Re: tcpdump script

["John Hally" <JHally () ebscohost com>]

I would definitely be interested in the scripts as well.

 

________________________________

From: Leon Ward [mailto:seclists () rm-rf co uk] 
Sent: Wednesday, April 08, 2009 9:15 AM
To: Jack Pepper
Cc: Snort-users () lists sourceforge net
Subject: Re: [Snort-users] tcpdump script

 

I use the fast output plugin, and swatch the alert file.

-Leon

On Wed, Apr 8, 2009 at 2:06 PM, Jack Pepper
<pepperjack () afferentsecurity com> wrote:

Quoting Leon Ward <seclists () rm-rf co uk>:

        The method I use is to keep a limited cache of network traffic
via tcpdump's
        ringbuffer mode, a few 100MB of pcap data. When Snort raises an
alert, a
        process automatically kicks off that extracts the session that
caused the
        alert from the ringbuffer and stores it for prosperity.

        I have some working scripts that I could provide if anyone wants
them, but I
        would have to censor them a bit before they can be shared. Let
me know.


I would be quite interested.  Are you hooking an output plugin for the
trigger?

jp

-- 

Framework?  I don't need no stinking framework!

----------------------------------------------------------------
@fferent Security Labs:  Isolate/Insulate/Innovate
http://www.afferentsecurity.com

 

------------------------------------------------------------------------------
This SF.net email is sponsored by:
High Quality Requirements in a Collaborative Environment.
Download a free trial of Rational Requirements Composer Now!
http://p.sf.net/sfu/www-ibm-com

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users