Al Lewis (allewi)
allewi at ...589...
Wed Apr 15 17:09:35 EDT 2015
Do you want to just capture "interesting traffic" (alert) or ALL traffic from src and destination after the initial alert as well?
Tagging allows you to log any other traffic between those hosts for a specified time or packet count after the initial alert.
For the logging you have several output formats to choose from.
Section on tagging: http://manual.snort.org/node34.html#SECTION00475000000000000000
Section on logging: http://manual.snort.org/node21.html
Hope this helps!
QA Software Engineer
SOURCEfire, Inc. now part of Cisco
9780 Patuxent Woods Drive
Columbia, MD 21046
Phone: (office) 443.430.7112
Email: allewi at ...589...
From: Xin, Qiao [mailto:qxin at ...17138...]
Sent: Wednesday, April 15, 2015 1:54 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] tag:host
I have a question on how the tag:host works. I have a rule based on the content of the packet as
alert udp $HOME_NET any -> any any (msg:"suspicious traffic--";content:"bad content";nocase; tag:host, 60, packets, dst; classtype:bad-unknown;sid:1000001;rev:0;)
I want to capture traffic of coming from any HOME_NET host to the destination IP in the alert packets.
Will "tag:host" and the "dst" option work?
If it works, in which file will the captured packets by the tag:host be stored?
How can we easily associate the packets captured by the tag:host action with the packets captured by the snort alert?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users