When you're using Snort for real-time monitoring the messages are logged to /var/log/snort/alerts.

However, when you load a pcap file, where do you see if any packet triggered a rule? Because they are not stored in that same directory.


Nevermind... the alerts are logged in the same directory. However the problem seems to be that even if I'm using the default configuration file, I need to use the -c parameter

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.