Re: How to dump a certain number of tcp packets (for TCPDUMP) when an alert is fired

[Jason <security () brvenik com>]

I think you need to remove logto from the rules and use this in snort.conf

http://www.snort.org/docs/snort_manual/node13.html#SECTION00345000000000000000

Loch Theary wrote:

> My respects all,
>
> It's doesn't work even with the "logto" directive.
>
>
> > These are my modified alert rule:
>
>
> > alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS
> > (msg:"WEB-MISC cross site scripting attempt";
> > flow:to_server,established; content:"<SCRIPT>"; nocase;
> > logto:"/snort/logs/suspicious.tcpdump"; tag:session,50,packets;
> > classtype:web-application-attack; sid:1497; rev:6;)
>
>
> > alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS
> > (msg:"WEB-ATTACKS mail command attempt";
> > flow:to_server,established; content:"/bin/mail"; nocase;
> > logto:"/snort/logs/suspicious.tcpdump"; tag:session,50,packets;
> > classtype:web-application-attack; sid:1366; rev:5;)
>
>
> > I can determine what I am doing wrong ...
>
>
> Anyone can help ?
>
> Regards, Theary
>
> -----Message d'origine----- De : Hart Clarence (rti1clh)
> [mailto:CHart () ups com] Envoyé : vendredi 3 septembre 2004 15:40 À :
> 'emf () servervault com'; Loch Theary Cc :
> snort-users () lists sourceforge net Objet : RE: [Snort-users] How to
> dump a certain number of tcp packets (for TCPDUMP) when an alert is
> fired
>
>
> If you use the alert tag where are the log files going to go? (
> filenames /or database)
>
>
> C
>
>
> -----Original Message----- From: Erik Fichtner
> [mailto:emf () servervault com] Sent: Thursday, September 02, 2004 12:55
> PM To: Loch Theary Cc: snort-users () lists sourceforge net Subject: Re:
> [Snort-users] How to dump a certain number of tcp packets (for 
> TCPDUMP) when an alert is fired
>
>
> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>
> On Thu, Sep 02, 2004 at 05:05:02PM +0200, Loch Theary wrote:
>
> > Could you please tell me how to log a certain number of packets
> > when an alert is fired (tcp dump format) ?
>
>
> "tag:session,${NUMBER},packets;"
>
> - -- Erik Fichtner Principal Engineer, Information Security,
> ServerVault Corp. 703-652-5900 -----BEGIN PGP SIGNATURE----- Version:
> GnuPG v1.0.7 (FreeBSD)
>
> iD8DBQFBN1BXQ7EzrewLMS0RAo44AKDAQNM0GLBXm871a181TEspE0gdvwCgu8fk 
> DM4p3ty2fTBlymbrsqyv5tA= =SBUM -----END PGP SIGNATURE-----
>
>
> ------------------------------------------------------- This SF.Net
> email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE
> developer tools! Get your free copy of BEA WebLogic Workshop 8.1
> today. http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click 
> _______________________________________________ Snort-users mailing
> list Snort-users () lists sourceforge net Go to this URL to change user
> options or unsubscribe: 
> https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users
> list archive: 
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
> ------------------------------------------------------- This SF.Net
> email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE
> developer tools! Get your free copy of BEA WebLogic Workshop 8.1
> today. http://ads.osdn.com/?ad_idP47&alloc_id808&op=click 
> _______________________________________________ Snort-users mailing
> list Snort-users () lists sourceforge net Go to this URL to change user
> options or unsubscribe: 
> https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users
> list archive: http://www.geocrawler.com/redir-sf.php3?list=ort-users



-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users