Re: [Snort-devel] New feature in snort - mark modified packets

Martin Olsson <elof@sentor.se> writes:

> It would be nice to know if the packet payload one is looking at in ACID

tcpdump is not really doable other than overloading some header field.

acid is doable but requires changes to

1. spo_database
2. ACID

• all the parts of snort that touch a packet flag parameter ( probably would have a new set of packet marks )
• barnyard

  >
  > Could snort include a label indicating the origin of the logged
  

  >
  > Like this:
  

  Do able right now. Frag2 is not doable at the moment however and requires a bit of work to get around it. It's not unworkable, just a pita.

  Do you need help?

  In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related snort.org Links snort-announce snort-cvsinfo snort-devel snort-sigs snort-users Request more information about Pantek

  The M's really should go away eventually. Only telnet & rpc decode still act in that way I believe.

  > Anyone else think this is a good idea?
  

  It is a good idea. Just a lot of work :)

  -- 
  Chris Green 
  You now have 14 minutes to reach minimum safe distance.
  
  
  -------------------------------------------------------
  This SF.Net email is sponsored by: INetU
  Attention Web Developers & Consultants: Become An INetU Hosting Partner.
  Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
  INetU Dedicated Managed Hosting 
  http://www.inetu.net/partner/index.php
  _______________________________________________
  Snort-devel mailing list
  Snort-devel@lists.sourceforge.net
  https://lists.sourceforge.net/lists/listinfo/snort-devel

  Received on Fri Jun 27 08:57:03 2003