0

I have recently installed Snort IDS on Linux Ubuntu 16.04LTS (not server), after experimenting and testing configuration in VitualBox.

After installing and successfully validating the configuration file with command:

sudo snort -T -c /etc/snort/snort.conf

I run the IDS as an instance using the following command, confirming that it is operating with the custom rule-set that I supplied.

sudo snort -A console -i wlp4s0 -u snort -g snort -c /etc/snort/snort.conf

When I close the instance and lunch snort properly using sudo service snort start, no errors are encountered, however the output of /var/log/snort/snort.log is an unrecognizable series of symbols that I would ordinarily relate to an unrecognized formatting error:

��p���Z� !"#$%&'()*+,-./01234567h<Z��   ���:�D��~Z��Z��    �b��(�M�,03��ET2(t�:�D��ns���Z��,b��(�M�,03��ET2(t�:�D����wL��Z��
                                   !"#$%&'()*+,-./01234567h<Z�V�R��:�D��~Z�VZ�V�Rb��(�M�,03��ET2(t�:�D��L�

Can anyone explain how this is occurring (especially considering the lack of Snort errors), and suggest how to fix this to make the logging legible?

Thanks in advance.

  • Maybe your expectation is just wrong what this file should contain. It is probably intended to be this way. See manual-snort-org.s3-website-us-east-1.amazonaws.com/…. The downvote is for not providing essential information, especially the part of the config which specifies what should be put into this log file. – Steffen Ullrich Mar 20 '18 at 13:29
  • snort.log is pcap format. You can open by tcpdump. – Mr.kang Mar 28 '18 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.