[Snort-users] snort and tcpdump

Ganu Skop skopganu at ...131...
Thu Feb 7 23:04:02 EST 2002


hi all,
got this matter to solve;
anyone got a paper/reference  on tcpdump and snort - a
reference need it pretty badly.
as in my opinion, tcpdump by default only capture 60
bytes of data (no payload) and we need to do the
filter based on abnormal packet behaviour - more or
less like shadow ids.
where as snort has all the feature with rules , stream
assembly and etc.
therefore it's better to run snort than capture
tcpdump and load it back to snort ..right ?

need ur feedback


=====
//skopganu

__________________________________________________
Do You Yahoo!?
Send FREE Valentine eCards with Yahoo! Greetings!
http://greetings.yahoo.com




More information about the Snort-users mailing list