Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Re: [Snort-users] Why Snort doubles packet number? |
|---|---|
| Date: | Thu, 11 May 2006 15:19:17 -0400 |
This was answered on the list a few days back. Here's a link:
http://groups.google.com/group/mailing.unix.snort/browse_frm/thread/80d7d2c50f9a916/05d8fd296bd6bb30?lnk=st&q=snort+tcpdump+twice+justin+OR+jheath&rnum=2#05d8fd296bd6bb30
Hi Snorters, I am replaying with Tcpreplay a file that has 1644419 packets by eth1.This interface is directly connected to eth1 in another computer where is running snort. When I press CTRL+C when the replay has finished, on statistic appear:
Snort received 3288840 packets (this number is just the double of 1644419) Analyzed: 3288840(100.000%) Dropped: 0(0.000%)
Why occurs this thing? Thanks a lot! Santi
------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmdlnk&kid0709&bid&3057&dat1642 _______________________________________________ Snort-users mailing list Snort-users@lists.sourceforge.net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?listsnort-users
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re: [Snort-users] Compiling snort for CheckPoint Firewall-1 support, Frank Knobbe |
|---|---|
| Next by Date: | [Snort-users] False positive alerts - rules fire on unmatching payload, Humes, David G. |
| Previous by Thread: | [Snort-users] Why Snort doubles packet number?, Santi Benito |
| Next by Thread: | [Snort-users] Compiling snort for CheckPoint Firewall-1 support, carlopmart |
| Indexes: | [Date] [Thread] [Top] [All Lists] |