RE: Snort URL logging

[ALMEIDA Antonio Jose <ajalmeida () novis pt>]

But with urlsnarf i can't filter the source ip, and i really need that. It's
impossible to do this with Snort?

-----Original Message-----
From: Jens Krabbenhoeft [mailto:tschenz-snort-users () noris net]
Sent: terça-feira, 14 de Janeiro de 2003 13:44
To: 'snort-users () lists sourceforge net'
Subject: Re: [Snort-users] Snort URL logging


Hi,

> Hello, can someone tell me how can i use snort to log all urls seen in the
> wire?

You probably don't want to use snort to do that. Searching the
snort-users archive[1] revealed
http://marc.theaimsgroup.com/?l=snort-users&m=104014154326341&w=2 which
says:

# The dsniff set of tools contains a program called urlsnarf that pulls
# out HTTP requests in a style similar to the combined apache access
# logs.  I don't think it will read from capture files, though, so
# you'll have to have it running alongside snort.

HTH,
        Jens

[1] http://marc.theaimsgroup.com/?l=snort-users


-------------------------------------------------------
This SF.NET email is sponsored by: FREE  SSL Guide from Thawte
are you planning your Web Server Security? Click here to get a FREE
Thawte SSL guide and find the answers to all your  SSL security issues.
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0026en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This SF.NET email is sponsored by: FREE  SSL Guide from Thawte
are you planning your Web Server Security? Click here to get a FREE
Thawte SSL guide and find the answers to all your  SSL security issues.
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0026en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users