[Snort-users] Traffic Capture

Al Lewis (allewi) allewi at cisco.com
Fri Dec 8 05:43:47 EST 2017


Hello,

Are you sure snort isnt seeing the ARP traffic? Have you checked your exist stats? See mine for arp below


===============================================================================
Breakdown by protocol (includes rebuilt packets):
        Eth:           42 (100.000%)
       VLAN:            0 (  0.000%)
        IP4:           18 ( 42.857%)
       Frag:            0 (  0.000%)
       ICMP:            0 (  0.000%)
        UDP:            0 (  0.000%)
        TCP:           18 ( 42.857%)
        IP6:            0 (  0.000%)
    IP6 Ext:            0 (  0.000%)
   IP6 Opts:            0 (  0.000%)
      Frag6:            0 (  0.000%)
      ICMP6:            0 (  0.000%)
       UDP6:            0 (  0.000%)
       TCP6:            0 (  0.000%)
     Teredo:            0 (  0.000%)
    ICMP-IP:            0 (  0.000%)
    IP4/IP4:            0 (  0.000%)
    IP4/IP6:            0 (  0.000%)
    IP6/IP4:            0 (  0.000%)
    IP6/IP6:            0 (  0.000%)
        GRE:            0 (  0.000%)
    GRE Eth:            0 (  0.000%)
   GRE VLAN:            0 (  0.000%)
    GRE IP4:            0 (  0.000%)
    GRE IP6:            0 (  0.000%)
GRE IP6 Ext:            0 (  0.000%)
   GRE PPTP:            0 (  0.000%)
    GRE ARP:            0 (  0.000%)
    GRE IPX:            0 (  0.000%)
   GRE Loop:            0 (  0.000%)
       MPLS:            0 (  0.000%)
        ARP:           24 ( 57.143%)


If the traffic is mirrored/copied to snort or if snort is inline it should see the ARP traffic.


Albert Lewis
ENGINEER.SOFTWARE ENGINEERING
SOURCEfire, Inc. now part of Cisco
Email: allewi at cisco.com<mailto:allewi at cisco.com>

From: Snort-users <snort-users-bounces at lists.snort.org<mailto:snort-users-bounces at lists.snort.org>> on behalf of Syed Hammad Tahir <mscs16059 at itu.edu.pk<mailto:mscs16059 at itu.edu.pk>>
Date: Friday, December 8, 2017 at 5:22 AM
To: waldo kitty <wkitty42 at windstream.net<mailto:wkitty42 at windstream.net>>
Cc: "snort-users at lists.snort.org<mailto:snort-users at lists.snort.org>" <snort-users at lists.snort.org<mailto:snort-users at lists.snort.org>>
Subject: Re: [Snort-users] Traffic Capture

I specifically want to do it with snort since I am using it as a sensor with apache metron.

On Fri, Dec 8, 2017 at 2:45 PM, <wkitty42 at windstream.net<mailto:wkitty42 at windstream.net>> wrote:
On 12/08/2017 04:20 AM, Syed Hammad Tahir wrote:
I am specifically interested in capturing the ARP request data. Any help
will be appreciated.

if all you are wanting to do is capture traffic, why not use tcpdump or wireshark? that's what they do... something like this should do...

  tcpdump -i eth0 -s0 -w arp_traffic.pcap 'arp or icmp'

check the tcpdump docs to understand the options given...

--
 NOTE: No off-list assistance is given without prior approval.
       *Please keep mailing list traffic on the list unless*
       *a signed and pre-paid contract is in effect with us.*
_______________________________________________
Snort-users mailing list
Snort-users at lists.snort.org<mailto:Snort-users at lists.snort.org>
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!


Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20171208/a155623f/attachment-0001.html>


More information about the Snort-users mailing list