Re: Specific Host Filter

[Frank Knobbe <frank () knobbe us>]

On Fri, 2004-05-14 at 10:15, Todd.Lambdin wrote:
> Is there an easy way to implement a filter so that I can watch traffic
> between the sensor host and 1 other system only?  I do not want to
> capture all traffic to the sensor, only traffic from 1 specific host. 

Is that not in the FAQ? Limit traffic using the BPF filter. For example:
  snort -c snort.conf -l /var/log host 1.2.3.4
That will only log/alert on packets from/to host 1.2.3.4.

Regards,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part