Intrusion Detection Systems: Re: DEFCON packet collection?

[Martin Roesch <roesch () hiverworld com>]

Archive: http://msgs.securepoint.com/ids
FAQ: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
HELP: Having problems... email questions to ids-owner () uow edu au
NOTE: Remove this section from reply msgs otherwise the msg will bounce.
SPAM: DO NOT send unsolicted mail to this list.
UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
-----------------------------------------------------------------------------
I could easily (with Snort), but I don't know if my little laptop hard drive
will be up to it (it's not exactly brimming with space these days).  The
*real* problem is that if I did this, I'd have to hang around the CTF network
all day so that my laptop doesn't walk away....

Hey Ron, are you going to be running Dragon?  You could probably do so better
than I if you're planning on hanging out there full time...

   -Marty

"Marcus J. Ranum" wrote:
> Archive: http://msgs.securepoint.com/ids
> FAQ: http://www.ticm.com/kb/faq/idsfaq.html
> IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
> HELP: Having problems... email questions to ids-owner () uow edu au
> NOTE: Remove this section from reply msgs otherwise the msg will bounce.
> SPAM: DO NOT send unsolicted mail to this list.
> UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
> -----------------------------------------------------------------------------
> Is anyone going to DEFCON to collect packets this year?
>
> mjr.
> -----
> Marcus J. Ranum
> Chief Technology Officer, Network Flight Recorder, Inc.
> Work:                  http://www.nfr.net
> Personal:              http://pubweb.nfr.net/~mjr
-- 
Martin Roesch                      <roesch () hiverworld com>
Core R&D                         http://www.hiverworld.com
Hiverworld, Inc.       Continuous Adaptive Risk Management