Re: log single packet vs reassmbled stream

["Alex Butcher, ISC/ISYS" <Alex.Butcher () bristol ac uk>]

--On 04 October 2004 03:57 -0700 Thomas Anderson <neo_ait () yahoo com> wrote:

> I know about the tag keyword..... Is there any other way so that the
> entire session can be logged, if alert is generated in any of its
> packet....
>
> The tag keyword only log packets after the alert generated.. and that to
> i have to specify the number of packets to log afterwards.. Actually I
> want to log the content of the entire session when any of its packet is
> alerted......

sguil can integrate snort with tcpdump, apparently. I've thought about 
doing something similar using flexresp, tethereal (in ring-log-file mode) 
and a shell script or similar.

> Regards
> Thomas

HTH,
Alex.
--
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing             GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9




-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users