Re: I cannot capture files using file_capture

"Oleksii Shumeiko -X \(oshumeik - SOFTSERVE INC at Cisco\) via Snort-users" <[email protected]> Mon, 16 Jun 2025 07:35:19 +0000
Newsgroups gmane.comp.security.ids.snort.general
Message-ID <[email protected]>
--===============8538351470278949426==
Content-Language: en-US
Content-Type: multipart/alternative;
	boundary="_000_8CB41BF06C884820813309C1D268ED68ciscocom_"

--_000_8CB41BF06C884820813309C1D268ED68ciscocom_
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64

SGksIE1pZ3VlbA0KDQpDYW4geW91IGNsYXJpZnkgd2hhdCBpcyBub3Qgd29ya2luZz8NCkN1cnJl
bnRseSwgSSBjYW4gc2VlIHRoZSBjb21tYW5kIGxpbmUsIHRoZSBwYXJ0cyBvZiBjb25maWd1cmF0
aW9uIGFuZC4uLiB0aGF0J3MgaXQuDQoNCk9uIDExIEp1biAyMDI1LCBhdCAxNDowMCwgTWlndWVs
IFZpY2VudGUgw4FsdmFyZXogQWRzdWFyYSB2aWEgU25vcnQtdXNlcnMgPHNub3J0LXVzZXJzQGxp
c3RzLnNub3J0Lm9yZz4gd3JvdGU6DQoNCnRoaXMgaXMgbXkgY29tbWFuZCBsaW5lIGZvciByZWZl
cmVuY2U6DQoNCmAvdXNyL3NiaW4vc25vcnQgLS1kYXEtZGlyIC91c3IvbGliNjQvZGFxIC1jIC9l
dGMvc25vcnQvMl9icGJyMl8wL2NvbmZpZy5sdWEgLWkgZW5wMnMwZjA6ZW5wMnMwZjEgLS1kYXEg
YWZwYWNrZXQgLS1kYXEtbW9kZSBpbmxpbmUgLS1kYXEtdmFyIGZhbm91dF90eXBlPWhhc2ggLWkg
ZW5wMnMwZjA6ZW5wMnMwZjEgLUEgYWxlcnRfanNvbg0KYA0KDQpteSBjb25maWcubHVhOg0KDQpg
DQotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0NCi0tIDcuIGNvbmZpZ3VyZSBvdXRwdXRzDQotLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0NCg0KZmlsZV9wb2xpY3kgPSB7DQogICAgZW5hYmxlX3R5cGUgPSB0cnVlLA0KICAg
IGVuYWJsZV9zaWduYXR1cmUgPSB0cnVlLA0KICAgIGVuYWJsZV9jYXB0dXJlID0gdHJ1ZQ0KfQ0K
DQpmaWxlX2lkID0gew0KICAgIHJ1bGVzX2ZpbGUgPSAiL3Jvb3QvY2FwdHVyZS5ydWxlcyIsDQog
ICAgdHJhY2VfdHlwZSA9IHRydWUsDQogICAgdHJhY2Vfc2lnbmF0dXJlID0gdHJ1ZSwNCiAgICB0
cmFjZV9zdHJlYW0gPSB0cnVlLA0KfQ0KDQpvdXRwdXQgPSB7DQogICAgbG9nZGlyID0gJy90bXAn
DQp9DQpgDQpteSBgY2FwdHVyZS5ydWxlc2AgZmlsZQ0KDQpgDQpmaWxlX2lkIChtc2c6Ikhhbmd1
