Snort mailing list archives
Re: log reassembled packet not only original packet
From: Joel Esler <jesler () sourcefire com>
Date: Wed, 16 Dec 2009 09:26:11 -0500
On Wed, Dec 16, 2009 at 2:50 AM, Chun Chan <chun_chan () ymail com> wrote:
Hi I install snort and configured. I want to do logging all packets which tcp reassembled not only original packets that caused alarm. For example: this is aplication layer Packet no 1: FOO trytrytry Packet no 2: abcdfedgassd I assumed, packet1 and packet2 need reassemble (tcp reassemble.) I need dump to file with all reassembled packet content. not only first original packet. but snort only dump to file first packet "FOO trytrytry". I use stream5 preprocessor with flush_on_alert my configuration file is preprocessor stream5_global: track_tcp yes, track_udp no, track_icmp no , flush_on_alert preprocessor stream5_tcp: policy linux, ports both all preprocessor stream5_udp: ignore_any_rules alert tcp any any -> any any (content:"FOO"; msg: "sucess";)
What is your output configuration? I think you can only dump reassembled packets with unified output. -- Joel Esler | 302-223-5974 | gtalk: jesler () sourcefire com ------------------------------------------------------------------------------ This SF.Net email is sponsored by the Verizon Developer Community Take advantage of Verizon's best-in-class app development support A streamlined, 14 day to market process makes app distribution fast and easy Join now and get one step closer to millions of Verizon customers http://p.sf.net/sfu/verizon-dev2dev _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- log reassembled packet not only original packet Chun Chan (Dec 15)
- Re: log reassembled packet not only original packet Joel Esler (Dec 16)