Re: Traffic Capture

["Al Lewis \(allewi\) via Snort-users" <snort-users () lists snort org>]

Hello,

Are you sure snort isnt seeing the ARP traffic? Have you checked your exist stats? See mine for arp below


===============================================================================
Breakdown by protocol (includes rebuilt packets):
        Eth:           42 (100.000%)
       VLAN:            0 (  0.000%)
        IP4:           18 ( 42.857%)
       Frag:            0 (  0.000%)
       ICMP:            0 (  0.000%)
        UDP:            0 (  0.000%)
        TCP:           18 ( 42.857%)
        IP6:            0 (  0.000%)
    IP6 Ext:            0 (  0.000%)
   IP6 Opts:            0 (  0.000%)
      Frag6:            0 (  0.000%)
      ICMP6:            0 (  0.000%)
       UDP6:            0 (  0.000%)
       TCP6:            0 (  0.000%)
     Teredo:            0 (  0.000%)
    ICMP-IP:            0 (  0.000%)
    IP4/IP4:            0 (  0.000%)
    IP4/IP6:            0 (  0.000%)
    IP6/IP4:            0 (  0.000%)
    IP6/IP6:            0 (  0.000%)
        GRE:            0 (  0.000%)
    GRE Eth:            0 (  0.000%)
   GRE VLAN:            0 (  0.000%)
    GRE IP4:            0 (  0.000%)
    GRE IP6:            0 (  0.000%)
GRE IP6 Ext:            0 (  0.000%)
   GRE PPTP:            0 (  0.000%)
    GRE ARP:            0 (  0.000%)
    GRE IPX:            0 (  0.000%)
   GRE Loop:            0 (  0.000%)
       MPLS:            0 (  0.000%)
        ARP:           24 ( 57.143%)


If the traffic is mirrored/copied to snort or if snort is inline it should see the ARP traffic.


Albert Lewis
ENGINEER.SOFTWARE ENGINEERING
SOURCEfire, Inc. now part of Cisco
Email: allewi () cisco com<mailto:allewi () cisco com>

From: Snort-users <snort-users-bounces () lists snort org<mailto:snort-users-bounces () lists snort org>> on behalf of 
Syed Hammad Tahir <mscs16059 () itu edu pk<mailto:mscs16059 () itu edu pk>>
Date: Friday, December 8, 2017 at 5:22 AM
To: waldo kitty <wkitty42 () windstream net<mailto:wkitty42 () windstream net>>
Cc: "snort-users () lists snort org<mailto:snort-users () lists snort org>" <snort-users () lists snort 
org<mailto:snort-users () lists snort org>>
Subject: Re: [Snort-users] Traffic Capture

I specifically want to do it with snort since I am using it as a sensor with apache metron.

On Fri, Dec 8, 2017 at 2:45 PM, <wkitty42 () windstream net<mailto:wkitty42 () windstream net>> wrote:
On 12/08/2017 04:20 AM, Syed Hammad Tahir wrote:
I am specifically interested in capturing the ARP request data. Any help
will be appreciated.

if all you are wanting to do is capture traffic, why not use tcpdump or wireshark? that's what they do... something 
like this should do...

  tcpdump -i eth0 -s0 -w arp_traffic.pcap 'arp or icmp'

check the tcpdump docs to understand the options given...

--
 NOTE: No off-list assistance is given without prior approval.
       *Please keep mailing list traffic on the list unless*
       *a signed and pre-paid contract is in effect with us.*
_______________________________________________
Snort-users mailing list
Snort-users () lists snort org<mailto:Snort-users () lists snort org>
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!


Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette