[Snort-users] Logging Reassembled Packets

Martin Roesch roesch at ...1935...
Fri Mar 14 10:38:52 EDT 2008


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Stream4 had the ability to log session summaries called "keepstats"  
that'll do that too.  Stream5 doesn't appear to support that option yet.

	-Marty

On Mar 14, 2008, at 4:05 AM, Patrik Nordlén wrote:

> On Friday 14 March 2008 08.26.26 Kamran Shafi wrote:
>> BTW, I just wanted to have a summary record of each session  
>> (initiated with
>> a 3WHS and terminated by a 4WHS) similar to the Snort's summary log  
>> packet
>> for portscans - I am not sure how tcpdump or other software  
>> mentioned in
>> this thread can do that. It looks like I will have to write one  
>> myself. In
>> addition I also wanted to track UDP and ICMP sessions - any ideas  
>> on how to
>> do that?
>
> What you describe is argus.
>
> http://qosient.com/argus/
>
> Regards,
> Patrik
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/_______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

- --
Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
Sourcefire - Security for the Real World - http://www.sourcefire.com
Snort: Open Source IDP - http://www.snort.org


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (Darwin)

iD8DBQFH2o38qj0FAQQ3KOARAgGiAJ40PvKL4gHDEMFrJ0ZW3aiZtJHq8ACfcHKv
u2Y1aPrm5aFyadEoOfHCusU=
=lJSs
-----END PGP SIGNATURE-----




More information about the Snort-users mailing list