Re: 'only_stream' (and other alternate decode buffers) do not write out data to the logs

[Joel Esler <jesler () sourcefire com>]

You should log to unified2, much more data is put out in that format than in pcap. 

--
Joel Esler 

On Oct 8, 2011, at 16:07, Steven Sturges <ssturges () sourcefire com> wrote:

> > I haven't played with unified2 that much.  I typically just log to
> > straight libpcap files and analyze them in WireShark

Attachment: smime.p7s
Description:

------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security
threats, fraudulent activity, and more. Splunk takes this data and makes
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2dcopy2

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!