Snort mailing list archives
Re: Troubles With Multiple Sensors
From: Erek Adams <erek () snort org>
Date: Fri, 24 Oct 2003 14:39:03 -0400 (EDT)
On Fri, 24 Oct 2003, Shawn Truax wrote:
I would suggest trying tcpdump instead of snort to do your testing. Running tcpdump as follows: tcpdump -n -X -i eth1 Should dump all packets received on that uplink port and display their payloads (Drop the -X if you don't want payload). This should give you everything ARP, broadcast and anything destined to the port without the complications that snort may give. As an aside I find tcpdump to be the best tool for testing/diagnosing an interface before running snort to make sure everything is working properly.
Actually, that's a bit misleading. Snort and TCPDump both use the libpcap library to snarf packets off of the wire. If Snort can see the packets, then TCPDump can and vice-versa. There is no difference in functionality of pulling the packets off of the wire. If there was, do you think that the SHADOW IDS would have been re-written to use Snort instead of TCPDump? :) Snort doens't have as many decoders as TCPDump or Ethereal, but it can still see the packets. snort -dv -i eth1 Usually gets you a nice breakdown in a much more readable format that TCPDump. :) Cheers! ----- Erek Adams "When things get weird, the weird turn pro." H.S. Thompson ------------------------------------------------------- This SF.net email is sponsored by: The SF.net Donation Program. Do you like what SourceForge.net is doing for the Open Source Community? Make a contribution, and help us add new features and functionality. Click here: http://sourceforge.net/donate/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Fwd: Troubles With Multiple Sensors Tim Rohrer (Oct 23)
- <Possible follow-ups>
- Troubles With Multiple Sensors Tim Rohrer (Oct 24)
- Re: Troubles With Multiple Sensors Erek Adams (Oct 24)
- Re: Troubles With Multiple Sensors Tim Rohrer (Oct 25)
- Re: Troubles With Multiple Sensors Erek Adams (Oct 24)
- Re: Troubles With Multiple Sensors Shawn Truax (Oct 24)
- Re: Troubles With Multiple Sensors Erek Adams (Oct 24)