[Snort-users] take a .pcap file and convert to .csv file

Neil

2005-03-06 23:09:10 UTC

This is a multi-part message in MIME format.

------=_NextPart_000_0000_01C52277.AC14E3F0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

snort users list:

I am new to snort.

I am running snort on a windows XP box (sorry my *nix boxes are currently
offline).

How do I simultaneously read a tcpdump file and output this same file to csv
(for Excel use)?

I can read the tcpdump file

F:\snort\bin>snort -r file.pcap

and I have added the following to snort.conf

output alert_CSV: F:\Snort\log\alert.csv
timestamp,msg,proto,src,srcport,dst,dstport

However, How do I combine both actions at once?

When I run F:\snort\bin>snort -r file.pcap a csv file never materializes.

I've read through several email archives, and did not quite see this issue,
and tried a few things from answers to other questions with no luck.

Thanks

-neil

------=_NextPart_000_0000_01C52277.AC14E3F0
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered medium)">
<style>

</style>

</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple>

<div class=3DSection1>

snort users =
list:<o:p></o:p>

<o:p> </o:p></fo=
nt>

I am new to =
snort.<o:p></o:p>

I am running snort on a =
windows XP
box (sorry my *nix boxes are currently =
offline).<o:p></o:p>

How do I simultaneously =
read a
tcpdump file and output this same file to csv (for Excel =
use)?<o:p></o:p>

<o:p> </o:p></fo=
nt>

I can read the tcpdump =
file<o:p></o:p>

F:\snort\bin>snort =
-r  file.pcap <o:p></o:p>

<o:p> </o:p></fo=
nt>

and I have added the =
following to
snort.conf<o:p></o:p>

output alert_CSV:
F:\Snort\log\alert.csv =
timestamp,msg,proto,src,srcport,dst,dstport<o:p></o:p>

<o:p> </o:p></fo=
nt>

<o:p> </o:p></fo=
nt>

However, How do I combine =
both
actions at once?<o:p></o:p>

<o:p> </o:p></fo=
nt>

When I run =
F:\snort\bin>snort -r 
file.pcap  a csv file never =
materializes.<o:p></o:p>

<o:p> </o:p></fo=
nt>

I've read through several =
email
archives, and did not quite see this issue, and tried a few things from =
answers
to other questions with no luck.<o:p></o:p>

Thanks<o:p></o:p></fo=
nt>

-neil<o:p></o:p>

</div>

</body>

</html>

------=_NextPart_000_0000_01C52277.AC14E3F0--

-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-***@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users