Hi,all.How to store all packet directly to the hard disk using bro-1.5 ?
Hello,
I'm not sure of what do you want exactly but i assume you're talking about
network packets ?
If so, you've to run something likes "tcpdump -w ..." instead of "bro".
Cheers,
Jean-Philippe.
* lzqsist <lzqsist@163.com> [2010-04-30 17:45:06 +0800]:
Can I use tcpdump saving network packet directlu to hard disk,just like DMA?
Hello,
Yes, just have to use 'tcpdump -w <filename> <some filter>'
exemple : tcpdump -i eth0 -w /tmp/tcpdump.cap port 80
Cheers,
Jean-Philippe.
* lzqsist@163.com <lzqsist@163.com> [2010-04-30 20:22:34 +0800]:
Yes, just have to use 'tcpdump -w <filename> <some filter>'
exemple : tcpdump -i eth0 -w /tmp/tcpdump.cap port 80
With the tweak of adding "-s 0" to capture full packets rather than only
(roughly) packet headers. This is necessary if you want to later run Bro
on the trace.
Vern