1

I am working with commands that have already been tested to work but they aren't working now.

This is my config file:

alert tcp any any <> any any (msg: "/etc/passwd Payload Found"; content: "/etc/passwd/"; sid: 69;)

It works. It generates an alert.

I use snort to put the alert file into a log directory

snort -r FRAG3z.pcap -c frag3.conf -dev -l log -d -q

I execute the snort command, and I go into the log directory and my alert is there. I then open the alert and is completely empty. Anyone got any ideas.

closed as unclear what you're asking by Steffen Ullrich, Xander, Steve, Xiong Chiamiov, this.josh Apr 18 '17 at 4:29

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    i am working with commands that having already been tested to work but they aren't working - if it worked before and is not working now you are probably doing something different. Since it is unknown to use what changed it is hard to tell what the cause of your problem is. And the current information do not make it possible to reproduce your problem too. – Steffen Ullrich Apr 15 '17 at 5:03
  • My obvious question is if you have tried any other configs regarding the content of snort logs. Snort can output many different things, and you might not have specified what you want to output. – schroeder Apr 16 '17 at 11:33

Browse other questions tagged or ask your own question.