3

I'm using SecurityOnion distro and I would to run snort on my pcap files. Is there a way to specify just one rule? I couldn't understand whether local.rules is used.

How can I show only the result of my rules instead of standard output?

1

Are you trying to have Snort display only the result of your own custom rules created in local.rules?

Why not create one such as an example below in local.rules, move all the other existing rules to someplace else leaving only the local.rules for testing? That way, only your local.rules will be checked against.

alert tcp any any -> any any (msg:"Testing TCP"; sid:10002)

When you run Snort in IDS mode, it will show up below alerts whenever there is any TCP traffic is happening.

screenshot

Hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.