I work with snort log file and now I need to extract the TCP header.

My question is: How to log only the TCP header from the packets captured by snort log file (without the payload) using command line in snort or nmap? any one from them will be suficient, just I want to have the tcp header in any way possible.

  • @schroeder, I have snort log file contain tcp packets, I want to know how to extract only the tcp header by using either of snort or nmap, any of them will be okay. I guess I must edit the question, sorry – Dalya Jun 1 '17 at 11:00
  • 1
    As far as Nmap is concerned looking at the headers probably wouldn't be possible. A better solution is to use tcpdump in parallel with Nmap or make the change in source code of Nmap and make it again. If you need more detail on these two suggestions then let me know. – Abhishek Singh Jun 1 '17 at 13:22
  • @schroeder, I read in this paper(Distributed Network Traffic Feature Extraction for a Real-time IDS) that Netmap used to extract required headers, Nmap and Netmap are the same thing right? – Dalya Jun 2 '17 at 2:56
  • I want to simulate dos attack by using hping3,then use snort to log this traffic , I want only the tcp headers, so after that I want to extract the header fields so I can analysis and Discover the Dos attack. – Dalya Jun 2 '17 at 3:00
  • @Abhishek Singh, Yes I want more detail on these two suggestions please. – Dalya Jun 2 '17 at 3:02