I have recently installed Snort IDS on Linux Ubuntu 16.04LTS (not server), after experimenting and testing configuration in VitualBox.

After installing and successfully validating the configuration file with command:

sudo snort -T -c /etc/snort/snort.conf

I run the IDS as an instance using the following command, confirming that it is operating with the custom rule-set that I supplied.

sudo snort -A console -i wlp4s0 -u snort -g snort -c /etc/snort/snort.conf

When I close the instance and lunch snort properly using sudo service snort start, no errors are encountered, however the output of /var/log/snort/snort.log is an unrecognizable series of symbols that I would ordinarily relate to an unrecognized formatting error:

��p���Z� !"#$%&'()*+,-./01234567h<Z��   ���:�D��~Z��Z��    �b��(�M�,03��ET2(t�:�D��ns���Z��,b��(�M�,03��ET2(t�:�D����wL��Z��

Can anyone explain how this is occurring (especially considering the lack of Snort errors), and suggest how to fix this to make the logging legible?

Thanks in advance.

  • Maybe your expectation is just wrong what this file should contain. It is probably intended to be this way. See manual-snort-org.s3-website-us-east-1.amazonaws.com/…. The downvote is for not providing essential information, especially the part of the config which specifies what should be put into this log file. Commented Mar 20, 2018 at 13:29
  • snort.log is pcap format. You can open by tcpdump.
    – Mr.kang
    Commented Mar 28, 2018 at 17:44


You must log in to answer this question.

Browse other questions tagged .