I cannot capture files using file_capture

--===============4373156705452647851==
Content-Type: multipart/alternative; boundary="000000000000040d7d063749b931"

--000000000000040d7d063749b931
Content-Type: text/plain; charset="UTF-8"

this is my command line for reference:

`/usr/sbin/snort --daq-dir /usr/lib64/daq -c
/etc/snort/2_bpbr2_0/config.lua -i enp2s0f0:enp2s0f1 --daq afpacket
--daq-mode inline --daq-var fanout_type=hash -i enp2s0f0:enp2s0f1 -A
alert_json
`

my config.lua:

`
---------------------------------------------------------------------------
-- 7. configure outputs
---------------------------------------------------------------------------

file_policy = {
    enable_type = true,
    enable_signature = true,
    enable_capture = true
}

file_id = {
    rules_file = "/root/capture.rules",
    trace_type = true,
    trace_signature = true,
    trace_stream = true,
}

output = {
    logdir = '/tmp'
}
`
my `capture.rules` file

`
file_id (msg:"Hangul word processor file"; file_meta:type HWP, id 323,
category "Office Documents", version "3.0"; file_data; content:"| 48 57 50
20 44 6F 63 75 6D 65 6E 74 20 46 69 6C 65 |", depth 17, offset 0; gid:4;
sid:200; rev:1;)
file_id (msg:"Flash file"; file_meta:type SWF, id 324, category
"Multimedia"; file_data; content:"| 5A 57 53 |", depth 3, offset 0; gid:4;
sid:201; rev:1;)
file_id (msg:"Packet capture file"; file_meta:type PCAP, id 325, category
"System files"; file_data; content:"| 0A 0D 0D 0A |", depth 4, offset 0;
gid:4; sid:202; rev:1;)
file_id (msg:"Flash file "; file_meta:type SWF, id 54, category
"Multimedia"; file_data; content:"| 58 46 49 52 |", depth 4, offset 0;
gid:4; sid:203; rev:1;)
file_id (msg:"Microsoft Office Open XML Format (OOXML) Document (PPTX)";
f.........................................
`
Anyone can help???

--000000000000040d7d063749b931
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">this is my command line for reference:<br><br>`/usr/sbin/s=
nort --daq-dir /usr/lib64/daq -c /etc/snort/2_bpbr2_0/config.lua -i enp2s0f=
0:enp2s0f1 --daq afpacket --daq-mode inline --daq-var fanout_type=3Dhash -i=
 enp2s0f0:enp2s0f1 -A alert_json<br>`<br><br>my config.lua:<br><br>`<br>---=
------------------------------------------------------------------------<br=
>-- 7. configure outputs<br>-----------------------------------------------=
----------------------------<br><br>file_policy =3D {<br>=C2=A0 =C2=A0 enab=
le_type =3D true,<br>=C2=A0 =C2=A0 enable_signature =3D true,<br>=C2=A0 =C2=
=A0 enable_capture =3D true<br>}<br><br>file_id =3D {<br>=C2=A0 =C2=A0 rule=
s_file =3D &quot;/root/capture.rules&quot;,<br>=C2=A0 =C2=A0 trace_type =3D=
 true,<br>=C2=A0 =C2=A0 trace_signature =3D true,<br>=C2=A0 =C2=A0 trace_st=
ream =3D true,<br>}<div><br></div><div>output =3D {<br>=C2=A0 =C2=A0 logdir=
 =3D &#39;/tmp&#39;<br>}<br>`<br>my `capture.rules` file<br><br>`<br>file_i=
d (msg:&quot;Hangul word processor file&quot;; file_meta:type HWP, id 323, =
category &quot;Office Documents&quot;, version &quot;3.0&quot;; file_data; =
content:&quot;| 48 57 50 20 44 6F 63 75 6D 65 6E 74 20 46 69 6C 65 |&quot;,=
 depth 17, offset 0; gid:4; sid:200; rev:1;)<br>file_id (msg:&quot;Flash fi=
le&quot;; file_meta:type SWF, id 324, category &quot;Multimedia&quot;; file=
_data; content:&quot;| 5A 57 53 |&quot;, depth 3, offset 0; gid:4; sid:201;=
 rev:1;)<br>file_id (msg:&quot;Packet capture file&quot;; file_meta:type PC=
AP, id 325, category &quot;System files&quot;; file_data; content:&quot;| 0=
A 0D 0D 0A |&quot;, depth 4, offset 0; gid:4; sid:202; rev:1;)<br>file_id (=
msg:&quot;Flash file &quot;; file_meta:type SWF, id 54, category &quot;Mult=
imedia&quot;; file_data; content:&quot;| 58 46 49 52 |&quot;, depth 4, offs=
et 0; gid:4; sid:203; rev:1;)<br>file_id (msg:&quot;Microsoft Office Open X=
ML Format (OOXML) Document (PPTX)&quot;; f.................................=
........<br>`<br>Anyone can help???</div></div>

--000000000000040d7d063749b931--

--===============4373156705452647851==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

--===============4373156705452647851==--