---
name: "prelude-nids"
section: "8"
platform: "linux"
package: "prelude-nids"
version: "0.8.6-1"
release: "Debian 3.1 (Sarge)"
platforms: ["linux"]
url: "https://new.carta.tech/prelude-nids"
---

# prelude-nids(8)

A Network Intrusion Detection System

## NAME

prelude-nids - A Network Intrusion Detection System

## SYNOPSIS

**prelude-nids** \[*OPTION*\]...

## DESCRIPTION

**prelude-nids** is the Prelude Network Intrusion Detection System sensor, responsible for packet capture and analyzis, it is endow with :

\- The signature engine, designed to be the completly generic and evolutive, it is currently able to read Snort rulesets. By simply adding parser, it shoulds permit to load rulesets from any NIDS

\- a series of intrusion detection plugins, each dedicated to a particular kind of attack started by prelude-nids

\- a series of protocols plugins, each dedicated to decoding one, high level protocol

## OPTIONS

- **-h**, **--help**

  Print help, additionally with the dynamically loaded plugins help.

- **-v**, **--version**

  Print version number.

- **-q**, **--quiet**

  Direct the output to syslog, not to stdout, or stderr..

- **-d**, **--daemon**

  Run in daemon mode.

- **-r**, **--read-from** **\<filename\>**

  Read file prevously recorded.

- **-i**, **--interface**

  Device to capture packet from (you may specify -i several time).

- **-w**, **--write-to** **\<filename\>**

  With -i, specify that packet gathered on this interface should be written to the specified file. As it's not possible to use the same file for storing data from different interface (pcap problem), the file will be created with a device extenssion. For exemple if you are capturing from interface  eth0, the file will be called \<filename\>.eth0. And so on.

- **-b**, **--bpf** **\<bpf** **rule\>**

  Specify that packet gathered from the specified interface should pass the provided BPF filter. The BPF rule have to be quoted. An exemple of BPF rule is : "src host x.x.x.x and ! dst host y.y.y.y". This option can be used globaly (before any -i or -r option), or on a per interface basis (after -i or -r).

- **-s**, **--snaplen** **\<snaplen\>**

  Specify the maximum number of bytes to capture by packet. The value should be set to the biggest MTU (Maximum  Transfer Unit) of the interface it is associated with. This option can be used globaly (before any -i or -r option),  or on a per interface basis (after -i or -r).

- **-a**, **--report-all**

  The default is to return as soon as a signature match (Snort compatibility),  however, we believe this is not a secure behavior, and encourage you to set this option (this should not impact CPU usage much, because of the advanced algorithm Prelude NIDS use).

- **-P**, **--pidfile** **\<pidfile\>**

  Write prelude-ndis's PID to pidfile.

## WEBSITE

http://www.prelude-ids.org ⟨http://www.prelude-ids.org⟩

## SEE ALSO

**prelude-manager**(8)

## AUTHORS

Prelude is written by Yoann Vandoorselaere \<yoann@prelude-ids.org\>.

This manpage was written by Sebastien Tricaud \<toady@gscore.org\>.