[ARGUS] Argus taking libpcap files from stdin
r.fulton at auckland.ac.nz
Wed Sep 1 17:09:17 EDT 2004
On Thu, 2004-09-02 at 01:37, Andrew Pollock wrote:
> On Wed, Sep 01, 2004 at 04:51:27PM +1200, Russell Fulton wrote:
> > I responded off list pointing out that ra reads .gz files and that I was
> > not sure if argus did too. Bill has come back with more info so I'm
> > sending this reply to the list.
> I think from memory, argus won't read compressed tcpdump files. I recall
> lamenting that fact when I had bogloads of compressed tcpdump files to
> conver to argus log files.
In that case I think it is time I contributed another patch to the
project ;) I patched ra and friends long ago to read compressed files.
Russell Fulton, Information Security Officer, The University of Auckland
More information about the argus