Home page logo

snort logo Snort mailing list archives

Re: running snort
From: beenph <beenph () gmail com>
Date: Wed, 1 May 2013 20:07:58 -0400

On Wed, May 1, 2013 at 6:18 PM, Balla István <balla.bmf () gmail com> wrote:
actually i m running snort with:
/usr/local/snort/bin/snort -Q -i eth2:eth1 -c
/usr/local/snort/etc/snort.conf -D

it produced a log file into /var/log/snort folder: snort.u2.123456789
i want to read(back) this file with: /usr/local/snort/bin/snort -r

Unified2 output is not what your snort process has read from the
network beforehand.

Unified2 is the result of events that snort triggered on the network
traffic you monitored
using its configuration and defined rules.

For snort to read a file with -r the source file needs to be a pcap file.

You could stretch the exercise to extract packets from the unified2 file
using u2bloat and then reading the output file with snort,

But depending on the rule set you have and snort configuration, its highly
improbable that those packets will re-trigger the original events
extracted from the
original unified2 file.

So maybe you could explain what you really want to do and probably people could
help you out.


Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
Get 100% visibility into your production application - at no cost.
Code-level diagnostics for performance bottlenecks with <2% overhead
Download for free and get started troubleshooting in minutes.
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

Please visit http://blog.snort.org to stay current on all the latest Snort news!

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]