[Snort-users] simultaneous snort and tcpdump
cgibbons at ...6953...
Fri Sep 20 09:00:02 EDT 2002
I wish to run tcpdump (with a certain bpf filter $MYFILTER) and
snort (in NID mode) simultaneously on the same live network traffic.
The following appears to work, but I don't know how robust or
dependable this method is. On one terminal:
# mkfifo sniff
# snort -b -c /etc/snort/snort.conf -r sniff
Then on another terminal:
# tcpdump -i eth0 -w - | tee sniff | tcpdump -r - $MYFILTER
Comments? Is there a better way? - Carl
More information about the Snort-users