Snort Unified2 File Format

[Dheeraj Gupta <dheeraj.gupta4 () gmail com>]

Hi,
I was looking into the u2 file generated by snort(processed by barnyard2)
and the documentation at http://manual.snort.org/node44.html
While the "Unified2 IDS Event" (type 7) record was consistent with the
documentation, the "Unified2 Packet" (type 2) record had the
timestamp(seconds) field repeating twice (One after the other). The
documentation only mention one event seconds field which is 4 bytes long.
The record length field in serial unified header was correct (i.e. it took
into account the repeating values of timestamp) and barnyard2 also had no
complaints with this repetition. Is it intentional and does the doc needs
updating? I am running Snort 2.9.3.0 on 64-bit machine.
Also I noticed that snort logged multiple packets per alert in u2 (But only
the first one was written by barnyard2 to the DB). Does Snort log the
entire stream in case of alert. The alert in question was triggered by
signature 1-6692

Thanks

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!