[Snort-users] BPF filters for the intimidated
jberry at ...11848...
Fri Jul 23 12:01:04 EDT 2004
If you only want to capture UDP ports destined to a specific host on
port 53 here is an example (where host = 22.214.171.124):
(udp && dst host 126.96.36.199 && port 53)
So you could do this with Tcpdump:
/usr/sbin/tcpdump -vvvxXi <ethX> 'udp && dst host 188.8.131.52 && port 53'
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Paul
Sent: Friday, July 23, 2004 1:16 PM
To: Snort-User Mailing List
Subject: [Snort-users] BPF filters for the intimidated
Does anyone know a good source for a tutorial on BFP filters? Reading
man page has me crossing my eyes and growning.
I want to capture udp packets on port 53 to one host, including the
payload. I've figured out the hex address for the host, but the rest
Paul Schmehl (pauls at ...6838...)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
More information about the Snort-users