Re: running snort as packet logger and nids simultaneously

[Metal Gear <finattack () gmail com>]

Thanks,



On 6/7/05, Joel Esler <eslerj () gmail com> wrote:
> Either way you're going to end up with the same result.
>
> Write three rules
>
> alert tcp any any -> any any (msg:"TCP Capture";)
> alert udp any any -> any any (msg:"Udp capture";)
> alert icmp any any -> any any (msg:"ICMP capture";)
>
> then restart snort.
>
> On 6/7/05, Metal Gear <finattack () gmail com> wrote:
> > the reasone i opted for that is due to very small size of the network 
> i.e
> > only 5 computers on that.
>
>
> --
> Joel Esler
> BASE Project Lead
> http://sourceforge.net/projects/secureideas