1

I have a pcap file, and what I wanted to know is how can I apply the Snortrule below which I've already written within the rules folder in my log folder:

alert icmp any any -> any any (msg:"TCP Packet"; sid:477; rev:3;)

How can I execute this rule over the pcap file I have?

Improve this question

1 Answer 1

Reset to default
7

Supposing the rule is already in a Snort .rules file and snort.conf is configured to include the .rules with the rule to test...

$ snort -r foo.pcap

...or...

$ snort --pcap-single=foo.pcap

...from...

http://manual.snort.org/node8.html

Improve this answer
3
  • 1
    So don't i need to mention the rules file in the command? I tried this command it worked: snort -r cap.pcap -c rulefile.rules
    – Kulasangar
    Commented Jan 28, 2015 at 3:04
  • @Kulasangar: The -c is used to specify the config file (snort.conf) to use; the config needs to specify the .rules to include (include your.rules).
    – user1801810
    Commented Jan 29, 2015 at 4:17
  • The pcaps must be saved as "modified tcpdump" or you will get the error can't initialize daq pcap (-1)
    – A Reu
    Commented Dec 6, 2019 at 15:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .