Re: simultaneous snort and tcpdump

[Bennett Todd <bet () rahul net>]

In testing, I've run both snort and tcpdump (and other libpcap based
sniffing programs) concurrently against the same promisc interface,
and even concurrently used that same interface for real network
interaction.

As far as I know, you can just run your snort and your tcpdump at
the same time; while the performance consequences might not be
ideal, I suspect they'd be better than one tcpdump teeing to a fifo
for snort then piping into another tcpdump.

-Bennett

Attachment: _bin
Description: