Re: Snort
Ken Connelly <[email protected]>
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <[email protected]> |
Buelna, Derek wrote: >I'm confused about a couple of things and was hoping for a little feedback. > >I'm analyzing http://isc.sans.org/logs/Raw/2002.9.30 <http://isc.sans.org/logs/Raw/2002.9.30> as part of my GCIA practical. > >The file is a little over 4MB and includes 15021 packets. From what I understand, only packets that fired against a rule are in there. Is this true? > Perhaps, but if the name of the file reflects the date that it was created, there was a *way* different version of snort available then and the ruleset could have been radically different as well. >My concern is that when I run snort against the file, I get 500 alerts. As part of this, when I run it in binary output mode, I get a binary log file that's about 600kB and includes 500 packets! What's the deal with the remaining 3.4MB worth of packets? Is it possible that these are the result of custom rules that I'm not aware of? I have all of the rules turned on, on my snort, although I haven't messed with the preprocessors. > >I'm also not clear on how I can use tcpdump to filter on a few things and then output a binary that snort can read. I want to run tcpdump on the 2002.9.30 file with a filter, save the output file and then run it through snort. When I do this I get no alerts so I think I messed up the syntax. > We could perhaps help if we knew what your tcpdump command looked like. Just saying that you ran the file through tcpdump with a filter doesn't give us much to go on. - ken >I was able to create a display filter in ethereal and save that off and run it through snort though. Maybe I need to output in ASCI and run a converter on it? > >Any suggestions would be appreciated. Thanks, > >Derek A. Buelna, GSEC, CISSP, CCIE #7318 >Information Security >XEROX Office Group >Office: 503.685.2593 >Fax: 503.685.4140 >Email: [email protected] >PGP Fingerprint: F01B F636 ED37 08AD 9D8B 6BCC 5663 F7A4 7F45 4AA5 > > > > >_______________________________________________ >Intrusions mailing list >[email protected] >http://www.dshield.org/mailman/listinfo/intrusions > > _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions