[Snort-users] snort and tcpdump
skopganu at ...131...
Thu Feb 7 23:04:02 EST 2002
got this matter to solve;
anyone got a paper/reference on tcpdump and snort - a
reference need it pretty badly.
as in my opinion, tcpdump by default only capture 60
bytes of data (no payload) and we need to do the
filter based on abnormal packet behaviour - more or
less like shadow ids.
where as snort has all the feature with rules , stream
assembly and etc.
therefore it's better to run snort than capture
tcpdump and load it back to snort ..right ?
need ur feedback
Do You Yahoo!?
Send FREE Valentine eCards with Yahoo! Greetings!
More information about the Snort-users