To the other people who answer me here, sorry for the delay, I took some
time to calm down and not degrade myself to the level of discussion some
person here proposed me.
Martin Brandenburg,
I know what pcap files are, I used them. But, as I said, I'm not an
expert, I didn't take in care that converting them to ASCII could mean
losing information (if I understand you well).
Thanks for the clarification.
***
R0me0 (private) and John Jansen,
I'd read the documentation before posting here. Thanks anyway.
***
Frederick W. Soucy
You got the "idea behind" my message (by the way, I was aware about
utmp). Taking in care I'm not in a Linux mailing list I avoided to
mention the abomination by its name :-). That's why I'm a bit paranoid
and some times I'm sarcastic. Sorry for that.
The point is, I ask myself the same a lot of unix users probably are
asking themselves, should I invest more time in educating myself in
practices that in two days could be declared obsolete? Or should I
install MSWindows in my desktop and RedHat in my server and simply use
the casual WYSIWYG interface to read logs (it exists a port called
winpcap)? Surely there are a lot of system administrators out there
that do this and win the same money than if dealing with pf or iptables
directly. In theory FOSS projects should be against promoting this
tendency among users (very few understand why) but in practice happens
exactly the opposite, at all levels.
***
Peter Hansteen,
Thanks for your explanation.
As I told you in a private email there aren't the technical details but
some human attitudes what discourages me. But I won't give up just
because one bad experience. I'll probably buy your book about pf. ;-)
Thanks to all.
Walter
