Re: playback question

[Aaron <lilnick () nepenthes org>]

Greg,
        I think the following will work for you:

snort -vr dumpfile src or dst net 134.117.88.0/20 and proto tcp

This will show all traffic to and from (query and response) your 
134.117.88.0/20 network. If you only want to see source or destination, 
then only use one of the 'src' or 'dst' keywords. 

Thanks,
Aaron

On 9 Nov 2001, Greg Sarsons wrote:

;Okay I haven't got the what I want working yet 
;
;I'm trying to play back a file
;
;./snort -vr dumpfile tcp 
;
;that is tcp 
;
;but I also want to only have traffic with from
;
;outside 134.117.88.0/20 (not from this)
;
;going to 134.117.88.0/20
;
;I couldn't make src and dst work.
;
;FYI The txt output then is piped into another program.
;
;Greg
;
;
;
;
;_______________________________________________
;Snort-users mailing list
;Snort-users () lists sourceforge net
;Go to this URL to change user options or unsubscribe:
;https://lists.sourceforge.net/lists/listinfo/snort-users
;Snort-users list archive:
;http://www.geocrawler.com/redir-sf.php3?list=snort-users
;


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users