next up previous contents
Next: Specifying Multiple-Instance Identifiers Up: Miscellaneous Previous: Running in Rule Stub   Contents

Obfuscating IP Address Printouts

If you need to post packet logs to public mailing lists, you might want to use the -O switch. This switch obfuscates your IP addresses in packet printouts. This is handy if you don't want people on the mailing list to know the IP addresses involved. You can also combine the -O switch with the -h switch to only obfuscate the IP addresses of hosts on the home network. This is useful if you don't care who sees the address of the attacking host. For example, you could use the following command to read the packets from a log file and dump them to the screen, obfuscating only the addresses from the 192.168.1.0/24 class C network:

    ./snort -d -v -r snort.log -O -h 192.168.1.0/24



Eugene Misnik 2013-05-08