[Snort-users] Snort Unified2 File Format

Dheeraj Gupta dheeraj.gupta4 at ...11827...
Mon Sep 17 04:24:39 EDT 2012


Hi,
I was looking into the u2 file generated by snort(processed by barnyard2)
and the documentation at http://manual.snort.org/node44.html
While the "Unified2 IDS Event" (type 7) record was consistent with the
documentation, the "Unified2 Packet" (type 2) record had the
timestamp(seconds) field repeating twice (One after the other). The
documentation only mention one event seconds field which is 4 bytes long.
The record length field in serial unified header was correct (i.e. it took
into account the repeating values of timestamp) and barnyard2 also had no
complaints with this repetition. Is it intentional and does the doc needs
updating? I am running Snort 2.9.3.0 on 64-bit machine.
Also I noticed that snort logged multiple packets per alert in u2 (But only
the first one was written by barnyard2 to the DB). Does Snort log the
entire stream in case of alert. The alert in question was triggered by
signature 1-6692

Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20120917/0c0977b8/attachment.html>


More information about the Snort-users mailing list