Re: multiple files off of stdin?

["Michael L. Artz" <dragon () october29 net>]

Phil Wood wrote:

> I cannot think of any reason to run snort just once.  Why not:
>
> ls *.pcap | while read f; do
>  snort -r $f ... other args
> done
>  
Becuase I want to try and examine *everything*, and all of the snort 
preprocessors (like the fragmentation and session reassembly, and any 
others that I might write) will lose their state every time snort is 
restarted.  So if an attack happened over the boundary of one of my 
files, snort won't pick it up.

I am contemplating just writing a little script to strip off the libpcap 
header on all files except the first one, if that is the problem.

-Mike




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users