RE: Snort-users digest, Vol 1 #3410 - 2 msgs

["Schmehl, Paul L" <pauls () utdallas edu>]

> -----Original Message-----
> From: Marc Quibell [mailto:mquibell () fbfs com] 
> Sent: Tuesday, August 05, 2003 8:36 AM
> To: snort-users () lists sourceforge net
> Cc: Schmehl, Paul L
> Subject: Re: Snort-users digest, Vol 1 #3410 - 2 msgs
>
> I think you're asking Snort to do more than it was designed 
> to do, and sorry, I don't know if it's really possible. Maybe 
> one of the Snort experts can help better. I know that when I 
> need more info on a tcp/udp session, I'll run TCPDUMP to look 
> into it further.
>
> "is there a way to reassemble packets that have been fed from 
> snort to mysql?" Huh? Really, I don't believe any packets are 
> disassembled in the process. Maybe you mean, "is there a way 
> to reconstruct the entire session that kicked off this 
> alert"? If this is the case, I would highly doubt there would 
> be a way to do that.

I know there's no way to reconstruct a session, because snort doesn't
store sessions.  It only stores what triggers an alert (unless you
specifically write a rule that traps a session.)  What I was trying to
figure out is if there is a way to take the data that's in mysql and
extract it in a way that can be read by ethereal or tcpdump.

Yeah, I know about capturing ongoing traffic.  What I'm trying to figure
out is if there's a way to reconstruct a packet using the data that's in
the mysql tables.

Anyway, it doesn't matter now.  I found a different way to prove my
point, and now the networking guys are scrambling to close the hole. :-)

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/ 


-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users