[Snort-users] increase packet size capture problem

I have a rule that captures outgoing data and logs to a seperate file.  Problem 
is that the data is truncated.  That is, not all the data is captured.  I am 
aware of the -P option to modify snaplen and also of "session" modifier, but 
changing these values doesn't seem to work -- I always end up with my outgoing 
data truncated.  I'm presuming that the data that is truncated is being put 
into a subsequent outing going packet and the alert that generates the first 
capture cannot say, "Hey, also capture all associated packets."  But I figured 
that's what the "session" keyword is for, but using it doesn't seem to help.

Any help much appreciated.

Thanks,

bulgin




-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list