<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=unicode" /> <meta http-equiv="Content-Language" content="en-us" /> <title>Testing Snort on Windows console with edited snort config file as packet logger</title> <style> <!-- p.MsoNormal {margin-top:0mm; margin-right:0mm; margin-bottom:10.0pt; margin-left:0mm; line-height:115%; font-size:12.0pt; font-family:"Times New Roman","serif";} a:link {color:blue; text-decoration:underline;} a:visited {color:purple; text-decoration:underline;} p {margin-right:0mm; margin-left:0mm; font-size:12.0pt; font-family:"Times New Roman","serif";} ol {margin-bottom:0mm;} h1 {margin-top:12.0pt; margin-right:0mm; margin-bottom:3.0pt; margin-left:0mm; page-break-after:avoid; font-size:16.0pt; font-family:Arial;} --> </style> <meta name="keywords" content="logger, security, IDS, opensource, technology, data, intrusion, detection, system, applications, sniffers, exploits, TCP/IP packets" /> <meta name="description" content="Testing Snort on Windows machine with new Snort rules and config files. The Snort tested as packet logger" /> </head> <body lang="EN-US" link="#0000FF" vlink="#800080" topmargin="20" leftmargin="20" rightmargin="20" bottommargin="20"> <div class="WordSection1"> <h1 align="center" style="margin-top: 0; margin-bottom: 0"> <span style="font-weight: 400"><font size="4">&lt; <span style="text-decoration: none"><font color="#000000"> <a title="Snort on Windows XP Pro SP2 - IDS, IPS and Packet sniffer" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpbaseperladodb6.html"> Snort on Windows XP&nbsp; Pro SP2</a></font></span> | <a title="Java and open source - information, tutorials, install, setup, configure" target="_top" href="http://www.javaguicodexample.com/"> Java &amp; Friends</a>&nbsp; | <span style="text-decoration: none"> <font color="#000000"> <a title="Snort and MySQL Database" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpbaseperladodb8.html"> Snort and MySQL Database</a></font></span> &gt;</font></span></h1> <hr noshade="" color="#FF3300" /> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <h1 align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><span style="font-weight: 400"><font face="Arial" size="6">Testing Snort<span style="line-height:115%;"> on Windows XP&nbsp; Pro SP2</span></font></span></h1> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font face="Arial">What do we have in this session?</font></b></p> <ol> <li> <h1 style="margin-bottom:0mm;margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">Testing Snort from Windows Console</font></span></h1> </li> <li> <h1 style="margin-bottom:0mm;margin-bottom:0;line-height: normal;text-autospace:none; margin-top:0"><span style="font-weight: 400"> <font size="3" face="Arial">Testing Snort Config File</font></span></h1> </li> <li> <h1 style="margin-bottom:0mm;margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">Running Snort from any Windows Path</font></span></h1> </li> <li> <h1 style="margin-bottom:0mm;margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">Snort in Sniffer mode</font></span></h1> </li> <li> <h1 style="margin-bottom:0mm;margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">Snort as Packet Logger</font></span></h1> </li> <li> <h1 style="margin-bottom:0mm;margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">The Not Using PCAP_FRAMES message</font></span></h1> </li> </ol> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt" align="center"> <script type="text/javascript"><!-- google_ad_client = "pub-8089415323104206"; /* 728x90, created 5/16/08 javaos */ google_ad_slot = "1917524460"; google_ad_width = 728; google_ad_height = 90; //--> </script> &nbsp;<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%; font-weight:bold">Testing Snort from Windows Console</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Save and close the snort.conf file. Launch Windows command prompt. Type:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">C:\&gt;Snort\bin\snort --h</span></font><font face="Courier New"> or C:\&gt;Snort\bin\snort -?</font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> The command will invoke the Helps.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="733" height="709" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp116.png" alt="Running the Snort command from Windows command prompt with -h option (help)" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> A complete Snort commands are shown below.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">USAGE: snort [-options] &lt;filter options&gt;</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; snort /SERVICE /INSTALL [-options] &lt;filter options&gt;</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; snort /SERVICE /UNINSTALL</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; snort /SERVICE /SHOW</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">Options:</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Set alert mode: fast, full, console, test or none&nbsp; (alert file alerts only)</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -b&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Log packets in tcpdump format (much faster!)</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -B &lt;mask&gt;&nbsp; Obfuscated IP addresses in alerts and packet dumps using CIDR mask</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -c &lt;rules&gt; Use Rules File &lt;rules&gt;</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Print out payloads with character data only (no hex)</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -d&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Dump the Application Layer</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -e&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Display the second layer header info</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Log alert messages to NT Eventlog. (Win32 only)</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -f&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Turn off fflush() calls after binary log writes</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -F &lt;bpf&gt;&nbsp;&nbsp; Read BPF filters from file &lt;bpf&gt;</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -G &lt;0xid&gt;&nbsp; Log Identifier (to uniquely id events for multiple snorts)</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -h &lt;hn&gt;&nbsp;&nbsp;&nbsp; Home network = &lt;hn&gt;</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -H&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Make hash tables deterministic.