bCB3b3JkIHByb2Nlc3NvciBmaWxlIjsgZmlsZV9tZXRhOnR5cGUgSFdQLCBpZCAzMjMsIGNhdGVn
b3J5ICJPZmZpY2UgRG9jdW1lbnRzIiwgdmVyc2lvbiAiMy4wIjsgZmlsZV9kYXRhOyBjb250ZW50
OiJ8IDQ4IDU3IDUwIDIwIDQ0IDZGIDYzIDc1IDZEIDY1IDZFIDc0IDIwIDQ2IDY5IDZDIDY1IHwi
LCBkZXB0aCAxNywgb2Zmc2V0IDA7IGdpZDo0OyBzaWQ6MjAwOyByZXY6MTspDQpmaWxlX2lkICht
c2c6IkZsYXNoIGZpbGUiOyBmaWxlX21ldGE6dHlwZSBTV0YsIGlkIDMyNCwgY2F0ZWdvcnkgIk11
bHRpbWVkaWEiOyBmaWxlX2RhdGE7IGNvbnRlbnQ6InwgNUEgNTcgNTMgfCIsIGRlcHRoIDMsIG9m
ZnNldCAwOyBnaWQ6NDsgc2lkOjIwMTsgcmV2OjE7KQ0KZmlsZV9pZCAobXNnOiJQYWNrZXQgY2Fw
dHVyZSBmaWxlIjsgZmlsZV9tZXRhOnR5cGUgUENBUCwgaWQgMzI1LCBjYXRlZ29yeSAiU3lzdGVt
IGZpbGVzIjsgZmlsZV9kYXRhOyBjb250ZW50OiJ8IDBBIDBEIDBEIDBBIHwiLCBkZXB0aCA0LCBv
ZmZzZXQgMDsgZ2lkOjQ7IHNpZDoyMDI7IHJldjoxOykNCmZpbGVfaWQgKG1zZzoiRmxhc2ggZmls
ZSAiOyBmaWxlX21ldGE6dHlwZSBTV0YsIGlkIDU0LCBjYXRlZ29yeSAiTXVsdGltZWRpYSI7IGZp
bGVfZGF0YTsgY29udGVudDoifCA1OCA0NiA0OSA1MiB8IiwgZGVwdGggNCwgb2Zmc2V0IDA7IGdp
ZDo0OyBzaWQ6MjAzOyByZXY6MTspDQpmaWxlX2lkIChtc2c6Ik1pY3Jvc29mdCBPZmZpY2UgT3Bl
biBYTUwgRm9ybWF0IChPT1hNTCkgRG9jdW1lbnQgKFBQVFgpIjsgZi4uLi4uLi4uLi4uLi4uLi4u
Li4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uDQpgDQpBbnlvbmUgY2FuIGhlbHA/Pz8NCl9fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpTbm9ydC11c2VycyBtYWls
aW5nIGxpc3QNClNub3J0LXVzZXJzQGxpc3RzLnNub3J0Lm9yZw0KR28gdG8gdGhpcyBVUkwgdG8g
Y2hhbmdlIHVzZXIgb3B0aW9ucyBvciB1bnN1YnNjcmliZToNCmh0dHBzOi8vbGlzdHMuc25vcnQu
b3JnL21haWxtYW4vbGlzdGluZm8vc25vcnQtdXNlcnMNCg0KVG8gdW5zdWJzY3JpYmUsIHNlbmQg
YW4gZW1haWwgdG86DQpzbm9ydC11c2Vycy1sZWF2ZUBsaXN0cy5zbm9ydC5vcmcNCg0KUGxlYXNl
IHZpc2l0IGh0dHA6Ly9ibG9nLnNub3J0Lm9yZyB0byBzdGF5IGN1cnJlbnQgb24gYWxsIHRoZSBs
YXRlc3QgU25vcnQgbmV3cyENCg0KUGxlYXNlIGZvbGxvdyB0aGVzZSBydWxlczogaHR0cHM6Ly9z
bm9ydC5vcmcvZmFxL3doYXQtaXMtdGhlLW1haWxpbmctbGlzdC1ldGlxdWV0dGUNCg0K

--_000_8CB41BF06C884820813309C1D268ED68ciscocom_
Content-Type: text/html; charset="utf-8"
Content-ID: <[email protected]>
Content-Transfer-Encoding: base64

PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i
dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5IHN0eWxlPSJvdmVyZmxv
dy13cmFwOiBicmVhay13b3JkOyAtd2Via2l0LW5ic3AtbW9kZTogc3BhY2U7IGxpbmUtYnJlYWs6
IGFmdGVyLXdoaXRlLXNwYWNlOyI+DQpIaSwgTWlndWVsDQo8ZGl2Pjxicj4NCjwvZGl2Pg0KPGRp
dj5DYW4geW91IGNsYXJpZnkgPGk+d2hhdCBpcyBub3Qgd29ya2luZzwvaT4/PC9kaXY+DQo8ZGl2
PkN1cnJlbnRseSwgSSBjYW4gc2VlIHRoZSBjb21tYW5kIGxpbmUsIHRoZSBwYXJ0cyBvZiBjb25m
aWd1cmF0aW9uIGFuZC4uLiB0aGF0J3MgaXQuPC9kaXY+DQo8ZGl2Pg0KPGRpdj48YnI+DQo8Ymxv
Y2txdW90ZSB0eXBlPSJjaXRlIj4NCjxkaXY+T24gMTEgSnVuIDIwMjUsIGF0IDE0OjAwLCBNaWd1
ZWwgVmljZW50ZSDDgWx2YXJleiBBZHN1YXJhIHZpYSBTbm9ydC11c2VycyAmbHQ7c25vcnQtdXNl
cnNAbGlzdHMuc25vcnQub3JnJmd0OyB3cm90ZTo8L2Rpdj4NCjxiciBjbGFzcz0iQXBwbGUtaW50
ZXJjaGFuZ2UtbmV3bGluZSI+DQo8ZGl2Pg0KPGRpdiBkaXI9Imx0ciI+dGhpcyBpcyBteSBjb21t
YW5kIGxpbmUgZm9yIHJlZmVyZW5jZTo8YnI+DQo8YnI+DQpgL3Vzci9zYmluL3Nub3J0IC0tZGFx
LWRpciAvdXNyL2xpYjY0L2RhcSAtYyAvZXRjL3Nub3J0LzJfYnBicjJfMC9jb25maWcubHVhIC1p
IGVucDJzMGYwOmVucDJzMGYxIC0tZGFxIGFmcGFja2V0IC0tZGFxLW1vZGUgaW5saW5lIC0tZGFx
LXZhciBmYW5vdXRfdHlwZT1oYXNoIC1pIGVucDJzMGYwOmVucDJzMGYxIC1BIGFsZXJ0X2pzb248
YnI+DQpgPGJyPg0KPGJyPg0KbXkgY29uZmlnLmx1YTo8YnI+DQo8YnI+DQpgPGJyPg0KLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tPGJyPg0KLS0gNy4gY29uZmlndXJlIG91dHB1dHM8YnI+DQotLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS08YnI+DQo8YnI+DQpmaWxlX3BvbGljeSA9IHs8YnI+DQombmJzcDsgJm5ic3A7IGVu
YWJsZV90eXBlID0gdHJ1ZSw8YnI+DQombmJzcDsgJm5ic3A7IGVuYWJsZV9zaWduYXR1cmUgPSB0
cnVlLDxicj4NCiZuYnNwOyAmbmJzcDsgZW5hYmxlX2NhcHR1cmUgPSB0cnVlPGJyPg0KfTxicj4N
Cjxicj4NCmZpbGVfaWQgPSB7PGJyPg0KJm5ic3A7ICZuYnNwOyBydWxlc19maWxlID0gJnF1b3Q7
L3Jvb3QvY2FwdHVyZS5ydWxlcyZxdW90Oyw8YnI+DQombmJzcDsgJm5ic3A7IHRyYWNlX3R5cGUg
PSB0cnVlLDxicj4NCiZuYnNwOyAmbmJzcDsgdHJhY2Vfc2lnbmF0dXJlID0gdHJ1ZSw8YnI+DQom
bmJzcDsgJm5ic3A7IHRyYWNlX3N0cmVhbSA9IHRydWUsPGJyPg0KfQ0KPGRpdj48YnI+DQo8L2Rp
dj4NCjxkaXY+b3V0cHV0ID0gezxicj4NCiZuYnNwOyAmbmJzcDsgbG9nZGlyID0gJy90bXAnPGJy
Pg0KfTxicj4NCmA8YnI+DQpteSBgY2FwdHVyZS5ydWxlc2AgZmlsZTxicj4NCjxicj4NCmA8YnI+
DQpmaWxlX2lkIChtc2c6JnF1b3Q7SGFuZ3VsIHdvcmQgcHJvY2Vzc29yIGZpbGUmcXVvdDs7IGZp
bGVfbWV0YTp0eXBlIEhXUCwgaWQgMzIzLCBjYXRlZ29yeSAmcXVvdDtPZmZpY2UgRG9jdW1lbnRz
JnF1b3Q7LCB2ZXJzaW9uICZxdW90OzMuMCZxdW90OzsgZmlsZV9kYXRhOyBjb250ZW50OiZxdW90
O3wgNDggNTcgNTAgMjAgNDQgNkYgNjMgNzUgNkQgNjUgNkUgNzQgMjAgNDYgNjkgNkMgNjUgfCZx
dW90OywgZGVwdGggMTcsIG9mZnNldCAwOyBnaWQ6NDsgc2lkOjIwMDsgcmV2OjE7KTxicj4NCmZp
bGVfaWQgKG1zZzomcXVvdDtGbGFzaCBmaWxlJnF1b3Q7OyBmaWxlX21ldGE6dHlwZSBTV0YsIGlk
IDMyNCwgY2F0ZWdvcnkgJnF1b3Q7TXVsdGltZWRpYSZxdW90OzsgZmlsZV9kYXRhOyBjb250ZW50
OiZxdW90O3wgNUEgNTcgNTMgfCZxdW90OywgZGVwdGggMywgb2Zmc2V0IDA7IGdpZDo0OyBzaWQ6
MjAxOyByZXY6MTspPGJyPg0KZmlsZV9pZCAobXNnOiZxdW90O1BhY2tldCBjYXB0dXJlIGZpbGUm
cXVvdDs7IGZpbGVfbWV0YTp0eXBlIFBDQVAsIGlkIDMyNSwgY2F0ZWdvcnkgJnF1b3Q7U3lzdGVt
IGZpbGVzJnF1b3Q7OyBmaWxlX2RhdGE7IGNvbnRlbnQ6JnF1b3Q7fCAwQSAwRCAwRCAwQSB8JnF1
b3Q7LCBkZXB0aCA0LCBvZmZzZXQgMDsgZ2lkOjQ7IHNpZDoyMDI7IHJldjoxOyk8YnI+DQpmaWxl
X2lkIChtc2c6JnF1b3Q7Rmxhc2ggZmlsZSAmcXVvdDs7IGZpbGVfbWV0YTp0eXBlIFNXRiwgaWQg
NTQsIGNhdGVnb3J5ICZxdW90O011bHRpbWVkaWEmcXVvdDs7IGZpbGVfZGF0YTsgY29udGVudDom
cXVvdDt8IDU4IDQ2IDQ5IDUyIHwmcXVvdDssIGRlcHRoIDQsIG9mZnNldCAwOyBnaWQ6NDsgc2lk
OjIwMzsgcmV2OjE7KTxicj4NCmZpbGVfaWQgKG1zZzomcXVvdDtNaWNyb3NvZnQgT2ZmaWNlIE9w
ZW4gWE1MIEZvcm1hdCAoT09YTUwpIERvY3VtZW50IChQUFRYKSZxdW90OzsgZi4uLi4uLi4uLi4u
Li4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uPGJyPg0KYDxicj4NCkFueW9uZSBjYW4gaGVs
cD8/PzwvZGl2Pg0KPC9kaXY+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fXzxicj4NClNub3J0LXVzZXJzIG1haWxpbmcgbGlzdDxicj4NClNub3J0LXVzZXJz
QGxpc3RzLnNub3J0Lm9yZzxicj4NCkdvIHRvIHRoaXMgVVJMIHRvIGNoYW5nZSB1c2VyIG9wdGlv
bnMgb3IgdW5zdWJzY3JpYmU6PGJyPg0KaHR0cHM6Ly9saXN0cy5zbm9ydC5vcmcvbWFpbG1hbi9s
aXN0aW5mby9zbm9ydC11c2Vyczxicj4NCjxicj4NCjxzcGFuIGNsYXNzPSJBcHBsZS10YWItc3Bh
biIgc3R5bGU9IndoaXRlLXNwYWNlOnByZSI+PC9zcGFuPlRvIHVuc3Vic2NyaWJlLCBzZW5kIGFu
IGVtYWlsIHRvOjxicj4NCjxzcGFuIGNsYXNzPSJBcHBsZS10YWItc3BhbiIgc3R5bGU9IndoaXRl
LXNwYWNlOnByZSI+PC9zcGFuPnNub3J0LXVzZXJzLWxlYXZlQGxpc3RzLnNub3J0Lm9yZzxicj4N
Cjxicj4NClBsZWFzZSB2aXNpdCBodHRwOi8vYmxvZy5zbm9ydC5vcmcgdG8gc3RheSBjdXJyZW50
IG9uIGFsbCB0aGUgbGF0ZXN0IFNub3J0IG5ld3MhPGJyPg0KPGJyPg0KUGxlYXNlIGZvbGxvdyB0
aGVzZSBydWxlczogaHR0cHM6Ly9zbm9ydC5vcmcvZmFxL3doYXQtaXMtdGhlLW1haWxpbmctbGlz
dC1ldGlxdWV0dGU8YnI+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPGJyPg0KPC9k
aXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo=

--_000_8CB41BF06C884820813309C1D268ED68ciscocom_--

--===============8538351470278949426==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

--===============8538351470278949426==--