RE: increase packet size capture problem

["Keith Pachulski" <keithp () corp ptd net>]

http://www.snort.org/docs/snort_manual/node16.html#SECTION00426000000000000000

-----Original Message-----
From: Jeffrey Starin [mailto:jeffs () speakeasy net]
Sent: Tuesday, October 26, 2004 11:28 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] increase packet size capture problem


I have a rule that captures outgoing data and logs to a seperate file.  Problem is that the data is truncated.  That 
is, not all the data is captured.  I am aware of the -P option to modify snaplen and also of "session" modifier, but 
changing these values doesn't seem to work -- I always end up with my outgoing data truncated.  I'm presuming that the 
data that is truncated is being put into a subsequent outing going packet and the alert that generates the first 
capture cannot say, "Hey, also capture all associated packets."  But I figured that's what the "session" keyword is 
for, but using it doesn't seem to help.

Any help much appreciated.

Thanks,

bulgin




-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=ort-users