0

how can I use snort to breakdown http/https traffic into separate sessions and track each session separately and also dump them into separate log files or something that I can read from.

  • I don't think you can do this with snort, i.e. it is the wrong tool for this kind of job. – Steffen Ullrich Jul 12 '17 at 7:26
  • @SteffenUllrich afaik snort understands sessions, right? so why not? – sepisoad Jul 12 '17 at 8:38
  • snort understand TCP sessions but not HTTP sessions (and not TLS sessions). All these are different things. Given your question HTTP session is what you want to track - which can span multiple TCP sessions but a TCP session can also contain parts from different HTTP sessions. Also, snort does no SSL interception so HTTPS will not be analyzed. – Steffen Ullrich Jul 12 '17 at 9:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.