Re: Difference of Alerts, Snort Logs, and Tcpdumps

[Seth <sethsec () gmail com>]

Fritz,

Alerts are stored in ASCII.  You can cat, tail, less, etc. that file.
snortlog.log is most likely in unified format (binary, so you can't
view it in a text editor).
tcpdump.log is stored in pcap format.  You can most likely read this
file by typing: tcpdump -nr Tcpdump.log and it will show you the
actual packets that were collected by snort rules that in fact log
packets.

Those three files are each the result of a separate output plugin.
There has been a lot of them written as to which is best for each
scenario.   ASCII logs are great for quickly checking what your sensor
is seeing, but it slows down the instance of snort considerably.
When running snort in daemon mode, you should almost always run snort
without this option (-A fast on the command line)

If you are upgrading the old sensor, and you want to keep all of your
other tools the same, the important lines that have to do with logging
can be found by doing this:

cat snort.conf | grep output | grep -v /#

Of course this just looks at the output part of the snort.conf
configuration.  You will have to make sure you retain a whole lot of
information from the previous snort.conf file including $HOME_NET and
$EXTERNAL_NET, and a whole lot of others.   Check out some of the
how-to documents on www.snort.org

-Seth



On Tue, Mar 4, 2008 at 12:07 PM, frederick sonnichsen
<fsonnichsen () whoi edu> wrote:
> I am new  to snort and trying to upgrade a prior system. It appears that
>  the old system collects Alerts, Snortlog.log and Tcpdump.log, however
>  after reading the doc I am a little unclear on the meaning of  these.
>  Are the snortlogs basically uncompressed versions of the tcpdumps? Also
>  are the alerts a condensation of the snort logs?
>  Thanks,
>  Fritz
>
>
>  -------------------------------------------------------------------------
>  This SF.net email is sponsored by: Microsoft
>  Defy all challenges. Microsoft(R) Visual Studio 2008.
>  http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
>  _______________________________________________
>  Snort-users mailing list
>  Snort-users () lists sourceforge net
>  Go to this URL to change user options or unsubscribe:
>  https://lists.sourceforge.net/lists/listinfo/snort-users
>  Snort-users list archive:
>  http://www.geocrawler.com/redir-sf.php3?list=snort-users

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users