Snort mailing list archives
Re: Snort 2.9.12 for Windows, issues trying to get payload info to analyze, and to make multiple file instances with the payload info.
From: "Joel Esler \(jesler\) via Snort-devel" <snort-devel () lists snort org>
Date: Fri, 11 Jan 2019 16:49:41 +0000
Answered on Snort-Users.
On Jan 10, 2019, at 7:19 PM, Don Hall <dhall () rmscollects com> wrote: I use Snort v2.9.12 for Windows. Issue #1. I am trying to get the payload info (-d) and log (-l) to later read back in (-dr) and analyze the payload. The payload info goes out to console, but the log file just has the header info, but not the payload info. I am using the config file \etc\snort.conf to apply the rules. I try to modify the output plug-ins to get the step 6 plug-ins. I need to see and analyze the payload. Issue #2. I am trying to get the files to close after a file size (e.g. 1MB for test purposes). With the epoch (timestamp extension), I would spawn off a new file, And save off the old file, to examine and do data analysis, on the payload. Trying to do it first, in a test; and later, with a 100MB or 1GB file size, for production. Do I have to use some other tools, such as logrotatewin? Or, can I do these things in Snort, without add-ons? Do I have to make certain config file changes, Or do I set some command line arguments, Or do I have to make some patches to resolve the issues? Thanks, in advance, for any good suggestions. Regards. _______________________________________________ Snort-devel mailing list Snort-devel () lists snort org <mailto:Snort-devel () lists snort org> https://lists.snort.org/mailman/listinfo/snort-devel <https://lists.snort.org/mailman/listinfo/snort-devel> Please visit http://blog.snort.org <http://blog.snort.org/> for the latest news about Snort!
Attachment:
smime.p7s
Description:
_______________________________________________ Snort-devel mailing list Snort-devel () lists snort org https://lists.snort.org/mailman/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Snort 2.9.12 for Windows, issues trying to get payload info to analyze, and to make multiple file instances with the payload info. Don Hall (Jan 10)
- Re: Snort 2.9.12 for Windows, issues trying to get payload info to analyze, and to make multiple file instances with the payload info. Joel Esler (jesler) via Snort-devel (Jan 11)