[Snort-users] packet traces to test snort

Erek Adams erek at ...950...
Fri May 2 07:06:42 EDT 2003


On Fri, 2 May 2003, Budi Rahardjo wrote:

> Is there an archive of (tcpdump) packet traces that I can replay
> to test against our snort configuration?
> I tried idswakeup, but not satisfied with it.
>
> I was looking at Internet traffic archive web site, but couldn't
> find what I am looking for.

Grab the the Capture the Flag traces from Defcon8/9 [0], and then use
tcpreplay [1] to replay them.

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


[0]	http://mediawhore.wi2600.org/mirrors/shmoo/
[1]	http://tcpreplay.sourceforge.net/





More information about the Snort-users mailing list