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -i &lt;if&gt;&nbsp;&nbsp;&nbsp; Listen on interface &lt;if&gt;</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -I&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Add Interface name to alert output</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -k &lt;mode&gt;&nbsp; Checksum mode (all,noip,notcp,noudp,noicmp,none)</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -K &lt;mode&gt;&nbsp; Logging mode (pcap[default],ascii,none)</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -l &lt;ld&gt;&nbsp;&nbsp;&nbsp; Log to directory &lt;ld&gt;</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -L &lt;file&gt;&nbsp; Log to this tcpdump file</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -n &lt;cnt&gt;&nbsp;&nbsp; Exit after receiving &lt;cnt&gt; packets</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -N&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Turn off logging (alerts still work)</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -O&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Obfuscate the logged IP addresses</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -p&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Disable promiscuous mode sniffing</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -P &lt;snap&gt;&nbsp; Set explicit snaplen of packet (default: 1514)</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -q&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Quiet. Don't show banner and status report</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -r &lt;tf&gt;&nbsp;&nbsp;&nbsp; Read and process tcpdump file &lt;tf&gt;</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -R &lt;id&gt;&nbsp;&nbsp;&nbsp; Include 'id' in snort_intf&lt;id&gt;.pid file name</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -s&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Log alert messages to syslog</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -S &lt;n=v&gt;&nbsp;&nbsp; Set rules file variable n equal to value v</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -T&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Test and report on the current Snort configuration</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -U&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Use UTC for timestamps</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -v&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Be verbose</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -V&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Show version number</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -W&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Lists available interfaces. (Win32 only)</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -X&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Dump the raw packet data starting at the link layer</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -x&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Exit if Snort configuration problems occur</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -y&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Include year in timestamp in the alert and log files</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -Z &lt;file&gt;&nbsp; Set the performonitor preprocessor file path and name</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -?&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Show this information</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&lt;Filter Options&gt; are standard BPF options, as seen in TCPDump</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">Longname options and their corresponding single char version</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --logid &lt;0xid&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Same as -G</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --perfmon-file &lt;file&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Same as -Z</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --pid-path &lt;dir&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Specify the directory for the Snort PID file</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --snaplen &lt;snap&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Same as -P</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --help&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Same as -?</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --version&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Same as -V</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --alert-before-pass&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Process alert, drop, sdrop, or reject before pass, default is pass before alert, drop,...</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --treat-drop-as-alert&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Converts drop, sdrop, and reject rules into alert rules during startup</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --process-all-events&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Process all queued events (drop, alert,...), default stops after 1st action group</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --dynamic-engine-lib &lt;file&gt;&nbsp;&nbsp;&nbsp;&nbsp; Load a dynamic detection engine</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --dynamic-engine-lib-dir &lt;path&gt; Load all dynamic engines from directory</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --dynamic-detection-lib &lt;file&gt;&nbsp; Load a dynamic rules library</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --dynamic-detection-lib-dir &lt;path&gt; Load all dynamic rules libraries from directory</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --dump-dynamic-rules &lt;path&gt;&nbsp;&nbsp;&nbsp;&nbsp; Creates stub rule files of all loaded rules libraries</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --dynamic-preprocessor-lib &lt;file&gt;&nbsp; Load a dynamic preprocessor library</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --dynamic-preprocessor-lib-dir &lt;path&gt; Load all dynamic preprocessor libraries from directory</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --pcap-single &lt;tf&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Same as -r.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --pcap-file &lt;file&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; file that contains a list of pcaps to read - read mode is implied.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --pcap-list &quot;&lt;list&gt;&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; a space separated list of pcaps to read - read mode is implied.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --pcap-loop &lt;count&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; this option will read the pcaps specified on command line continuously.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; for &lt;count&gt; times.&nbsp; A value of 0 will read until Snort is terminated.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --pcap-reset&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if reading multiple pcaps, reset snort to post-configuration state before reading next pcap.