Snort mailing list archives
Re: Capturing incoming packets?
From: Erek Adams <erek () snort org>
Date: Fri, 13 Jun 2003 22:45:58 -0400 (EDT)
On Fri, 13 Jun 2003 guano () hackerfactor com wrote: [...snip...]
I really want to capture "everything that is initiated from the outside world". Including UDP, TCP, and ICMP (ARP isn't important to me). Basically, I want to capture everything that is not part of a session initiated by me. - Keeping track of TCP sessions is feasible. - Keeping track of UDP and ICMP sessions (since they are stateless) is a little more difficult. I'm thinking it would keep track of host/port in a finite timeframe. Is this possible already?
Yep. snort -l <logdir> -b 'not net <local_lan>' Cheers! ----- Erek Adams "When things get weird, the weird turn pro." H.S. Thompson ------------------------------------------------------- This SF.NET email is sponsored by: eBay Great deals on office technology -- on eBay now! Click here: http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Capturing incoming packets? guano (Jun 13)
- Re: Capturing incoming packets? Erek Adams (Jun 13)
- Re: Capturing incoming packets? guano (Jun 13)
- Re: Capturing incoming packets? Erek Adams (Jun 14)
- Re: Capturing incoming packets? guano (Jun 14)
- Re: Capturing incoming packets? Erek Adams (Jun 16)
- Re: Capturing incoming packets? guano (Jun 13)
- Re: Capturing incoming packets? Erek Adams (Jun 13)