[Snort-users] application layer data

Benjamin Collins bencollins at ...5072...
Sat Mar 2 11:27:29 EST 2002

I am running snort 1.8.3 on a RedHat 7.2 (2.4.10-7) machine.  I am
trying to log all the data from TCP packets that match certain rules,
but it's not working.  I know the packets are matching the rules,
because the correct alerts are being generated, but the full packets are
nowhere to be found.  In the config file, I am using the 'config
dump_payload' directive, and in the command used to start snort I am
using the -d option.  

Some information is being logged into directories named after ip
addresses, but I don't think they are complete packets -- for example:

Here's an alert generated by a rule I wrote:

02/23-17:25:53.148618 ->
TCP TTL:255 TOS:0x10 ID:0 IpLen:20 DgmLen:40 DF
*****R** Seq: 0xFA54EC12  Ack: 0x0  Win: 0x0  TcpLen: 20


Yet in the /var/log/snort/ directory, there is no TCP:4569-23
file, and even in the files that are in there, there is no application
data; they look just like the above alert.

Anyone know what might be going on?

More information about the Snort-users mailing list