[Snort-users] simultaneous snort and tcpdump

Carl Gibbons cgibbons at ...6953...
Fri Sep 20 09:00:02 EDT 2002


I wish to run tcpdump (with a certain bpf filter $MYFILTER) and
snort (in NID mode) simultaneously on the same live network traffic.
The following appears to work, but I don't know how robust or
dependable this method is.  On one terminal:

    # mkfifo sniff
    # snort -b -c /etc/snort/snort.conf -r sniff

Then on another terminal:

    # tcpdump -i eth0 -w - | tee sniff | tcpdump -r - $MYFILTER

Comments?  Is there a better way?   - Carl





More information about the Snort-users mailing list