Snort mailing list archives
Does snort "sniff" differently than tcpdump?
From: Jason Haar <Jason.Haar () trimble co nz>
Date: Mon, 10 Mar 2003 14:50:21 +1300
I've got a weird one. I have a few hosts hanging off a 10/100 hub (not switch). Most are configured to be 10Mb, but one is 100M (the sniffer host is 10 BTW). If I sniff with tcpdump, I can see all the traffic to/from *all* the hosts - not just the 10M ones. However, snort doesn't trigger on rules for the sole 100Mb host that it does trigger on for the 10M hosts. Any ideas? e.g. could this be a libpcap issue? (i.e. tcpdump doesn't appear to use libpcap, whereas snort does) RH 7.1 + snort-1.9.1/libpcap-0.6.2-11.7.1.0 -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 ------------------------------------------------------- This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger for complex code. Debugging C/C++ programs can leave you feeling lost and disoriented. TotalView can help you find your way. Available on major UNIX and Linux platforms. Try it free. www.etnus.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Does snort "sniff" differently than tcpdump? Jason Haar (Mar 09)