monitor session 1 source interface f0/0 both
monitor session 1 destination interface f0/15

server# ifconfig eth2|em2 up

server# tcpdump -ni eth2|em2 -A -s 0 "port 80"

http://www.circlemud.org/~jelson/software/tcpflow/

Сервис SNORT

[server:~] # /usr/local/etc/rc.d/snort stop
[server:~] # pkg_delete -x snort
[server:~] # rm -r /usr/local/etc/snort/

root@server:~# /etc/init.d/snort stop
root@server:~# apt-get purge snort

Сервис SNORTSAM