I am working with commands that have already been tested to work but they aren't working now.
This is my config file:
alert tcp any any <> any any (msg: "/etc/passwd Payload Found"; content: "/etc/passwd/"; sid: 69;)
It works. It generates an alert.
I use snort to put the alert file into a log directory
snort -r FRAG3z.pcap -c frag3.conf -dev -l log -d -q
I execute the snort command, and I go into the log directory and my alert is there. I then open the alert and is completely empty. Anyone got any ideas.