Re: reading packet capture file

[Matt Kettler <mkettler () evi-inc com>]

At 11:59 AM 9/20/2004, John Fiore wrote:
> I have a large packet capture file which contains a
> record of malicious activity.  Is it possible to read
> it into snort offline?  Thanks in advance

If it's a tcpdump binary capture file, certainly.. use snort's -r parameter 
(see man snort for more detail).



-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users