[Snort-users] Snort vs TCPdump

Denis Ducamp Denis.Ducamp at ...199...
Wed May 30 16:57:33 EDT 2001

On Wed, May 30, 2001 at 09:52:39PM +0200, Jean sébastien Op de Beeck wrote:
> Sorry for my English, I'm French


> Is Snort (I use it) more powerfull than TCPDump (no tested) ?

If by more powerfull you mean the one knowing how to decode the bigger
number of application protocols then tcpdump is better, but in this case I
prefer to use ethereal. If you mean the one the more humanly readable then
snort is better.

But if snort is a great sniffer, it's the best IDS, which tcpdump can't be
without third parties as shadow per example.


 Denis.Ducamp at ...199... --- Hervé Schauer Consultants --- http://www.hsc.fr/
Owl/snort/hping/dsniff en français  http://www.groar.org/~ducamp/#sec-trad
            Owl en français    http://www.openwall.com/Owl/fr/
 Du bon usage de ... http://usenet-fr.news.eu.org/fr-chartes/rfc1855.html

More information about the Snort-users mailing list