Re: Catchall Rule

[Kenton Smith <ksmith () chartwelltechnology com>]

I may be missing something here, but isn't ICMP traffic IP traffic? Or
are you just suggesting this so that you can see the type of IP traffic
that it is?

Kenton Smith

On Thu, 2003-02-06 at 09:11,erek () snort org wrote:

> On Thu, 6 Feb 2003, Gary Hill wrote:
>
> > I take it this rule wont capture non-tcp/udp/icmp traffic such as IPSEC!
>
> > Can you create a rule that looks at all IP traffic, rather then each
> > protocol on the top of it
>
> Sure.
>
> log ip any any -> $HOME_NET any;
>
> But traffic isn't always ip traffic....
>
> log icmp any any -> $HOME_NET any;
> log arp any any -> $HOME_NET any;
>
> (Ok, the last one is silly, but he said "all traffic". :)
>
> > From what I'm getting, you want to snarf all the frames on the wire, then
> shove that into a DB.  If you do, be _sure_ to have acres of disk, and one
> helluva machine for the DB.  You might get better performance using
> Barnyard to spool the files.  If realtime isn't an issue, you might be
> better off with tcpdump and then using Snort to post process.
>
> Cheers!
>
> -----
> Erek Adams
   "When things get weird, the weird turn pro."   H.S. Thompson




-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users