Duration/Protocol/Service/Source/flags/Bytes/Dest etc.. bytes needed
Hari Kishore via Snort-users <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <CAC2C35Tv4_Q911Mxm2evAZoHdHh81sU7Yi4a69XD21SDO5FPOw@mail.gmail.com> |
Hi , I'd like to use snort to log the following information on a connection basis: /duration/protocol/service/src/flags/bytes/dest etc... bytes and possibly time stamp So I could create a data file similar to the data set kddcup99 which contains the following fields .. So is it possible to get all these information in logs using snort?? Is is possible ? if yes then how ? duration 1 number (default) protocol_type 2 string (default) service 3 string (default) flag 4 string (default) src_bytes 5 number (default) dst_bytes 6 any (default) land 7 number (default) wrong_fragment 8 number (default) urgent 9 number (default) hot 10 number (default) num_failed_logins 11 number (default) logged_in 12 number (default) lnum_compromised 13 number (default) lroot_shell 14 number (default) lsu_attempted 15 number (default) lnum_root 16 number (default) lnum_file_creations 17 number (default) lnum_shells 18 number (default) lnum_access_files 19 number (default) lnum_outbound_cmds 20 number (default) is_host_login 21 number (default) is_guest_login 22 number (default) count 23 number (default) srv_count 24 number (default) serror_rate 25 number (default) srv_serror_rate 26 number (default) rerror_rate 27 number (default) srv_rerror_rate 28 number (default) same_srv_rate 29 number (default) diff_srv_rate 30 number (default) srv_diff_host_rate 31 number (default) dst_host_count 32 number (default) dst_host_srv_count 33 number (default) dst_host_same_srv_rate 34 number (default) dst_host_diff_srv_rate 35 number (default) dst_host_same_src_port_rate 36 number (default) dst_host_srv_diff_host_rate 37 number (default) dst_host_serror_rate 38 number (default) dst_host_srv_serror_rate 39 number (default) dst_host_rerror_rate 40 number (default) dst_host_srv_rerror_rate 41 number (default) label 42 string (default)Thankyou, Hari _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette