Paul Schmehl wrote:
--On Tuesday, February 14, 2006 18:19:46 -0500 Joel Esler
<joel.esler@sourcefire.com> wrote:
Paul,
That may be all there is in the packet. Try running Snort in packet
dump mode (or tcpdump) along side Snort at the same time these packets
are alerting your IDS. Make sure you have snaplen set to 0 (- s 0), and
then compare the two.
That may be all there is.
Snort captures the full snaplen of the packet by default, so unless you
want to use tag to get the whole session, whatever is in the alert, is
what it is in the packet.
Thanks, Joel. I see now that every packet is terminated with a \r\n.
The one packet I emailed to the list that had urlencoded content in it
decodes to this:
user=blah&pass=blah&SUBMIT=提交查询内容
Does anyone have any idea what those strings mean? What is #25552? Or
#20132? Etc.? They look almost like unicode. Or HTML color codes.
Yes, they're unicode. Chinese from the looks of it.
There's a quick way to see what they decode as.. copy the number into
calculator, convert it to hex, and input the hex code into charmap's "go to
unicode" box.
Basic technique from:
http://www.hallvord.com/pc/manual-urldecode.en.htm
Although in this case, we don't have to de-utf8 it, so you can copy-paste the
numeric part into calculator and jump to step 9.
Note: I had to tell charmap to use a "complete" font.. I found that XP's "MS UI
Gothic" worked well to include all the unicode characters.
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
