Re: [Snort-sigs] Issue

From: Matt Kettler <mkettler(at)evi-inc.com>
Date: Fri May 16 2003 - 14:40:36 EDT

1. you'll probably be better off following up on the snort-users list instead of here.. it's the correct list, and it's got more users on it. snort-sigs is the people that do packet dump analysis and rule development, so there's a lot fewer users here.. particularly a LOT fewer snort-for-windows users.
2. what version of snort are you using?
3. You need a -i in front of interface names for snort on the command line, and You want to remove the part in ()'s. (I know windump fails if you include the expanded name)

So your command line really should look more like this: snort -v -i \Device\NPF_{37B8DFB9-9F3C-4585-BF8C-F65A3422564B}

At 12:19 PM 5/16/2003 +0100, Colin.Slevin@transwareplc.com wrote:
>Hi all ,

---

Enterprise Linux Forum Conference & Expo, June 4-6, 2003, Santa Clara The only event dedicated to issues related to Linux enterprise solutions www.enterpriselinuxforum.com

---

Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs Received on Fri May 16 15:16:57 2003