I am looking for some support on using Snort in Windows 7. My experience so far is using WireShark, so this is new territory to me.

I would like to use Snort to perform a trace, which, after it ends, will write the output to a logfile which I can then analyse.

I can perform a trace using:

snort.exe -i 3 -vd

But I cannot figure out to log this output. Any help would be appreciated.

1 Answer 1


Here is an excerpt from Snort Cookbook. You should be able to find what your looking for in there.

Logging to a Specific File


You want to log your output to a specific file and location.


Use the -L ttfilename/tt option to log to a specific file:

[testuser@localhost snort]# snort -L test1

You can also specify a location by using the -l ttdirectory/tt command-line option:

[testuser@localhost snort]# snort -l /snort/log -L test2


Logging traffic in binary mode is far less resource intensive than in other modes. Binary files can then be reviewed later using Snort, TCPDump, Ethereal, or other binary log-compatible programs.

You can log to a specific file by specifying the -L ttfilename/tt command-line option. This logs the network traffic to a binary file. The following command logs all traffic to the file called test1 in the default Snort log directory:

[testuser@localhost snort]# snort -L test1

This command creates a file called test1.1084554709 in the /var/log/snort directory. You can also specify a location by using the -l ttdirectory/tt command-line option:

[testuser@localhost snort]# snort -l /snort/log -L test2

This command creates a file called test1.1084554711 in the /snort/log directory.

  • It's worth noting that the Windows version acts slightly differently, but should be translatable.
    – Scott Pack
    Aug 2, 2012 at 14:14
  • Thanks. I'm getting this strange error: 'c:\Snort\bin>snort.exe snort -L test1 Running in packet dump mode --== Initializing Snort ==-- Initializing Output Plugins! Snort BPF option: snort -L test1 pcap DAQ configured to passive. The DAQ version does not support reload. Acquiring network traffic from "\Device\NPF_{C01CA2EE-3374-4499-8281-344B9BF97BF 2}". ERROR: Can't set DAQ BPF filter to 'snort -L test1' (¶;h)! Fatal Error, Quitting.. Could not create the registry key.' Do you know what's causing this? Aug 2, 2012 at 18:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .