from what you described, I understood:
- You already have PCAP files to analyse with Snort (so you are not running in live mode but reading back previously created captures). Therefore the switch
-i does not apply in this case.
- Snort aborts with the message:
ERROR: Cannot decode data link type 127
- When you mention "detect any problem", I assume you are specifically looking for malware communication (and not investigation network issues, eg. layer-2 issues with your Wifi!).
First, you need to remove radiotap link encapsulation by rewriting the layer-2 link type into something Snort can easily cope with, eg. link-type
For that you can use
editcap tool from Wireshark project.
editcap captura-analisar.pcapng -T ether captura-1.pcap, where:
-T ether: sets the encapsulation type of the output file to
By the way, if your version of Snort does not read PCAPNG files, you can also convert it with
editcap adding parameter
editcap captura-analisar.pcapng -F pcap -T ether captura-1.pcap
From now on you can run snort over your PCAPs files with a command such as:
snort -A console -k none -K none -c snort.conf -r captura-1.pcap
-A: issues alerts to the console
none will not create PCAPs from the alerts, while
pcap will do so. Use accordingly.
-k: checksum mode, ignore checksum validation.
-c: your snort config file containing variables, pre-process options, rules.
-r: read PCAP. be aware of other options to read bunch of pcap files, such as
--pcap-list="foo1.pcap foo2.pcap foo3.pcap"
Does it make sense?
PS: you can inspect the properties of PCAP files with
capinfos -M captura.pcap. This shows information on encapsulation, amount of packets captured, start/end date of capture, duration, etc.