How can we know exactly which packet alert triggered for?
Please let me know how I can find exact packet. I understand that IP addresses are an indication but there are mostly too many packets in pcaps for one IP.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
If you use a recent build of Wireshark, it has a Snort post-dissector which substitutes the packet number into the fractional part of the timestamp before it feeds each packet to Snort. When an alert fires, it can then attach the alert info to the correct packet (showing the correct timestamp) in the Wireshark packet list.