[Snort-users] BASE sensor name
james.lay at ...15009...
Mon Aug 1 11:04:04 EDT 2011
Heh...me either Joel...first time. I'll give that filter file a shot
though...sounds like just what I need. Thank you. Here's a
From: Joel Esler [mailto:jesler at ...1935...]
Sent: Monday, August 01, 2011 8:47 AM
To: Lay, James
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] BASE sensor name
Huh. Never heard that one before James.
How are you logging? (output method)
You might want to try loading the bpf in a file and then calling the
file through -F
On Aug 1, 2011, at 10:42 AM, Lay, James wrote:
Real quick...seems like when I start snort with a tcpdump style filter
(snort -c snort.conf "ip and not host blah blah blah") my sensor name
shows up as the sensorname:interface:tcpdumpfilter. Anyone else seen
anything like this? It's not a complete pain...just looks kinda dumb ;)
Didn't see any fixes after googling, so I thought I'd ask here. Thanks
all..have a great week J
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users