Snort mailing list archives
Re: extracting urls from the alerts
From: twig les <twigles () yahoo com>
Date: Tue, 17 Dec 2002 10:01:25 -0800 (PST)
For me on FreeBSD I had to recompile the kernel with Berkeley Packet Filter (BPF) in it to run the dsniff package. But if you just want a bunch of porn sites I can probably just send you my list (it *is* christmas :-). --- Shane Williams <shanew () shanew net> wrote:
The dsniff set of tools contains a program called urlsnarf that pulls out HTTP requests in a style similar to the combined apache access logs. I don't think it will read from capture files, though, so you'll have to have it running alongside snort. On Sat, 14 Dec 2002, Mahdi Kefaiati wrote:In the Name of the Dearest Hi there I wonder how can I extract URL's from alerts;specialintrest is urls which triggered porn rules. I wanttohave the list in a readable format, i.e. a textfilewhich is the list of the noted URL's. regards Mahdi Kefayati-- Public key #7BBC68D9 at | Shane Williams http://pgp.mit.edu/ | Systems Administrator UT-GSLIS
=----------------------------------+-------------------------------
All syllogisms contain three lines | shanew () gslis utexas edu Therefore this is not a syllogism | www.gslis.utexas.edu/~shanew
-------------------------------------------------------
This sf.net email is sponsored by: With Great Power, Comes Great Responsibility Learn to use your power at OSDN's High Performance Computing Channel http://hpc.devchannel.org/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users ===== ----------------------------------------------------------- If you give a man a fish, he can eat for a day If you bludgeon him to death, you can eat the fish yourself ----------------------------------------------------------- __________________________________________________ Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com ------------------------------------------------------- This sf.net email is sponsored by: With Great Power, Comes Great Responsibility Learn to use your power at OSDN's High Performance Computing Channel http://hpc.devchannel.org/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- extracting urls from the alerts Mahdi Kefaiati (Dec 17)
- Re: extracting urls from the alerts Shane Williams (Dec 17)
- Re: extracting urls from the alerts twig les (Dec 17)
- Re: extracting urls from the alerts J. Craig Woods (Dec 17)
- Re: extracting urls from the alerts Gene (Dec 17)
- Re: extracting urls from the alerts twig les (Dec 17)
- Re: extracting urls from the alerts Shane Williams (Dec 17)