[Snort-users] BASE sensor name

Lay, James james.lay at ...15009...
Mon Aug 1 11:04:04 EDT 2011


Heh...me either Joel...first time.  I'll give that filter file a shot
though...sounds like just what I need.  Thank you.  Here's a
snap...really wild.

 

http://i290.photobucket.com/albums/ll269/DigiDemon/MWSnap035.jpg

 

James

 

From: Joel Esler [mailto:jesler at ...1935...] 
Sent: Monday, August 01, 2011 8:47 AM
To: Lay, James
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] BASE sensor name

 

Huh.  Never heard that one before James.

 

How are you logging?  (output method)

 

You might want to try loading the bpf in a file and then calling the
file through -F

 

Joel

 

On Aug 1, 2011, at 10:42 AM, Lay, James wrote:





Hey all!

 

Real quick...seems like when I start snort with a tcpdump style filter
(snort -c snort.conf "ip and not host blah blah blah") my sensor name
shows up as the sensorname:interface:tcpdumpfilter.  Anyone else seen
anything like this?  It's not a complete pain...just looks kinda dumb ;)
Didn't see any fixes after googling, so I thought I'd ask here.  Thanks
all..have a great week J

 

James

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20110801/3e30d5b8/attachment.html>


More information about the Snort-users mailing list