[Snort-users] Tell snort to resolve ip or use /etc/hosts?

Matt Kettler mkettler at ...4108...
Wed Jan 14 12:27:02 EST 2004


At 02:29 PM 1/14/2004, James Nonya wrote:
>Since I'm blithering on in here I might as well get
>all my questions out now ;)  Any way to get snort to
>resolve ip addresses?  Looked around and googled but
>didn't find much on it.  Thanks!

It'd be too slow for snort to do it when logging things... you'd wind up 
dropping packets while snort was waiting for DNS queries, etc.

If you really need things looked up, do it in a back-end script..





More information about the Snort-users mailing list