Re: Capturing incoming packets?

[Erek Adams <erek () snort org>]

On Fri, 13 Jun 2003 guano () hackerfactor com wrote:

[...snip...]

> I really want to capture "everything that is initiated from the
> outside world".  Including UDP, TCP, and ICMP (ARP isn't important to me).
> Basically, I want to capture everything that is not part of a session
> initiated by me.
>   - Keeping track of TCP sessions is feasible.
>   - Keeping track of UDP and ICMP sessions (since they are stateless) is
>     a little more difficult.  I'm thinking it would keep track of host/port
>     in a finite timeframe.
>
> Is this possible already?

Yep.

        snort -l <logdir> -b 'not net <local_lan>'

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


-------------------------------------------------------
This SF.NET email is sponsored by: eBay
Great deals on office technology -- on eBay now! Click here:
http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users