[Snort-users] (no subject)

Anthony Pardini tony at ...653...
Wed Oct 18 12:47:38 EDT 2000


log tcp any any <> any any (logto:"loginlog";msg:"Login 
Sniffer";content:"login"
;nocase;session: printable)

in an attempt to look for login names being used I came up with this rule. 
It only logs the prompt, not the response to the prompt. How would I be 
able to log the username ?

Also, in what version of snort does the content-list option work ?

thanks,

tony




More information about the Snort-users mailing list