[Snort-users] Promiscuous monitoring

Francis Yom fyom at ...2367...
Tue Jul 2 14:46:16 EDT 2002

> Try this test:  Run snort and tcpdump at the same time.  You _should_ see the
> same packets.  If not, it might be the version of pcap each is linked against.

Bingo!  They are NOT! I used the PCAP from the CVS about a month ago. 
What libPCAP should I be using?


More information about the Snort-users mailing list