[Snort-users] 1.8.6 and tcpdump format
erek at ...577...
Wed May 22 12:31:02 EDT 2002
On Wed, 22 May 2002, Jeremy wrote:
> I recently switched from 1.8.3 to 1.8.6 and I'm running into a problem.
> With 1.8.3 I was able to use the -b flag and also have snort create a
> directory with the attacking IP's name and log the packet. Now when I run
> snort with the -b flag I no longer get the packet logged to the directory.
> In fact the directory is not created at all. If I simply take away the -b
> flag things work as expected.
That was actually a 'bug fix'. :) Decoding to disk while also writing in -b
mode was large speed bottleneck.
> I'm using snort to monitor a honeypot so I'm trying to grab as much info
> as possible, is this combination of features no longer supported?
Not really needed. If you use -b for binary logging, you get a copy of the
entire packet sent to the output functions. Assuming you've got 'output
log_tcpdump: snort.log' in your snort.conf there will be a pcap style file in
the log directory. Once you stop snort, you can run it like 'snort -ader
<filename> -l /logs/snort' and it will dump out all packets into the
directories like you want.
You're still getting all the info, it's just formatted differently. :)
More information about the Snort-users