Re: BASE sensor name

["Lay, James" <james.lay () wincofoods com>]

Heh...me either Joel...first time.  I'll give that filter file a shot
though...sounds like just what I need.  Thank you.  Here's a
snap...really wild.

 

http://i290.photobucket.com/albums/ll269/DigiDemon/MWSnap035.jpg

 

James

 

From: Joel Esler [mailto:jesler () sourcefire com] 
Sent: Monday, August 01, 2011 8:47 AM
To: Lay, James
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] BASE sensor name

 

Huh.  Never heard that one before James.

 

How are you logging?  (output method)

 

You might want to try loading the bpf in a file and then calling the
file through -F

 

Joel

 

On Aug 1, 2011, at 10:42 AM, Lay, James wrote:





Hey all!

 

Real quick...seems like when I start snort with a tcpdump style filter
(snort -c snort.conf "ip and not host blah blah blah") my sensor name
shows up as the sensorname:interface:tcpdumpfilter.  Anyone else seen
anything like this?  It's not a complete pain...just looks kinda dumb ;)
Didn't see any fixes after googling, so I thought I'd ask here.  Thanks
all..have a great week J

 

James

------------------------------------------------------------------------------
Got Input?   Slashdot Needs You.
Take our quick survey online.  Come on, we don't ask for help often.
Plus, you'll get a chance to win $100 to spend on ThinkGeek.
http://p.sf.net/sfu/slashdot-survey

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please see http://www.snort.org/docs for documentation