snort-users May 2009 archive
Main Archive Page > Month Archives  > snort-users archives
snort-users: Re: [Snort-users] whether wireshark can be integrat

Re: [Snort-users] whether wireshark can be integrated with snort??

From: Nigel Houghton <nhoughton_at_nospam>
Date: Sun May 24 2009 - 14:46:37 GMT
To: Snort Users List <snort-users@lists.sourceforge.net>


On Sat, May 23, 2009 at 4:04 PM, Stephen Mullins <steve.mullins.work@gmail.com> wrote:
> I would suggest you use Sguil with Snort and you can launch wireshark
> from Sguil if needed.
>
> Or you could use an inline network TAP on the cable running from the
> SPAN port to the Wireshark box to "split" the signal so it goes to
> both the Snort sensor and the Wireshark box.
>
> Steve Mullins
>
> On Tue, May 19, 2009 at 12:01 PM, Sadanand Ghagare <sadanandgh@gmail.com> wrote:
>> Hi
>>
>> We are in process to implement snort as network sensor in our network. But
>> problem here is, we already have wireshark machine connected to monitoring
>> port of switch and we don't want to disturb existing setup.
>> So whether it is possible to integrate snort with wireshark so that snort
>> can analyze the packets captured by wireshark as per snort rule base.
>> If yes, how to configure it.
>> I hope I am up to the point for my requirements.

Ignoring all the drawbacks of using a windows box for this, I have to know exactly what the wireshark instance is doing? Is someone really looking at the data? Is wireshark being used to dump out all traffic so that someone can go back and look at it later? Is someone watching it real time? -- Nigel Houghton Head Mentalist SF VRT http://vrt-sourcefire.blogspot.com && http://www.snort.org/vrt/ ------------------------------------------------------------------------------ Register Now for Creativity and Technology (CaT), June 3rd, NYC. CaT is a gathering of tech-side developers & brand creativity professionals. Meet the minds behind Google Creative Lab, Visual Complexity, Processing, & iPhoneDevCamp asthey present alongside digital heavyweights like Barbarian Group, R/GA, & Big Spaceship. http://www.creativitycat.com _______________________________________________ Snort-users mailing list Snort-users@lists.sourceforge.net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users