From owner-freebsd-net@FreeBSD.ORG  Sun Feb 16 00:06:40 2014
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 427731FD
 for <freebsd-net@freebsd.org>; Sun, 16 Feb 2014 00:06:40 +0000 (UTC)
Received: from btw.pki2.com (btw.pki2.com [IPv6:2001:470:a:6fd::2])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id D8D631683
 for <freebsd-net@freebsd.org>; Sun, 16 Feb 2014 00:06:39 +0000 (UTC)
Received: from [127.0.0.1] (localhost [127.0.0.1])
 by btw.pki2.com (8.14.8/8.14.8) with ESMTP id s1G06RSX037030;
 Sat, 15 Feb 2014 16:06:27 -0800 (PST) (envelope-from dg@pki2.com)
Subject: Re: Recommendations for packet capture
From: Dennis Glatting <dg@pki2.com>
To: George Neville-Neil <gnn@neville-neil.com>
In-Reply-To: <3D9E8EFA-1EB0-4CA6-B26E-CA87553150E3@neville-neil.com>
References: <CAEjQA5L=hCo56SLMgK-wKH-CzOpDN2vHYwP_ySd1QEK5HccM6Q@mail.gmail.com>
 <1392304466.63673.23.camel@btw.pki2.com>
 <CAEjQA5+KT3y3Y0C9r1uK=7JshT4OcJhEPw3Oztqpbh6x==HBHg@mail.gmail.com>
 <3D9E8EFA-1EB0-4CA6-B26E-CA87553150E3@neville-neil.com>
Content-Type: text/plain; charset="ISO-8859-1"
Date: Sat, 15 Feb 2014 16:06:27 -0800
Message-ID: <1392509187.35612.12.camel@btw.pki2.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.32.1 FreeBSD GNOME Team Port 
Content-Transfer-Encoding: 7bit
X-SoftwareMunitions-MailScanner-Information: Dennis Glatting
X-SoftwareMunitions-MailScanner-ID: s1G06RSX037030
X-SoftwareMunitions-MailScanner: Found to be clean
X-MailScanner-From: dg@pki2.com
Cc: "C. L. Martinez" <carlopmart@gmail.com>,
 FreeBSD Net <freebsd-net@freebsd.org>
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net/>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 16 Feb 2014 00:06:40 -0000

On Sat, 2014-02-15 at 18:44 -0500, George Neville-Neil wrote:
> On Feb 14, 2014, at 2:21 , C. L. Martinez <carlopmart@gmail.com> wrote:
> 
> > On Thu, Feb 13, 2014 at 3:14 PM, Dennis Glatting <dg@pki2.com> wrote:
> >> On Thu, 2014-02-13 at 09:14 +0000, C. L. Martinez wrote:
> >>> Hi all,
> >>> 
> >>> I need to setup some FreeBSD (or Linux, it depends) hosts to use as a
> >>> packet capture sensors for our infrastrucutre.
> >>> 
> >>> Searching about software that I could use under FreeBSD, I only find
> >>> these ones:
> >>> 
> >>> a) daemonlogger
> >>> b) streamdb
> >>> 
> >>> For Linux, it seems exits more alternatives. Any suggestions??
> >>> 
> >>> I need to monitor 1 GiB networks.
> >>> 
> >> 
> >> I've not (yet) used these:
> >> 
> >> /usr/ports/security/sguil-client
> >> /usr/ports/security/sguil-sensor
> >> /usr/ports/security/sguil-server
> >> 
> >> 
> >>> Thanks.
> > 
> > Thanks Dennis, but Sguil is not a packet capture componente. Sguil
> > needs daemonlogger to show you captured data.
> 
> I might be a bit confused.  Can you just use tcpdump with the appropriate flags
> to limit the size and number of files?
> 
> What are you trying to achieve?
> 

Well, I was trying to achive an evaluation of SGuil under FreeBSD but
after a couple hours of trying to get the peices to play I surrendered
to another day. I assumed the goal here was IPS.


-- 
Dennis Glatting <dg@pki2.com>