[Snort-users] Snort and session logging

Braxton Thomason bthomason at ...12681...
Fri Nov 19 10:42:52 EST 2004


For reasons that are overly complicated, I would like to make Snort track  
TCP sessions, i.e., "Telnet session from IP X to IP Y, username Bob", or  
"FTP session blah blah". It seems like the stream4 preprocessor could be  
hacked to make this work, but I wanted to check if something like that  
already exists, and I just haven't found it. Assuming it doesn't exist,  
does anyone have any hints?

Thanks in advance!

-- 
Braxton Thomason
Senior Research Engineer
21st Century Technologies
(512) 342-0010 ext 244
bthomason at ...12681...




More information about the Snort-users mailing list