No subject


Thu Nov 23 16:36:19 EST 2017


SMTP connection is made. The fact that I chose "session" over "host" in the
tag field should mean I get bi-directional - right?

Well, what happened is that a 0823 at ...3201... was created after
restarting snort. Upon having a SMTP session and exiting, the file was still
0 bytes! I HUP'ed snort, and then the data was flushed. Upon running
ethereal on it, I saw that I was only seeing the packets from 1.2.3.4 *to*
2.3.4.5 - the return packets are missing.

I can run tcpdump and see both directions - so this is a snort issue - not a
networking one.

Now, that sounds more like the way "tag: host" is meant to work doesn't it?
I've tried several pertubations of flags - to no avail.

Bug or misunderstanding?


snort-1.8-1-RELEASE under RH-6.2.

On Sat, Aug 18, 2001 at 10:45:24AM -0400, Martin Roesch wrote:
> Use tagging:
> 
> alert tcp !$HOME_NET any -> $!HOME_NET 143 (flags: S; tag: session, 60,
> seconds; msg: "Tracking inbound IMAP session";)
> 
> That'll do it.
> 
>      -Marty
> 
> Jason Haar wrote:
> > 
> > I've tried setting up a dynamic rule so that I could catch (say), a whole
> > IMAP session. I want it saved in tcpdump format, but can't get it to work.
> > 
> > Any ideas?
> > 
> > ruletype catchimap
> > {
> >  type dynamic
> >  output log_tcpdump: imapsessions.log
> > }
> > 
> > activate tcp !$HOME_NET any -> $HOME_NET 143 (flags: PA; activates: 1;)
> > catchimap tcp !$HOME_NET any -> $HOME_NET 143 (activated_by: 1;)
> > 
> > --
> > Cheers
> > 
> > Jason Haar
> > 
> > Unix/Special Projects, Trimble NZ
> > Phone: +64 3 9635 377 Fax: +64 3 9635 417
> > 
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > http://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 
> --
> Martin Roesch
> roesch at ...1935...
> http://www.sourcefire.com - http://www.snort.org

-- 
Cheers

Jason Haar

Unix/Special Projects, Trimble NZ
Phone: +64 3 9635 377 Fax: +64 3 9635 417




More information about the Snort-users mailing list