zeek/scripts/start-capture-all

19 lines
454 B
Tcsh
Executable file

#!/bin/csh -f
#
# usage start-capture-all filename
#
# e.g.: start-capture-all /usr/local/bro/bulk-trace/bulk
#
# this will generate a trace with file name filename-N
#
# note: if you run this script repeatedly with the same filename,
# spot-trace will kill the old instance, and start a new
# instance with file filename-N+1
#
# capture everything
spot-trace $* all 'tcp and udp'
# capture everything but HTTP
#spot-trace $* all 'not tcp port 80'