Re: Troubles With Multiple Sensors

[Erek Adams <erek () snort org>]

On Fri, 24 Oct 2003, Shawn Truax wrote:

> I would suggest trying tcpdump instead of snort to do your testing.
> Running tcpdump as follows:
>
> tcpdump -n -X -i eth1
>
> Should dump all packets received on that uplink port and display their
> payloads (Drop the -X if you don't want payload).  This should give you
> everything ARP, broadcast and anything destined to the port without the
> complications that snort may give.  As an aside I find tcpdump to be the
> best tool for testing/diagnosing an interface before running snort to
> make sure everything is working properly.

Actually, that's a bit misleading.

Snort and TCPDump both use the libpcap library to snarf packets off of the
wire.  If Snort can see the packets, then TCPDump can and vice-versa.
There is no difference in functionality of pulling the packets off of the
wire.

If there was, do you think that the SHADOW IDS would have been re-written
to use Snort instead of TCPDump?  :)  Snort doens't have as many decoders
as TCPDump or Ethereal, but it can still see the packets.

        snort -dv -i eth1

Usually gets you a nice breakdown in a much more readable format that
TCPDump.  :)

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


-------------------------------------------------------
This SF.net email is sponsored by: The SF.net Donation Program.
Do you like what SourceForge.net is doing for the Open
Source Community?  Make a contribution, and help us add new
features and functionality. Click here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users