[Snort-users] Promiscuous monitoring

Francis Yom fyom at ...2367...
Tue Jul 2 14:46:16 EDT 2002


> 
> Try this test:  Run snort and tcpdump at the same time.  You _should_ see the
> same packets.  If not, it might be the version of pcap each is linked against.
> 

Bingo!  They are NOT! I used the PCAP from the CVS about a month ago. 
What libPCAP should I be using?

Thanks!
F






More information about the Snort-users mailing list