[Snort-users] 1.8.6 and tcpdump format

Erek Adams erek at ...577...
Wed May 22 12:31:02 EDT 2002

On Wed, 22 May 2002, Jeremy wrote:

>   I recently switched from 1.8.3 to 1.8.6 and I'm running into a problem.
> With 1.8.3 I was able to use the -b flag and also have snort create a
> directory with the attacking IP's name and log the packet. Now when I run
> snort with the -b flag I no longer get the packet logged to the directory.
> In fact the directory is not created at all. If I simply take away the -b
> flag things work as expected.

That was actually a 'bug fix'.  :)  Decoding to disk while also writing in -b
mode was large speed bottleneck.

>   I'm using snort to monitor a honeypot so I'm trying to grab as much info
> as possible, is this combination of features no longer supported?

Not really needed.  If you use -b for binary logging, you get a copy of the
entire packet sent to the output functions.  Assuming you've got 'output
log_tcpdump: snort.log' in your snort.conf there will be a pcap style file in
the log directory.  Once you stop snort, you can run it like 'snort -ader
<filename> -l /logs/snort' and it will dump out all packets into the
directories like you want.

You're still getting all the info, it's just formatted differently.  :)


Erek Adams

More information about the Snort-users mailing list