Snort mailing list archives
Re: Reading a TCPdump file
From: sekure <sekure () gmail com>
Date: Fri, 22 Oct 2004 09:20:19 -0400
Mark, Are you HOME_NET and EXTERNAL_NET variables defined correctly? Also, i am not exactly sure if the tcpdump contains a complete session, or just the alerts, but if it does NOT contain the entire session, Snort won't even look at it, unless you remove the "-z" from the commandline (which looks like you did), and remove the "flow" keyword from the rules. On Thu, 21 Oct 2004 15:15:36 +0100, Mark Johnston <mark.johnston () bluesq com> wrote:
I'm looking at one of the honeynet scan of the month projects (#27). And what I'm trying to do is get snort to read the TCPdump capture file and view the alerts. Thus far I have configured the conf file to have the appropriate values and run snort against the file, however I'm not getting any generated alerts. I know that I should be getting some though. I also have the latest version of the rules and am running snort 2.2 for Fedora Core 2. The command that I am using is "snort -A full -c /etc/snort/snort.conf -r sotm27"
------------------------------------------------------- This SF.net email is sponsored by: IT Product Guide on ITManagersJournal Use IT products in your business? Tell us what you think of them. Give us Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more http://productguide.itmanagersjournal.com/guidepromo.tmpl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Reading a TCPdump file Mark Johnston (Oct 21)
- Re: Reading a TCPdump file sekure (Oct 22)
- RE: Reading a TCPdump file Jeff Dell (Oct 22)
- <Possible follow-ups>
- RE: Reading a TCPdump file Mark Johnston (Oct 29)
- Re: Reading a TCPdump file sekure (Oct 22)