[Snort-users] packet traces to test snort

Erek Adams erek at ...950...
Fri May 2 07:06:42 EDT 2003

On Fri, 2 May 2003, Budi Rahardjo wrote:

> Is there an archive of (tcpdump) packet traces that I can replay
> to test against our snort configuration?
> I tried idswakeup, but not satisfied with it.
> I was looking at Internet traffic archive web site, but couldn't
> find what I am looking for.

Grab the the Capture the Flag traces from Defcon8/9 [0], and then use
tcpreplay [1] to replay them.


Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson

[0]	http://mediawhore.wi2600.org/mirrors/shmoo/
[1]	http://tcpreplay.sourceforge.net/

More information about the Snort-users mailing list