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --pcap-show&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; print a line saying what pcap is currently being read.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --exit-check &lt;count&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Signal termination after &lt;count&gt; callbacks from pcap_dispatch(), showing the time it</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; takes from signaling until pcap_close() is called.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --conf-error-out&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Same as -x</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --enable-mpls-multicast&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Allow multicast MPLS</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --enable-mpls-overlapping-ip&nbsp;&nbsp;&nbsp; Handle overlapping IPs within MPLS clouds</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --max-mpls-labelchain-len&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Specify the max MPLS label chain</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --mpls-payload-type&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Specify the protocol (ipv4, ipv6, ethernet) that is encapsulated by MPLS</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">&nbsp;&nbsp; --require-rule-sid&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Require that all snort rules have SID specified.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Arial"> <span style="font-size:12.0pt">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><b><font size="3" face="Arial"> <span style="font-size:12.0pt;font-weight:bold">Testing Snort Config File</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Arial"> <span style="font-size:12.0pt">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Let test the snort basic configuration that we have done. Run the following command. The meanings have been summarized in the following Table.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <div align="center"> <table class="MsoNormalTable" border="1" cellspacing="0" cellpadding="0" style="border-collapse:collapse;border:none"> <tbody> <tr> <td width="177" bgcolor="#D9D9D9" style="width:133.0pt;border:solid black 1.0pt; background:#D9D9D9;padding:0mm 5.4pt 0mm 5.4pt"> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><b><font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%;font-weight:bold"> Option</span></font></b></p> </td> <td width="369" bgcolor="#D9D9D9" style="width:276.4pt;border:solid black 1.0pt; border-left:none;background:#D9D9D9;padding:0mm 5.4pt 0mm 5.4pt"> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><b><font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%;font-weight:bold"> Meaning</span></font></b></p> </td> </tr> <tr> <td width="177" style="width:133.0pt;border:solid black 1.0pt;border-top:none; padding:0mm 5.4pt 0mm 5.4pt"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%">-c &lt;rules&gt;</span></font></p> </td> <td width="369" style="width:276.4pt;border-top:none;border-left:none; border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:0mm 5.4pt 0mm 5.4pt"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <span style="font-size:12.0pt;line-height:115%"> <font size="3" face="Arial"> Use Rules File </font> <font size="3" face="Courier New"> &lt;rules&gt;</font></span></p> </td> </tr> <tr> <td width="177" style="width:133.0pt;border:solid black 1.0pt;border-top:none; padding:0mm 5.4pt 0mm 5.4pt"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%">-l &lt;ld&gt;</span></font></p> </td> <td width="369" style="width:276.4pt;border-top:none;border-left:none; border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:0mm 5.4pt 0mm 5.4pt"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <span style="font-size:12.0pt;line-height:115%"> <font size="3" face="Arial"> Log to directory </font> <font size="3" face="Courier New"> &lt;ld&gt;</font></span></p> </td> </tr> <tr> <td width="177" style="width:133.0pt;border:solid black 1.0pt;border-top:none; padding:0mm 5.4pt 0mm 5.4pt"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%">-v</span></font></p> </td> <td width="369" style="width:276.4pt;border-top:none;border-left:none; border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:0mm 5.4pt 0mm 5.4pt"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%">Be verbose</span></font></p> </td> </tr> <tr> <td width="177" style="width:133.0pt;border:solid black 1.0pt;border-top:none; padding:0mm 5.4pt 0mm 5.4pt"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%">-i &lt;if&gt;</span></font></p> </td> <td width="369" style="width:276.4pt;border-top:none;border-left:none; border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:0mm 5.4pt 0mm 5.4pt"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <span style="font-size:12.0pt;line-height:115%"> <font size="3" face="Arial"> Listen on interface </font> <font size="3" face="Courier New"> &lt;if&gt;</font></span></p> </td> </tr> <tr> <td width="177" style="width:133.0pt;border:solid black 1.0pt;border-top:none; padding:0mm 5.4pt 0mm 5.4pt"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%">-T</span></font></p> </td> <td width="369" style="width:276.4pt;border-top:none;border-left:none; border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:0mm 5.4pt 0mm 5.4pt"> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%">Test and report on the current Snort configuration</span></font></p> </td> </tr> </tbody> </table> </div> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">C:\&gt;Snort\bin&gt;snort -c c:\snort\etc\snort.conf -l c:\snort\log -i2 -T</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="589" height="727" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp117.png" alt="Running the Snort command from Windows command prompt to test Snort configuration file" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%; font-weight:bold">Running Snort from any Windows Path</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> In order to run snort and other related binaries, put the path in Windows environment variables and the steps are shown below.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="419" height="486" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp118.png" alt="Setting Snort environment variable so that Snort command can be run from any Windows path: relative or absolute" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Close any Windows console and re-open it. Run snort.exe from the root, </span></font><font face="Courier New"> <span style="font-family:&quot;Arial&quot;">C:\</span></font><font face="Arial"> drive.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="589" height="337" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp119.png" alt="Running Snort from any Windows Path with --h option (help)" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Next, let have some story about Snort. Depending on your needs, Snort runs in three different modes: Sniffer, Packet Logger, and Network Intrusion modes.