[Snort-devel] pcap files patch

Brian Caswell bmc at ...227...
Fri Feb 16 05:59:03 EST 2001


Am I the only person that uses snort on machines that don't have network
cards in them?  :)

I got tired of having to specify the "-i lo" when I want to run snort
against a pcap file.  Attached is a patch that will not ask about an
interface if you specify a pcap file with -r.

-- 
Brian Caswell
The MITRE Corporation
-------------- next part --------------
Index: snort.c
===================================================================
RCS file: /cvsroot/snort/snort/snort.c,v
retrieving revision 1.59
diff -u -r1.59 snort.c
--- snort.c	2001/02/15 22:52:02	1.59
+++ snort.c	2001/02/16 15:53:03
@@ -1006,8 +1006,8 @@
         pv.pcap_cmd = copy_argv(&argv[optind]);
     }
 
-
-    if(pv.interfaces[0] == NULL)
+    
+    if((pv.interfaces[0] == NULL) && (pv.readmode_flag == 0))
     {
         pv.interfaces[0] = pcap_lookupdev(errorbuf);
 


More information about the Snort-devel mailing list