Re: IDS and forensics

From: ktimm <ktimm(at)var-log.com>
Date: Thu Jan 30 2003 - 18:29:19 EST

Actually you can get all the payload data with tcpdump by setting the snaplen to max mtu size. You can also query much of that info from tcpdump dump binary files. Another solution is to use snort and log everything. There is an excellent snort configuration from the Honeynet project for logging everything in binary format as well as breaking out sessions. It works great for forensic use. Here is the link. http://project.honeynet.org/papers/honeynet/tools/snort.conf

Kevin      

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Thu Jan 30 22:02:35 2003