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%; font-weight:bold">Snort in Sniffer mode</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> If you re running Snort from the command line with two network adapters, specify which adapter to monitor:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">C:\&gt;snort -v -i#</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> # is the number of the applicable adapters (as shown on the output of the <b>snort -W</b> command).</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> You must use this -i switch whenever you run the snort program on the command line. Sniffer mode is the simplest iteration of Snort. To run it, follow these steps: from the command line (within the <b>%SnortPath%\bin</b> directory and in our case, we can run it from any Windows path) type:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">C:\&gt;snort -v -i2</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt" align="center"> <script type="text/javascript"> <!-- google_ad_client = "pub-8089415323104206"; /* 300x250, created 5/16/08javaos */ google_ad_slot = "8146009330"; google_ad_width = 300; google_ad_height = 250; //--> </script> &nbsp;<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt" align="center"> <font face="Arial"> --------------------------------------------------------------</font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="525" height="289" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp120.png" alt="Running Snort as sniffer mode" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> This command runs Snort as a packet sniffer with the verbose switch, outputting TCP/IP packet headers to the screen. Press Ctrl+C keys to stop the output. Snort/WinPcap summarizes its activities, as shown in the following screenshot.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="597" height="769" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp121.png" alt="Running snort with verbose output on interface no. 2" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> To receive a more detailed capture of packets on the wire, type:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">C:\&gt;snort -vd -i2</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="557" height="553" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp122.png" alt="Running snort with verbose output and details on interface no. 2" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> This command provides the TCP/IP headers and packet information (descriptive). Type snort at the command line for a full list of all the switches. If you re getting TCP headers, you know that so far you re right on track. If you have more than one network card in your Snort IDS system, type:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">C:\&gt;snort -W</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="693" height="319" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp123.png" alt="Running snort with -W option to view the available interfaces on the run machine" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> This command determines how WinPcap has these adapters numbered, and is only available in the Win32 version of Snort.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%; font-weight:bold">Snort as Packet Logger</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> You can test Snort s logging abilities with the -l (log) switch, by typing (take note on the order of the options):</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">C:\&gt;snort -vde -l c:\Snort\log -i2</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="581" height="289" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp124.png" alt="Running Snort for Windows as packet logger" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Please press Ctrl+C to stop.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="501" height="451" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp125.png" alt="Sample of Snort output run as packet logger" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="544" height="330" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp126.png" alt="The generated Snort log file" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> This runs Snort in descriptive verbose mode and logs all its findings to the directory called log under the Snort installation directory. The individual packets are filed in hierarchical directories based on the IP address from where the packet was received. Several command-line switches are specific to logging and output, including the ability to log all packets to a single binary file. Play around with those as needed.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%; font-weight:bold">The Not Using PCAP_FRAMES message</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> The Not Using PCAP_FRAMES message is normal. Try the following command:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font face="Courier New">C:\&gt;snort -v -ix</font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Replace x with the number of the NIC which snort will use. If you re using the wrong NIC 'pcap_frames' error will show up and if you use the right NIC pcap_frame error appears and just stays there until you have some traffic running through. So, make sure to use the right number of NIC when running snort. When running as a service, a valid and appropriate NIC number also must be specified.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;<div align="center"><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=527221&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=85439"></script></div> </p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <hr noshade="" color="#FF3300" /> <p class="MsoNormal" style="margin-top: 0; margin-bottom: 0" align="center"> <script type="text/javascript"><!-- google_ad_client = "pub-8089415323104206"; google_ad_slot = "3545464564"; google_ad_width = 728; google_ad_height = 15; //--> </script> &nbsp;<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script></p> <h1 align="center" style="margin-top: 0; margin-bottom: 0"> <span style="font-weight: 400"><font size="4">&lt; <span style="text-decoration: none"><font color="#000000"> <a title="Snort on Windows XP Pro SP2 - IDS, IPS and Packet sniffer" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpbaseperladodb6.html"> Snort on Windows XP&nbsp; Pro SP2</a></font></span> | <a title="Java and open source - information, tutorials, install, setup, configure" target="_top" href="http://www.javaguicodexample.com/"> Java &amp; Friends</a>&nbsp; | <span style="text-decoration: none"> <font color="#000000"> <a title="Snort and MySQL Database" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpbaseperladodb8.html"> Snort and MySQL Database</a></font></span> &gt;</font></span></h1> </div> </body> </html>