log reassembled packet not only original packet

[Chun Chan <chun_chan () ymail com>]

Hi

I install snort and configured. I want to do logging all packets which tcp reassembled not only original packets that 
caused alarm. For example: this is aplication layer

Packet no 1:    FOO trytrytry    
Packet no 2:   abcdfedgassd

I assumed, packet1 and packet2 need reassemble  (tcp reassemble.)   I need dump to file with all reassembled packet 
content. not only first original packet. but snort only dump to file first packet "FOO trytrytry". I use stream5 
preprocessor with flush_on_alert

my configuration file is
preprocessor stream5_global: track_tcp yes, track_udp no, track_icmp no , flush_on_alert
preprocessor stream5_tcp: policy linux, ports both all
preprocessor stream5_udp: ignore_any_rules
alert tcp any any -> any any (content:"FOO";
msg: "sucess";)


------------------------------------------------------------------------------
This SF.Net email is sponsored by the Verizon Developer Community
Take advantage of Verizon's best-in-class app development support
A streamlined, 14 day to market process makes app distribution fast and easy
Join now and get one step closer to millions of Verizon customers
http://p.sf.net/sfu/verizon-dev2dev

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users