03-26-2001 11:15 AM - edited 03-08-2019 08:06 PM
I was told in a current TAC case that to view the iplogs you can use Ethereal. Ethereal is great, but it doesn't open the iplogs.
I'm using v0.8.7 and get a "not in a recognized file format" error msg when I try to open an iplog file.
It's not tcpdump either, what should I be using to view these files?
03-26-2001 03:14 PM
I added support for CSIDS IPLog format to ethereal starting in version 0.8.12. If you get the latest version from www.ethereal.com you should be able to read the file.
To check on changes to ethereal, you can watch http://www.ethereal.com/ChangeLog
Please let me know if you have trouble opening the log after you have upgraded to a version >= 0.8.12.
04-26-2001 09:56 AM
If you are talking about the log files that are stored on the sensor, (log.20010426####) they are comma delimited and can be read in excel or anything that reads SDF files. If you are talking about the event database on CSPM, they are in a database format, and good luck finding something to read them.
04-26-2001 12:07 PM
The nice thing about ethereal is that it will parse the iplog files and do packet decode. It can also write the iplogs back out in pcap format (useful with TCPDUMP) for replay (have to hack TCPDUMP to add MAC info).
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide