When you're using Snort for real-time monitoring the messages are logged to /var/log/snort/alerts.

However, when you load a pcap file, where do you see if any packet triggered a rule? Because they are not stored in that same directory.

1 Answer 1


Nevermind... the alerts are logged in the same directory. However the problem seems to be that even if I'm using the default configuration file, I need to use the -c parameter

You must log in to answer this question.