[Snort-users] outgoing traffic question

permalink · #1 (**permalink**) 03-02-2005

This is a multi-part message in MIME format.

------_=_NextPart_001_01C51EA2.F3402B32
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

I've just recently installed snort on my network and I'm still trying to
figure out what exactly I'm looking at on the ACID page.

Right now I'm more interested in seeing what traffic is going out of my
network, eg: url, and ports being accessed. =20

=20

When I click on destination ip address I see some of the ips that I've
been trying to access within my network. But if don't see any ips/url
for any sites I've gone outside my network. I do see a .255 ip which I
think is tells me that an outside url/ip was accessed. =20

=20

Any ideas as where I should look in my configs to be able to view the
type of info I'm trying to see?

=20

Thanks.

=20

-guillermo

=20

=20

=20

=20

------_=_NextPart_001_01C51EA2.F3402B32
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered medium)">
<style>

</style>

</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple>

<div class=3DSection1>

I’ve just recently installed snort on my =
network and I’m
still trying to figure out what exactly I’m looking at on the ACID =
page.<o:p></o:p>

Right now I’m more interested in seeing what =
traffic
is going out of my network, eg: url, and ports being accessed.  =
<o:p></o:p>

<o:p> </o:p>

When I click on destination ip address I see some of =
the ips
that I’ve been trying to access within my network.  But if =
don’t see
any ips/url for any sites I’ve gone outside my network.  I do =
see a .255
ip which I think is tells me that an outside url/ip was accessed.  =
<o:p></o:p>

<o:p> </o:p>

Any ideas as where I should look in my configs to be =
able to
view the type of info I’m trying to =
see?<o:p></o:p>

<o:p> </o:p>

Thanks.<o:p></o:p>

<o:p> </o:p>

-guillermo<o:p></o:p>

<o:p> </o:p>

<o:p> </o:p>

<o:p> </o:p>

<o:p> </o:p>

</div>

</body>

</html>

------_=_NextPart_001_01C51EA2.F3402B32--

-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode