Snort mailing list archives

take a .pcap file and convert to .csv file


From: "Neil" <nro () ix netcom com>
Date: Sun, 6 Mar 2005 18:09:42 -0500

snort users list:

 

I am new to snort.

I am running snort on a windows XP box (sorry my *nix boxes are currently
offline).

How do I simultaneously read a tcpdump file and output this same file to csv
(for Excel use)?

 

I can read the tcpdump file

F:\snort\bin>snort -r  file.pcap 

 

and I have added the following to snort.conf

output alert_CSV: F:\Snort\log\alert.csv
timestamp,msg,proto,src,srcport,dst,dstport

 

 

However, How do I combine both actions at once?

 

When I run F:\snort\bin>snort -r  file.pcap  a csv file never materializes.

 

I've read through several email archives, and did not quite see this issue,
and tried a few things from answers to other questions with no luck.

Thanks

-neil


Current thread: