Re: Snort dont understand pf (openbsd) format

["M. Shirk" <shirkdog_list () hotmail com>]

> From: Matt Kettler <mkettler () evi-inc com>
> To: leitao () async com br (Breno Leitão ),   
> snort-users () lists sourceforge net
> Subject: Re: [Snort-users] Snort dont understand pf (openbsd) format
> Date: Mon, 29 Nov 2004 18:27:24 -0500

> The manpage is pretty clear about what kind of format -r expects. It 
> expects a tcpdump format file.


While pf is running on OpenBSD, it creates tcpdump log file using the pflog0 
pseudo-device. You can simply take the /var/log/pflog  and that should work 
with snort because it is already in tcpdump binary format.

More info on pf logging from the OpenBSD site:
http://www.openbsd.org/faq/pf/logging.html


Shirkdog
http://www.shirkdog.us

_________________________________________________________________
DonÂ’t just search. Find. Check out the new MSN Search! 
http://search.msn.click-url.com/go/onm00200636ave/direct/01/



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users