Snort mailing list archives
Re: reading packet capture file
From: Matt Kettler <mkettler () evi-inc com>
Date: Mon, 20 Sep 2004 12:57:20 -0400
At 11:59 AM 9/20/2004, John Fiore wrote:
I have a large packet capture file which contains a record of malicious activity. Is it possible to read it into snort offline? Thanks in advance
If it's a tcpdump binary capture file, certainly.. use snort's -r parameter (see man snort for more detail).
------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- reading packet capture file John Fiore (Sep 20)
- Re: reading packet capture file Scott Zawalski (Sep 20)
- Re: reading packet capture file Matt Kettler (Sep 20)