Re: Sniffer War!!

[beenph <beenph () gmail com>]

Got ram? write to a ramdrive and move them after they have been read.


On Fri, Jul 18, 2014 at 2:06 PM, Jeremy Hoel <jthoel () gmail com> wrote:
> We've been using Daemonlogger and it works great.  plays nice with PF_Ring,
> maintained by the snort guys..  we have been happy with it.
>
>
> On Thu, Jul 17, 2014 at 11:36 PM, Randal T. Rioux <randy () procyonlabs com>
> wrote:
> > I've always used Daemonlogger. And it has been good.
> >
> > But, time passes. And I'm becoming lazy. Crowdsource!
> >
> > What is the collective wisdom around the best way to perform full packet
> > capture?
> >
> > Features... packet loss... OS support (Linux/Unix/*BSD)... etc.
> >
> > I have VSS aggregate tap boxes, and can test daemonlogger, tcpdump and
> > wireshark all at once. But it'd be nice to have some real world
> > experience.
> >
> > Thanks, all.
> >
> >
> > ------------------------------------------------------------------------------
> > Want fast and easy access to all the code in your enterprise? Index and
> > search up to 200,000 lines of code with a free copy of Black Duck
> > Code Sight - the same software that powers the world's largest code
> > search on Ohloh, the Black Duck Open Hub! Try it now.
> > http://p.sf.net/sfu/bds
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> >
> > Please visit http://blog.snort.org to stay current on all the latest Snort
> > news!
>
>
>
> ------------------------------------------------------------------------------
> Want fast and easy access to all the code in your enterprise? Index and
> search up to 200,000 lines of code with a free copy of Black Duck
> Code Sight - the same software that powers the world's largest code
> search on Ohloh, the Black Duck Open Hub! Try it now.
> http://p.sf.net/sfu/bds
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort
> news!

------------------------------------------------------------------------------
Want fast and easy access to all the code in your enterprise? Index and
search up to 200,000 lines of code with a free copy of Black Duck
Code Sight - the same software that powers the world's largest code
search on Ohloh, the Black Duck Open Hub! Try it now.
http://p.sf.net/sfu/bds
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!