[Snort-users] BASE sensor name

Lay, James james.lay at ...15009...
Mon Aug 1 11:04:04 EDT 2011

Heh...me either Joel...first time.  I'll give that filter file a shot
though...sounds like just what I need.  Thank you.  Here's a
snap...really wild.






From: Joel Esler [mailto:jesler at ...1935...] 
Sent: Monday, August 01, 2011 8:47 AM
To: Lay, James
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] BASE sensor name


Huh.  Never heard that one before James.


How are you logging?  (output method)


You might want to try loading the bpf in a file and then calling the
file through -F




On Aug 1, 2011, at 10:42 AM, Lay, James wrote:

Hey all!


Real quick...seems like when I start snort with a tcpdump style filter
(snort -c snort.conf "ip and not host blah blah blah") my sensor name
shows up as the sensorname:interface:tcpdumpfilter.  Anyone else seen
anything like this?  It's not a complete pain...just looks kinda dumb ;)
Didn't see any fixes after googling, so I thought I'd ask here.  Thanks
all..have a great week J



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20110801/3e30d5b8/attachment.html>

More information about the Snort-users mailing list