Snort mailing list archives

Re: Problem to sniff 80, 110, 25 and 21 ports.

From: giochi <giochi () telvia it>
Date: Wed, 29 Oct 2003 20:50:29 +0100

Well, the reason is because with tcpdump I must log _all_ packets and not only the traffic to/from 80,110,21 and 25 
ports.

Regards,
Fabrizio


On Wed, 29 Oct 2003 14:25:13 -0500
Matt Kettler <mkettler () evi-inc com> wrote:

At 01:23 PM 10/29/2003, you wrote:

I use this command:

root@andrealnx:~# snort -i eth0 -l prova dst port 80 and dst port 110 and 
dst port 25 and dst port 21

and I've got this error:


Is there a reason why are you using snort for this? If you just need a 
packet dumper, use tcpdump.

Also, the above rule theoretically would never match any packets at all.. 
you want or, not and.. It's impossible for a packet to be destined to port 
80 and port 110, it can only be destined to one or the other.



-- 
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.2.3 (GNU/Linux)

mQGiBD6CJ8QRBACpDkW+4b3/LdE8YsT3FEM/MfH2k0NDxFKhedwYaGi5CzbU7KfM
1sD5KEwBONz2FQM+FIil2wuiVy0aLSnRmQHg6SMCFsGfjAG9Uc41hKpReTI/tG+s
39cX7q21oiE4n22yXpocqLFf0QFXQccHbQ2RzwTCiEPINUjcgXMszQsxXwCgqIDw
IAcSTMx1jdX0gVPMnngMgT8EAJOTRWAoGlb1TfZvLqqPzgWoeQATHV4TQ19QYYv4
McqTRPDVVBKFveRrcVvAF269tDH8PBh3B06KPinMq+yQoQSKWbhg7oT00m9jvkmZ
eU+XpAOpjvi0zFICFTDLag1iVp21NssUPc1XDUxfTpBzxoE+d9sFymCuLq1VhhFZ
jxiPA/0XEyWx1M8RjPxZfS/RRJWKG/ibtViNHpTG9ZGrZow9WWm/5NXdk0AS8bIH
3jHcNpqDJNKHaO4zm5CTkCPBgGkgf9PqeeffKrpUtj1VNXqb+zCSXKF43YwYDVxi
rX/6rNxpby0yQY+OJcJoke+NGCUfMyD2M7znS8bzzm6rWIvkArQ8RmFicml6aW8g
UmVnYWxsaSAoVW5peCBTeXN0ZW0gQWRtaW5pc3RyYXRvcikgPGZhYkB0ZWx2aWEu
aXQ+iFkEExECABkFAj6CJ8UECwcDAgMVAgMDFgIBAh4BAheAAAoJEHjh0f/fOEdn
VbEAn15x05/obw6ipPf4UHZXfu5sX4n3AJ0ZGR8apSUVqj15YuvJf3K+hZNU5A==
=jDBs
-----END PGP PUBLIC KEY BLOCK-----


-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?   SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Current thread:

Problem to sniff 80, 110, 25 and 21 ports. giochi (Oct 29)
- Re: Problem to sniff 80, 110, 25 and 21 ports. Matt Kettler (Oct 29)
  - Re: Problem to sniff 80, 110, 25 and 21 ports. giochi (Oct 29)
  - Re: Problem to sniff 80, 110, 25 and 21 ports. Mike Cojocea (Oct 29)
- <Possible follow-ups>
- Problem to sniff 80, 110, 25 and 21 ports. giochi (Oct 29)
- RE: Problem to sniff 80, 110, 25 and 21 ports. O'Flynn, Derek (Oct 29)