the information you want without logging the
entirety of every packet.
 
--Ben


        -----Original Message-----
        From: Stevo [mailto:checkpoint () ozbergs com] 
        Sent: Tuesday, August 05, 2003 6:13 PM
        To: snort-users () lists sourceforge net
        Subject: [Snort-users] Rules Question
        
        
        I'm creating some new rules to use... I'm looking for certain
keywords in packets and have got the rule working, but I'm interested in
seeing more of the Payload... right now I'm just getting the line that
includes that keyword...  how can I tell ACID to show me 10 lines on
either side of the keyword for example??
         
        Stevo