analyse tcpdump output
ww at styx.org
Wed Nov 22 19:50:32 UTC 2006
Do people still use snort for this? snort -r filename, IIRC
Le mercredi 22 novembre 2006 à 16:34 +0100, Stefan Hegger a écrit :
> I wonder if someone knows a tool to use a tcpdump output for anomaly
> dedection. It is sometimes really time consuming when looking for identical
> patterns in the tcpdump output.
> It would be helpful to get a diff between SYN and ACK's e.g. Or look for a
> pattern in a URL. Or just get some timediffs e.g. when an ACK is send but
> client is waiting for data etc.
> We would like to decrease time to investigate the cause for an unusual network
> Best Stefan
More information about the NANOG