0

How can we know exactly which packet alert triggered for?

Please let me know how I can find exact packet. I understand that IP addresses are an indication but there are mostly too many packets in pcaps for one IP.

Improve this question

1 Answer 1

Reset to default
1

If you use a recent build of Wireshark, it has a Snort post-dissector which substitutes the packet number into the fractional part of the timestamp before it feeds each packet to Snort. When an alert fires, it can then attach the alert info to the correct packet (showing the correct timestamp) in the Wireshark packet list.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .