I have a pcap file, and what I wanted to know is how can I apply the Snortrule below which I've already written within the rules folder in my log folder:

alert icmp any any -> any any (msg:"TCP Packet"; sid:477; rev:3;)

How can I execute this rule over the pcap file I have?


Supposing the rule is already in a Snort .rules file and snort.conf is configured to include the .rules with the rule to test...

$ snort -r foo.pcap


$ snort --pcap-single=foo.pcap



  • 1
    So don't i need to mention the rules file in the command? I tried this command it worked: snort -r cap.pcap -c rulefile.rules – Kulasangar Jan 28 '15 at 3:04
  • @Kulasangar: The -c is used to specify the config file (snort.conf) to use; the config needs to specify the .rules to include (include your.rules). – user1801810 Jan 29 '15 at 4:17
  • The pcaps must be saved as "modified tcpdump" or you will get the error can't initialize daq pcap (-1) – A Reu Dec 6 '19 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.