Re: How does TCP connections over multiple Pcap files

["Al Lewis \(allewi\) via Snort-users" <snort-users () lists snort org>]

Hello,

Have you tried combining the pcaps offline into one and then replaying that into snort?


Albert Lewis
ENGINEER.SOFTWARE ENGINEERING
Cisco Systems Inc.
Email: allewi () cisco com<mailto:allewi () cisco com>


From: Snort-users <snort-users-bounces () lists snort org> on behalf of Mark A via Snort-users <snort-users () lists 
snort org>
Reply-To: Mark A <sec.marka () gmail com>
Date: Saturday, July 21, 2018 at 10:27 AM
To: "snort-users () lists snort org" <snort-users () lists snort org>
Subject: [Snort-users] How does TCP connections over multiple Pcap files

Hi all,

Was just wondering if snort can handle a connection that is spread over multiple PCAP files? If so, how (or any 
documentation that points to how it works)


The likely example will be

1) You have two routers (Router A and Router B) connected to the same ISP.
2) BGP has been configured so that traffic is load balanced to the ISP from the two routers.
3) Captures are running on the ISP facing interfaces on Router A and Router B and sent to a directory.
3) Snort is configured to read pcaps off a directory

A TCP connection from your LAN to a server on the internet is made. The packets are split in a round robin fashion 
between Router A and Router B.

Kind Regards,
Mark A

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette