[Snort-users] New IDS tool, looking for beta testers
jprad at ...16763...
Tue Apr 1 09:33:55 EDT 2014
-----BEGIN PGP SIGNED MESSAGE-----
I've just published the first beta release of a plugin (dissector) that
gives you the ability to view Snort/Suricata alerts from within
Wireshark. A companion set of tools provide you with the ability to
create multiple "configuration instances" so that you can quickly switch
from one to another within Wireshark for comparing differences between
them for the same pcap file.
An overview of the tools and demo of the plugin can be viewed at:
Everything is currently limited to Linux, but I am working on a
Windows version of Wireshark with the plugin, no timeframe on when it
will be ready for testing though.
The packages for this were developed and tested with Centrych, but
should work with other Ubuntu 12.04 compatible systems as well.
Additional details on the Centrych version of Wireshark are listed at:
A walk-through on installing and setting up snort and suricata
instances is available at: http://www.centrych.org/idsutil
An Ubuntu 12.04 compatible PPA with all the required packages are
available from: https://launchpad.net/~centrych/+archive/security
Centrych can be downloaded from: http://www.centrych.org/downloads
If you're using another distribution, you can obtain the python source
as well as patch files for Wireshark and Barnyard from:
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-----END PGP SIGNATURE-----
More information about the Snort-users