Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is new to me, but what types of data does Snort log for Network Intrusion Detection?

I am guessing time stamp, source IP address, destination IP address, source port, destination port, protocol. Is there anything else?

share|improve this question
up vote 2 down vote accepted

Snort supports several output formats for the Log Parser where CSV format is mostly used. To configure Snort to use the CSV output format add the following line in the snort.conf file:

output alert_csv: alert.csv default

There are by default 28 fields available for log analysis that include timestamp, sig_generator, sig_id, sig_rev, msg, proto etc. For understanding Snort Log Management i recommend to read "Managing Snort Alerts"

share|improve this answer

Basically, snort observes network packet traffic. It can be configured to log and/or report on any information that is available from the network packet. In most cases it is only trapping on frame and header data, but it can also be used for a fairly robust set of deep packet inspection (DPI) functions. DPI allows you to sort/track/trap/etc based on information actually inside of the packet in addition to your snort rule set. For a complete set of features check out the snort documentation at The FAQ is also quite useful for this type of question.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.