Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am looking for some support on using Snort in Windows 7. My experience so far is using WireShark, so this is new territory to me.

I would like to use Snort to perform a trace, which, after it ends, will write the output to a logfile which I can then analyse.

I can perform a trace using:

snort.exe -i 3 -vd

But I cannot figure out to log this output. Any help would be appreciated.

share|improve this question

1 Answer 1

Here is the http://commons.oreilly.com/wiki/index.php/Snort_Cookbook/Logging,_Alerts,_and_Output_Plug-ins. You should be able to find what your looking for in there.

Logging to a Specific File Problem

You want to log your output to a specific file and location. Solution

Use the -L ttfilename/tt option to log to a specific file:

[testuser@localhost snort]# snort -L test1

You can also specify a location by using the -l ttdirectory/tt command-line option:

[testuser@localhost snort]# snort -l /snort/log -L test2

Discussion

Logging traffic in binary mode is far less resource intensive than in other modes. Binary files can then be reviewed later using Snort, TCPDump, Ethereal, or other binary log-compatible programs.

You can log to a specific file by specifying the -L ttfilename/tt command-line option. This logs the network traffic to a binary file. The following command logs all traffic to the file called test1 in the default Snort log directory:

[testuser@localhost snort]# snort -L test1

This command creates a file called test1.1084554709 in the /var/log/snort directory. You can also specify a location by using the -l ttdirectory/tt command-line option:

[testuser@localhost snort]# snort -l /snort/log -L test2

This command creates a file called test1.1084554711 in the /snort/log directory.

share|improve this answer
    
It's worth noting that the Windows version acts slightly differently, but should be translatable. –  Scott Pack Aug 2 '12 at 14:14
    
Thanks. I'm getting this strange error: 'c:\Snort\bin>snort.exe snort -L test1 Running in packet dump mode --== Initializing Snort ==-- Initializing Output Plugins! Snort BPF option: snort -L test1 pcap DAQ configured to passive. The DAQ version does not support reload. Acquiring network traffic from "\Device\NPF_{C01CA2EE-3374-4499-8281-344B9BF97BF 2}". ERROR: Can't set DAQ BPF filter to 'snort -L test1' (¶;h)! Fatal Error, Quitting.. Could not create the registry key.' Do you know what's causing this? –  Dustin Cook Aug 2 '12 at 18:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.