60

Chapter 2     Installing Snort and Getting Started

attached to the packet in addition to TCP, UDP and ICMP information. Note that the

command still does not display all of the packet data.

[root@conformix snort]# /opt/snort/bin/snort  dv

Initializing Output Plugins!

Log directory = /var/log/snort

Initializing Network Interface eth0

          == Initializing Snort ==  

Decoding Ethernet on interface eth0

          == Initialization Complete ==  

 *> Snort! <* 

Version 1.9.0 (Build 209)

By Martin Roesch (roesch@sourcefire.com, www.snort.org)

11/20 16:18:11.129548 192.168.1.100:2474  > 192.168.1.2:22

TCP TTL:128 TOS:0x0 ID:4387 IpLen:20 DgmLen:40 DF

***A**** Seq: 0x9DAEF2FC  Ack: 0xF5688CDA  Win: 0x4190  TcpLen: 20

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

11/20 16:18:11.129723 192.168.1.2:22  > 192.168.1.100:2474

TCP TTL:64 TOS:0x10 ID:57171 IpLen:20 DgmLen:120 DF

***AP*** Seq: 0xF5688D2A  Ack: 0x9DAEF2FC  Win: 0x6330  TcpLen: 20

C5 1D 81 8F 70 B7 12 0B C1 1B 8F 6D A9 8F 1D 05  ....p......m....

40 7D F9 BD 84 21 11 59 05 01 E4 A1 01 20 AC 92  @}...!.Y..... ..

58 50 73 8D 17 EA E2 17 AD 3A AD 54 E2 50 80 CB  XPs......:.T.P..

DA E1 40 30 7B 63 0D 79 5A D8 51 07 93 95 2B A8  ..@0{c.yZ.Q...+.

F8 D4 F5 FA 76 D6 27 35 E8 6E E2 ED 41 2B 01 2D  ....v. 5.n..A+. 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

11/20 16:18:11.130802 192.168.1.2:22  > 192.168.1.100:2474

TCP TTL:64 TOS:0x10 ID:57172 IpLen:20 DgmLen:120 DF

***AP*** Seq: 0xF5688D7A  Ack: 0x9DAEF2FC  Win: 0x6330  TcpLen: 20

E9 7C 09 E0 E0 5C 3E 17 1C BE 93 1F B0 DA 92 40  .|...\>........@

D1 18 71 52 80 F3 B2 F7 59 CE F7 7C D4 8F FD B4  ..qR....Y..|....

98 08 A9 63 63 23 0D C8 9D A4 4F 68 87 06 0D 16  ...cc#....Oh....

44 61 09 CD FF FE 8B 1A 5B D8 42 43 1D 1A 6F A8  Da......[.BC..o.

14 90 C6 63 4C EE 9D 64 1B 90 CC 3A FB BD 7E E4  ...cL..d...:..~.

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

11/20 16:18:11.131701 192.168.1.2:22  > 192.168.1.100:2474

TCP TTL:64 TOS:0x10 ID:57173 IpLen:20 DgmLen:120 DF