[Snort-users] Need to log FULL packets
mkettler at ...4108...
Wed Mar 13 10:58:13 EST 2002
Well, first I'm wondering what version of snort you are running. Snort
1.9??? Erm, snort 1.8.4 isn't even in non beta yet as far as I can tell
(1.8.4 beta4 was released march 2). Is 1.9 what the CVS image tarballs call
themselves? If so, why are you using snort-current for production use?
(that's a development branch snapshot, which really could use a better name
on the website, the term "current" risks implying "current release").
As far as switches go -X (full dump including IP headers) or -d
(application layer only, no IP headers) should be all you need.
You claim the data looks like it is "cut off", since this is UDP we are
talking about, have you checked to make sure you're not only catching one
fragment of a multi-fragment UDP packet. Note that dumping the application
layer data like this will slow snort down enough that it becomes quite
likely that if a UDP packet gets fragmented you may miss some of the
following fragments while the first one is dumped.
If this is the case, you might make sure that the frag2 preprocessor is on
to defragment the UDP packet prior to passing it up and dumping it.
At 01:06 PM 3/13/2002 -0500, Sheahan, Paul (PCLN-NW) wrote:
>I'm doing an investigation on some unusual UDP traffic on my network and am
>using Snort 1.9 on Linux to monitor the data. The traces of each packet are
>getting cut off in the logs. How can I be sure I am getting ALL of each
>packet in the traces? The more info I can gather on each packet during this
>test would be ideal (I'm not concerned about speed or missed packets).
>Can anyone recommend the correct Snort switches so I can gather the MOST
>Thanks in advance!
More information about the Snort-users