Re: Logging Reassembled Packets

[Patrik Nordlén <patrik.nordlen () sentor se>]

On Friday 14 March 2008 08.26.26 Kamran Shafi wrote:
> BTW, I just wanted to have a summary record of each session (initiated with
> a 3WHS and terminated by a 4WHS) similar to the Snort's summary log packet
> for portscans - I am not sure how tcpdump or other software mentioned in
> this thread can do that. It looks like I will have to write one myself. In
> addition I also wanted to track UDP and ICMP sessions - any ideas on how to
> do that?

What you describe is argus.

http://qosient.com/argus/

Regards,
Patrik

Attachment: smime.p7s
Description:

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users