[Snort-users] increase packet size capture problem

Keith Pachulski keithp at ...222...
Tue Oct 26 08:35:03 EDT 2004


-----Original Message-----
From: Jeffrey Starin [mailto:jeffs at ...1936...]
Sent: Tuesday, October 26, 2004 11:28 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] increase packet size capture problem

I have a rule that captures outgoing data and logs to a seperate file.  Problem is that the data is truncated.  That is, not all the data is captured.  I am aware of the -P option to modify snaplen and also of "session" modifier, but changing these values doesn't seem to work -- I always end up with my outgoing data truncated.  I'm presuming that the data that is truncated is being put into a subsequent outing going packet and the alert that generates the first capture cannot say, "Hey, also capture all associated packets."  But I figured that's what the "session" keyword is for, but using it doesn't seem to help.

Any help much appreciated.



This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list