Re: [snort-users] Using snort as connection tracker

[Richard Bejtlich <taosecurity () gmail com>]

Klemen Mihevc wrote:

> Is there anyway to log only first and last package from 1 ip 
> and only if data transfer is bigger then let's say 5k? Or 
> maybe anyother way to log that connections? 

Welcome to the wonderful world of session data.  Snort can log TCP
sessions using the stream4 preprocessor, but you are better off using
another tool to acquire the data you need.  Check out Argus [0] for a
stand-alone solution or SANCP [1] for a database-logging tool
integrated with Sguil.  [2]

Chapter 7 of my book is devoted to session data, but that's one of the
few chapters not online.  [3]  In there you'll also learn how to
collect and analyze NetFlow records, another form of session data.

Sincerely,

Richard
http://www.taosecurity.com

[0] http://www.qosient.com/argus
[1] http://www.metre.net/sancp.html
[2] http://www.sguil.net
[3] http://www.taosecurity.com/books.html


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users