[Snort-users] tcpdump script

John Hally JHally at ...14234...
Wed Apr 8 10:29:29 EDT 2009


I would definitely be interested in the scripts as well.

 

________________________________

From: Leon Ward [mailto:seclists at ...14165...] 
Sent: Wednesday, April 08, 2009 9:15 AM
To: Jack Pepper
Cc: Snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] tcpdump script

 

I use the fast output plugin, and swatch the alert file.

-Leon

On Wed, Apr 8, 2009 at 2:06 PM, Jack Pepper
<pepperjack at ...14319...> wrote:

Quoting Leon Ward <seclists at ...14165...>:

	The method I use is to keep a limited cache of network traffic
via tcpdump's
	ringbuffer mode, a few 100MB of pcap data. When Snort raises an
alert, a
	process automatically kicks off that extracts the session that
caused the
	alert from the ringbuffer and stores it for prosperity.

	I have some working scripts that I could provide if anyone wants
them, but I
	would have to censor them a bit before they can be shared. Let
me know.


I would be quite interested.  Are you hooking an output plugin for the
trigger?

jp

-- 

Framework?  I don't need no stinking framework!

----------------------------------------------------------------
@fferent Security Labs:  Isolate/Insulate/Innovate
http://www.afferentsecurity.com

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20090408/c373b34c/attachment.html>


More information about the Snort-users mailing list