How can we know exactly which packet alert triggered for?

Please let me know how I can find exact packet. I understand that IP addresses are an indication but there are mostly too many packets in pcaps for one IP.


If you use a recent build of Wireshark, it has a Snort post-dissector which substitutes the packet number into the fractional part of the timestamp before it feeds each packet to Snort. When an alert fires, it can then attach the alert info to the correct packet (showing the correct timestamp) in the Wireshark packet list.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.