Re: Logging Reassembled Packets

[Martin Roesch <roesch () sourcefire com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Stream4 had the ability to log session summaries called "keepstats"  
that'll do that too.  Stream5 doesn't appear to support that option yet.

        -Marty

On Mar 14, 2008, at 4:05 AM, Patrik Nordlén wrote:

> On Friday 14 March 2008 08.26.26 Kamran Shafi wrote:
> > BTW, I just wanted to have a summary record of each session  
> > (initiated with
> > a 3WHS and terminated by a 4WHS) similar to the Snort's summary log  
> > packet
> > for portscans - I am not sure how tcpdump or other software  
> > mentioned in
> > this thread can do that. It looks like I will have to write one  
> > myself. In
> > addition I also wanted to track UDP and ICMP sessions - any ideas  
> > on how to
> > do that?
>
> What you describe is argus.
>
> http://qosient.com/argus/
>
> Regards,
> Patrik
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/_______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

- --
Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
Sourcefire - Security for the Real World - http://www.sourcefire.com
Snort: Open Source IDP - http://www.snort.org


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (Darwin)

iD8DBQFH2o38qj0FAQQ3KOARAgGiAJ40PvKL4gHDEMFrJ0ZW3aiZtJHq8ACfcHKv
u2Y1aPrm5aFyadEoOfHCusU=
=lJSs
-----END PGP SIGNATURE-----

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users