Re: Tag Feature question

[Edward Fjellskål <edwardfjellskaal () gmail com>]

I published a blog post about the tag option:
http://www.gamelinux.org/?p=329
"Packetcapture with Snort using the “tag” option"

Hope this might give you an idea on how to turn your snort into a pcap device ;)

E



On Tue, Mar 1, 2011 at 5:33 PM, Josh Blender <jsblists () gmail com> wrote:
> Hi, I'm a pretty new Snort user and I'm trying to get the "tag:" feature to
> work so that I can capture the entire connection once a packet triggers a
> rule.
> Unfortunately, I've tested this in several ways, and I simply can't get this
> tag feature to work.  In local.rules, I have:
> tagtest tcp any any -> {ip address} 80 (content:"/{url}";
> tag:host,5,packets,src; sid:100002; rev:1)
> and I have a dedicated log file for catching this rule:
> ruletype tagtest
> {
>         type log
>         output log_tcpdump: tagtest.log
> }
> I've also tried using "tag:session,10,seconds" and various output methods
> (not database, as I understand that does not work properly).
> No matter what I do, I can not get Snort to log more than the first packet.
>  The rule works perfectly - it triggers on traffic that I want it to trigger
> on, and it writes to the log files perfectly, but it just will NOT log
> anything more than 1 packet no matter what I do.  Are there any preprocessor
> directives that are required to let tagging work?  Anything else I might be
> missing that might prevent this from working?
> Thank you,
> Josh B
>
> ------------------------------------------------------------------------------
> Free Software Download: Index, Search & Analyze Logs and other IT data in
> Real-Time with Splunk. Collect, index and harness all the fast moving IT
> data
> generated by your applications, servers and devices whether physical,
> virtual
> or in the cloud. Deliver compliance at lower cost and gain new business
> insights. http://p.sf.net/sfu/splunk-dev2dev
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-- 
Edward Bjarte Fjellskål
Senior Security Analyst
http://www.gamelinux.org/

------------------------------------------------------------------------------
Free Software Download: Index, Search & Analyze Logs and other IT data in 
Real-Time with Splunk. Collect, index and harness all the fast moving IT data 
generated by your applications, servers and devices whether physical, virtual
or in the cloud. Deliver compliance at lower cost and gain new business 
insights. http://p.sf.net/sfu/splunk-dev2dev 
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users