[Snort-users] Snort and session logging

Braxton Thomason bthomason at ...12681...
Fri Nov 19 08:22:02 EST 2004


For reasons that are overly complicated, I would like to make Snort track
TCP sessions, i.e., "Telnet session from IP X to IP Y, username Bob", or
"FTP session blah blah". It seems like the stream4 preprocessor could be
hacked to make this work, but I wanted to check if something like that
already exists, and I just haven't found it. Assuming it doesn't exist,
does anyone have any hints?

Thanks in advance!



-- 
Braxton Thomason
Senior Research Engineer
21st Century Technologies
(512) 342-0010 ext 244
bthomason at ...12681...




More information about the Snort-users mailing list