[Snort-users] Snort handling multiple Pcap files

Al Lewis (allewi) allewi at ...589...
Fri Jan 6 13:56:32 EST 2017


Run snort -h

   --pcap-single <tf>              Same as -r.
   --pcap-file <file>              file that contains a list of pcaps to read - read mode is implied.
   --pcap-list "<list>"            a space separated list of pcaps to read - read mode is implied.
   --pcap-dir <dir>                a directory to recurse to look for pcaps - read mode is implied.


Albert Lewis
ENGINEER.SOFTWARE ENGINEERING
SOURCEfire, Inc. now part of Cisco
Email: allewi at ...589...<mailto:allewi at ...589...>

From: "Asad, Hafiz ul" <Hafiz-ul.Asad at ...17478...<mailto:Hafiz-ul.Asad at ...17478...>>
Date: Friday, January 6, 2017 at 12:53 PM
To: 'snort-users' <snort-users at lists.sourceforge.net<mailto:snort-users at lists.sourceforge.net>>
Subject: [Snort-users] Snort handling multiple Pcap files

Snort Users,

Is it possible that snort could analyse multiple ‘pcap’ files. To be more specific, is it possible to have ,

Snort  -r file1.pcap file2.pcap….filen.pcap

Regards
Asad
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20170106/41e7eda6/attachment.html>


More information about the Snort-users mailing list