Re: simultaneous snort and tcpdump

[Jason <security () brvenik com>]

create a rule that matches the other interesting traffic.

look at the docs for creating rules on snort.org

Carl Gibbons wrote:

> Thanks, Bennett and Gary.
>
> I was needlessly complicating matters.  Perhaps I still am: one
> reason I want simultaneous snort/tcpdump is that "snort -b" only
> seems to record packets on which it finds a rule match, and I want
> to record other traffic as well.  Perhaps there's an elegant,
> efficient way to do so with a single snort process?  - Carl
>
> Bennett Todd wrote:
>  
>
> > > As far as I know, you can just run your snort and your tcpdump at
> > > the same time...
> > >      
>
> Gary Flynn wrote:
>  
>
> > My experiences are the same as Bennett's. I've got ntop and
> > snort running on the same interface and they seem to be
> > sharing it fine.
> >
> > When I first contemplated doing this, I did some superficial
> > research that suggested to me that this wouldn't be a problem.
> > After diving through pcap code and then into the kernel
> > network handling code, I came to the conclusion that all
> > pcap applications have a PF_SOCKET open whose packet_rcv()
> > functions are sequentially called by the kernel.
> >
> > This seems to be very nicely documented in the following two
> > articles:
> >
> > http://www.linuxjournal.com/article.php?sid=4852
> > and
> > http://www.linuxjournal.com/article.php?sid=5617
> >    
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>  



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users