[Snort-users] OT: "Pretty Packet Printer"

Jerry Shenk jas at ...129...
Tue May 8 06:32:21 EDT 2001

Have you looked at tcpshow?  I'm not sure if that's what you're referring
to.  It's not specific to snort at all....in fact, it is specific to tcpdump
output but if you have snort outputting in tcpdump format, tcpshow gives you
a pretty decent breakdown of the packet.

Packet 19
        Timestamp:                      00:25:53.570000
        Source Ethernet Address:        00:00:C0:32:9D:30
        Destination Ethernet Address:   00:50:04:B5:79:C2
        Encapsulated Protocol:          IP
IP Header
        Version:                        4
        Header Length:                  20 bytes
        Service Type:                   0x00
        Datagram Length:                45 bytes
        Identification:                 0x0096
        Flags:                          MF=off, DF=on
        Fragment Offset:                0
        TTL:                            110
        Encapsulated Protocol:          TCP
        Header Checksum:                0xC016
        Source IP Address:    
        Destination IP Address:
TCP Header
        Source Port:                    110 (pop-3)
        Destination Port:               3871 (<unknown>)
        Sequence Number:                1237726229
        Acknowledgement Number:         2058443429
        Header Length:                  20 bytes (data=5)
        Flags:                          URG=off, ACK=on,  PSH=on
                                        RST=off, SYN=off, FIN=off
        Window Advertisement:           6134 bytes
        Checksum:                       0x6897
        Urgent Pointer:                 0
TCP Data

-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net]On Behalf Of Erek Adams
Sent: Monday, May 07, 2001 10:45 PM
To: Snorters Anonymous
Subject: [Snort-users] OT: "Pretty Packet Printer"

Pardon the OT post, but would anyone have a pointer to a 'Pretty Packet
Printer'?  I'd love to have a script that will display nd decode the packet
while displaying the packet structure around it.  Does that make sense? :)

I've seen the output of such a beast that used block ASCII art, I just can't
recall where! :-/

Erek Adams

Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list