[Snort-users] snort -r output

Tay Chee Yong tcy at ...8934...
Mon Apr 21 01:19:07 EDT 2003


Hi list,

I am pretty new to snort, and i would like to find out how do I decode the
snort -r output?  Could anyone tell me what does hex value stand for, and
why are there "......."?

Basically, I am trying to find out the patterns of the packets, so that I
can match by the content in my rules.

04/21-16:02:57.719998 210.24.246.13:62764 -> 203.120.90.33:53
UDP TTL:124 TOS:0x0 ID:31492 IpLen:20 DgmLen:70
Len: 42
01 62 01 00 00 01 00 00 00 00 00 00 09 4D 41 52  .b...........MAR
4B 45 54 49 4E 47 07 61 6C 63 6F 74 65 63 00 00  KETING.alcotec..
01 00 01 00 00 00 00 00 00 00                    ..........

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

Appreciate any advise.

Thanks.

Cheeyong




More information about the Snort-users mailing list