Snort mailing list archives
unified2_extra_data
From: Brad Tilley <rtilley () vt edu>
Date: Thu, 10 Jan 2013 15:55:38 -0500
I'm parsing unified2 data files from snort 2.9.4 with a C++ program I wrote (just to refresh my memory of the format) and I was wondering how to make snort write a UNIFIED2_EXTRA_DATA entry. I've tried scanning with Nessus, nmap and Rapid7 (ipv4 and ipv6) but I'm still unable to get a unified2 header with a type of 110 written to the file. Thanks for any advice. All the other types I'm interested in (2, 104, 105) parse OK. Brad -- Brad Tilley Virginia Tech IT Security (540) 231-3133 ------------------------------------------------------------------------------ Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS, MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft MVPs and experts. ON SALE this month only -- learn more at: http://p.sf.net/sfu/learnmore_122712 _______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- unified2_extra_data Brad Tilley (Jan 10)
- Re: unified2_extra_data Russ Combs (Jan 10)
- Re: unified2_extra_data Brad Tilley (Jan 11)
- Re: unified2_extra_data Victor Roemer (Jan 11)
- Re: unified2_extra_data Russ Combs (Jan 10)