Snort mailing list archives
Re: Snort dont understand pf (openbsd) format
From: Matt Kettler <mkettler () evi-inc com>
Date: Mon, 29 Nov 2004 19:06:40 -0500
At 06:27 PM 11/29/2004, Matt Kettler wrote:
> What is wrong with that? Does snort understand the pf log format? No, snort doesn't understand any textual log formats at all, including pf.
Self correction.. pflogd generates tcpdump binary files. So, theoretically, it should work with snort -r.
My mistake entirely.However, looking around, pflogd files aren't exactly tcpdump files.. they have (or at least had) a "pftcpdump" to read them in freebsd:
http://lists.freebsd.org/pipermail/freebsd-current/2004-August/035814.html http://lists.sans.org/pipermail/list/2004-November/062633.htmlIt's unclear if OpenBSD generates real tcpdump files that any ordinary tcpdump can read, or if they patched tcpdump to support them.
------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users.Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort dont understand pf (openbsd) format Breno Leitão (Nov 29)
- Re: Snort dont understand pf (openbsd) format Matt Kettler (Nov 29)
- Re: Snort dont understand pf (openbsd) format Matt Kettler (Nov 29)
- Re: Snort dont understand pf (openbsd) format Sean Brown (Nov 29)
- Re: Snort dont understand pf (openbsd) format Matt Kettler (Nov 29)
- Re: Snort dont understand pf (openbsd) format Sean Brown (Nov 29)
- Re: Snort dont understand pf (openbsd) format Matt Kettler (Nov 30)
- Re: Snort dont understand pf (openbsd) format Matt Kettler (Nov 30)
- Re: Snort dont understand pf (openbsd) format Christian Robottom Reis (Nov 30)
- Re: Snort dont understand pf (openbsd) format Sean Brown (Nov 30)
- Re: Snort dont understand pf (openbsd) format Christian Robottom Reis (Dec 01)
- Re: Snort dont understand pf (openbsd) format Jeremy Hewlett (Dec 01)
- Re: Snort dont understand pf (openbsd) format Breno Leitão (Dec 02)
- Re: Snort dont understand pf (openbsd) format Matt Kettler (Nov 29)
- Re: Snort dont understand pf (openbsd) format Matt Kettler (Nov 29)