[ARGUS] Argus taking libpcap files from stdin

Russell Fulton r.fulton at auckland.ac.nz
Wed Sep 1 17:09:17 EDT 2004


On Thu, 2004-09-02 at 01:37, Andrew Pollock wrote:
> On Wed, Sep 01, 2004 at 04:51:27PM +1200, Russell Fulton wrote:
> > I responded off list pointing out that ra reads .gz files and that I was
> > not sure if argus did too.  Bill has come back with more info so I'm
> > sending this reply to the list.
> > 
> 
> I think from memory, argus won't read compressed tcpdump files. I recall
> lamenting that fact when I had bogloads of compressed tcpdump files to
> conver to argus log files.


In that case I think it is time I contributed another patch to the
project ;)  I patched ra and friends long ago to read compressed files.

-- 
Russell Fulton, Information Security Officer, The University of Auckland
New Zealand




More information about the argus mailing list