Recommendations for packet capture

[Dennis Glatting]

On Sat, 2014-02-15 at 18:44 -0500, George Neville-Neil wrote:
> On Feb 14, 2014, at 2:21 , C. L. Martinez <carlopmart at gmail.com> wrote:
> 
> > On Thu, Feb 13, 2014 at 3:14 PM, Dennis Glatting <dg at pki2.com> wrote:
> >> On Thu, 2014-02-13 at 09:14 +0000, C. L. Martinez wrote:
> >>> Hi all,
> >>> 
> >>> I need to setup some FreeBSD (or Linux, it depends) hosts to use as a
> >>> packet capture sensors for our infrastrucutre.
> >>> 
> >>> Searching about software that I could use under FreeBSD, I only find
> >>> these ones:
> >>> 
> >>> a) daemonlogger
> >>> b) streamdb
> >>> 
> >>> For Linux, it seems exits more alternatives. Any suggestions??
> >>> 
> >>> I need to monitor 1 GiB networks.
> >>> 
> >> 
> >> I've not (yet) used these:
> >> 
> >> /usr/ports/security/sguil-client
> >> /usr/ports/security/sguil-sensor
> >> /usr/ports/security/sguil-server
> >> 
> >> 
> >>> Thanks.
> > 
> > Thanks Dennis, but Sguil is not a packet capture componente. Sguil
> > needs daemonlogger to show you captured data.
> 
> I might be a bit confused.  Can you just use tcpdump with the appropriate flags
> to limit the size and number of files?
> 
> What are you trying to achieve?
> 

Well, I was trying to achive an evaluation of SGuil under FreeBSD but
after a couple hours of trying to get the peices to play I surrendered
to another day. I assumed the goal here was IPS.


-- 
Dennis Glatting <dg at pki2.com>