From: Jason Haar (Jason.Haartrimble.co.nz)
Date: Tue Sep 04 2007 - 12:34:07 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Paul Melson wrote:
> It appears to work for me on Fedora 7:
>
> # ngrep vlan 1
> interface: eth0 (10.0.0.0/255.255.255.0)
> filter: (ip or ip6) and ( vlan 1 )
> exit
> 0 received, 0 dropped
>
>
Try that with tcpdump and you'll see the problem (looks like ngrep
doesn't have the same error checking tcpdump does). It plain cannot work
if it starts with that "(ip)" or "(ip or ip6)" at the beginning.

I have logged a bug in ngrep.sf.net so hopefully it will be fixed at
some stage.

--
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]