Hi,

I'd like to know if we can use snoop and export the capture in a format
(like *cap) which can be read by a packet analyser like Etheral or perhaps
EtherDetect. I may not have permission to install etheral on one of my
servers but would like to capture the packets and
export it for analysis of snmp packets. thanks for any advice.

regards, Veni
inveni@hotmail.com

In comp.unix.solaris Veni <inveni@hotmail.com> wrote:
> I'd like to know if we can use snoop and export the capture in a format
> (like *cap) which can be read by a packet analyser like Etheral or perhaps
> EtherDetect. I may not have permission to install etheral on one of my
> servers but would like to capture the packets and
> export it for analysis of snmp packets. thanks for any advice.

Ethereal will read snoop output files, so just :
snoop -o /tmp/snoop.output

Scott

"Veni" <inveni@hotmail.com> writes:
> I'd like to know if we can use snoop and export the capture in a format
>(like *cap) which can be read by a packet analyser like Etheral or perhaps
>EtherDetect. I may not have permission to install etheral on one of my
>servers but would like to capture the packets and
>export it for analysis of snmp packets. thanks for any advice.

Ethereal can read snoop files directly. But if you have something else
that needs pcap file format, ethereal also comes with a util called
mergecap that can read tons of different input file types and output
stock pcap files.

"Veni" <inveni@hotmail.com> wrote in message news:<cklf3e$s5h$1@mawar.singnet.com.sg>...
> Hi,
>
> I'd like to know if we can use snoop and export the capture in a format
> (like *cap) which can be read by a packet analyser like Etheral or perhaps
> EtherDetect. I may not have permission to install etheral on one of my
> servers but would like to capture the packets and
> export it for analysis of snmp packets. thanks for any advice.

You need root permissions to run snoop, anway..
Back to topic: I never tried this, but with snoop, you can dump
raw packets (matching the specific rules, if you want) into the file,
and the other analyser PROBABLY can read raw packets from the file
instead of wire.

Regards,
Andrei