[Snort-users] simultaneous snort and tcpdump

Jason security at ...5028...
Sun Sep 22 10:12:02 EDT 2002


create a rule that matches the other interesting traffic.

look at the docs for creating rules on snort.org

Carl Gibbons wrote:

>Thanks, Bennett and Gary.
>
>I was needlessly complicating matters.  Perhaps I still am: one
>reason I want simultaneous snort/tcpdump is that "snort -b" only
>seems to record packets on which it finds a rule match, and I want
>to record other traffic as well.  Perhaps there's an elegant,
>efficient way to do so with a single snort process?  - Carl
>
>Bennett Todd wrote:
>  
>
>>>As far as I know, you can just run your snort and your tcpdump at
>>>the same time...
>>>      
>>>
>
>Gary Flynn wrote:
>  
>
>>My experiences are the same as Bennett's. I've got ntop and
>>snort running on the same interface and they seem to be
>>sharing it fine.
>>
>>When I first contemplated doing this, I did some superficial
>>research that suggested to me that this wouldn't be a problem.
>>After diving through pcap code and then into the kernel
>>network handling code, I came to the conclusion that all
>>pcap applications have a PF_SOCKET open whose packet_rcv()
>>functions are sequentially called by the kernel.
>>
>>This seems to be very nicely documented in the following two
>>articles:
>>
>>http://www.linuxjournal.com/article.php?sid=4852
>>and
>>http://www.linuxjournal.com/article.php?sid=5617
>>    
>>
>
>
>
>-------------------------------------------------------
>This sf.net email is sponsored by:ThinkGeek
>Welcome to geek heaven.
>http://thinkgeek.com/sf
>_______________________________________________
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/listinfo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>  
>





More information about the Snort-users mailing list