Snort mailing list archives
Re: Testing snort
From: Sandip Bankewar <sbankewar () cloudaccess com>
Date: Fri, 25 May 2012 05:29:33 +0000
Hi Nick, Yes I have installed tcpreplay successfully on Linux. Thanks for your help. While installing libpcap I am getting following error: configure: error: Your operating system's lex is insufficient to compile libpcap. flex is a lex replacement that has many advantages, including being able to compile libpcap. For more information, see http://www.gnu.org/software/flex/flex.html. Could you please help me out. Regards, Sandip Bankewar From: Nick Moore [mailto:nmoore () sourcefire com] Sent: 24 May 2012 17:50 To: Sandip Bankewar Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] Testing snort Sandip, I have only used it in Linux and Mac OSX. I have to confess that I haven't used Windows as my primary workstation for over six years and am not familiar with current tools for it. The website mentions Cygwin, which if I remember correctly creates a Linux-like environment for Windows. So you're pretty much back to square one. If there are other users on the list who are more knowledgable regarding Windows and available tcpreplay-like utilities, please chime in. Regarding installation instructions, installing from source is pretty much the same as any package: * tar -zxvf tcpreplay-3.x.x.tar.gz * cd tcpreplay-3.x.x * ./configure && make && make install If you run Debian or Ubuntu, you can use apt-get. Most RPM based distro's should have tcpreplay. (blatantly plagiarizing from the website). To quote Marty Roesch "Learn to use Linux. Like eating your broccoli, it's good for you." A really good start would be to download a Snort set up doc for Ubuntu or CentOS and follow it through. David Gullet has done a much better job than I on keeping up with current releases with his Ubuntu doc. Happy Snorting! Nick On Thu, May 24, 2012 at 6:30 AM, Sandip Bankewar <sbankewar () cloudaccess com<mailto:sbankewar () cloudaccess com>> wrote: Hi Nick, I am new to this. Could you please provide me steps for installation or Is there any windows tool? From: Nick Moore [mailto:nmoore () sourcefire com<mailto:nmoore () sourcefire com>] Sent: 24 May 2012 16:44 To: Sandip Bankewar Subject: Re: [Snort-users] Testing snort Sandip, Please try tcpreplay. http://tcpreplay.synfin.net/ Happy Snorting! Nick On Thu, May 24, 2012 at 5:04 AM, Sandip Bankewar <sbankewar () cloudaccess com<mailto:sbankewar () cloudaccess com>> wrote: Hi All, I want to test snort using large packets. I started wireshark and started to capture traffic. I am planning to save .pcap file and load it into a system running snort. My question is how can I load .pcap or wireshark file to that system? Is there any tool? Is there any other method to test it? Regards, Sandip Bankewar ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net<mailto:Snort-users () lists sourceforge net> Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news! -- Nick Moore, SFCE, CISSP, CISA Sr. Systems Engineer Voice 708-336-9041<tel:708-336-9041> Email nick.moore () sourcefire com<mailto:nick.moore () sourcefire com> IM nickgmoore (Yahoo) nickgmoore38 (AIM) ,,_ o" )~ Sourcefire - The Creators of Snort '''' www.sourcefire.com<http://www.sourcefire.com> www.snort.org<http://www.snort.org> www.immunet.com<http://www.immunet.com> -- Nick Moore, SFCE, CISSP, CISA Sr. Systems Engineer Voice 708-336-9041 Email nick.moore () sourcefire com<mailto:nick.moore () sourcefire com> IM nickgmoore (Yahoo) nickgmoore38 (AIM) ,,_ o" )~ Sourcefire - The Creators of Snort '''' www.sourcefire.com<http://www.sourcefire.com> www.snort.org<http://www.snort.org> www.immunet.com<http://www.immunet.com>
------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Testing snort Sandip Bankewar (May 24)
- Message not available
- Message not available
- Re: Testing snort Nick Moore (May 24)
- Re: Testing snort Paul Halliday (May 24)
- Re: Testing snort Sandip Bankewar (May 24)
- Re: Testing snort Sandip Bankewar (May 24)
- Re: Testing snort Romskie L (May 24)
- Re: Testing snort Sandip Bankewar (May 24)
- Message not available
- Message not available
- Re: Testing snort Sandip Bankewar (May 24)