Honeypots mailing list archives

Use of pcap_api.pl


From: "Leonard Kwan" <electron-asx () optusnet com au>
Date: Wed, 13 Sep 2006 23:05:30 +1000

Hi,

I was wondering whether someone could let me know how to use the
pcap_api.pl?

Basically I am trying to get the packet captures that the honeywall records.
I would then like to load these into a database for the purposes of data
mining. 

From what I've been able to gather from the Flow.pl I need to specify
several parameters, but unfortunately have not had any luck getting it to
work.

I've tried ./pcap_api.pl -M sensor=2170483942;con_id=541689 > pcap_temp.txt
to no avail. I get those two parameters from the walleye interface
(/walleye.pl?act=snortdecode;sensor=2170483942;con_id=541689)

Any help would be much appreciated!

Cheers
Leonard


Current thread: