Wireshark · Ethereal-users: Re: [Ethereal-users] how to automatically alarm for certain content

[Guy Harris <gharris@xxxxxxxxx>]

Tore Agblad wrote:
> Does anyone have a sample on howto have ethereal running and if some 
> text is found
> in a packet (the data part) it triggers some action, for example sending 
> an email ?

Ethereal isn't really designed to do that sort of scanning; that sounds 
more like an intrusion detection system rather than a protocol analyzer, 
as it doesn't require as detailed protocol analysis as Ethereal does, 
but it *does* require more actions than Ethereal supports when it sees a 
packet match.

You might want to check whether, for example, Snort:

	http://www.snort.org/

can be configured to do that.