[ISSForum] query on packet logging Option

Hi,

I have a query on packet logging Option. Could anyone help me out? 

I want to capture the packets which trigger a particular event for
further analysis. How do I do this?

In the current version of SiteProtector, I have to two places to
enable the packet logging. 1) Sensor properties --> Advanced
Parameters --> packetlog.enabled set this value to true. 2) Against
each policy there is an option to enable 'log evidence' (A check box)

I did the first option and the packets were getting logged on the
sensor in the logs folder. 10 files, each 1400 KB. But this is all the
packets coming to the sensor. How do I get the packets only for a
particular event?

I tried the second option and I could not see any packets getting
logged. Appreciate if  someone could advice me on this.



Thanks and Regards



Gijo Thomas
_______________________________________________
ISSForum mailing list
ISSForum@iss.net

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to 
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@iss.net

The ISSForum mailing list is hosted and managed by Internet Security Systems, 
6303 Barfield Road, Atlanta, Georgia, USA 30328.