simultaneous snort and tcpdump

[Carl Gibbons <cgibbons () du edu>]

I wish to run tcpdump (with a certain bpf filter $MYFILTER) and
snort (in NID mode) simultaneously on the same live network traffic.
The following appears to work, but I don't know how robust or
dependable this method is.  On one terminal:

    # mkfifo sniff
    # snort -b -c /etc/snort/snort.conf -r sniff

Then on another terminal:

    # tcpdump -i eth0 -w - | tee sniff | tcpdump -r - $MYFILTER

Comments?  Is there a better way?   - Carl



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users