[Snort-users] How to log PPP (ssh - VPN Installation) packets using snort

Erek Adams erek at ...577...
Mon Mar 4 10:00:12 EST 2002


On Mon, 4 Mar 2002, Sameer wrote:

> Well i want to log in ssh and ppp packets using snort , can any one help me
> by telling how to log such "ppp/ssh protocol" packets inclusive of header
> and payload

You can't.

SSH is _encrypted_ from the endpoints.  IOW, all you'll get is garbage if you
try to examine the packets.  That's why it's such a wonderful utility!  :)

Sorry to be the bearer of bad news!  Cheers!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net





More information about the Snort-users mailing list