Ethereal-users: Re: [Ethereal-users] how to automatically alarm for certain content

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 29 Jun 2005 09:20:30 -0700
Tore Agblad wrote:
Does anyone have a sample on howto have ethereal running and if some text is found in a packet (the data part) it triggers some action, for example sending an email ?
Ethereal isn't really designed to do that sort of scanning; that sounds more like an intrusion detection system rather than a protocol analyzer, as it doesn't require as detailed protocol analysis as Ethereal does, but it *does* require more actions than Ethereal supports when it sees a packet match. 

You might want to check whether, for example, Snort:

	http://www.snort.org/

can be configured to do that.