Does snortsnarf work?
"Schmehl, Paul L" <[email protected]> Thu, 13 Feb 2003 07:26:48 -0600
| Newsgroups | gmane.comp.security.ids.snort.snarf |
|---|---|
| Message-ID | <871080DEC5874D41B4E3AFC5C400611ECFCED5@UTDEVS02.campus.ad.utdallas.edu> |
I've been running snortsnarf with this command: /usr/local/bin/snortsnarf -d /usr/local/www/snortsnarf/ -homenet x.x.x.x/16 -maxtime=3Dyesterday snort:xxxxxx@snort@localhost (IP and password obfuscated) But it has never worked. I've let it run as long as 2 hours, and it never writes anything to the hard drive. Last night I ran it through cron, figuring I'd just let it run until it finished. It ran, and there are no errors in /var/log/cron or messages, but there's no data in the web directory either. What the heck am I doing wrong? Paul Schmehl ([email protected]) Adjunct Information Security Officer The University of Texas at Dallas http://www.utdallas.edu/~pauls/ AVIEN Founding Member=20