SNORT(8)

📦 version 2.9.20, in ubuntu jammy, ubuntu noble

💖 SNORT 💖 — System Manager's Manual (Snort(8))

okay bestie, sit down, hydrate, because we're about to read the manual page for Snort together and honestly? it's giving legend behavior. 🐷✨

🌸 NAME 🌸

Snort — open source network intrusion detection system

✨ SYNOPSIS ✨

snort [-bCdDeEfHIMNOpqQsTUvVwWxXy?] [-A alert-mode ] [-B address-
conversion-mask ] [-c rules-file ] [-F bpf-file ] [-g group-name ] [-G
id ] [-h home-net ] [-i interface ] [-k checksum-mode ] [-K logging-mode
] [-l log-dir ] [-L bin-log-file ] [-m umask ] [-n packet-count ] [-P
snap-length ] [-r tcpdump-file ] [-R name ] [-S variable=value ] [-t
chroot_directory ] [-u user-name ] [-Z pathname ] [--logid id ]
[--perfmon-file pathname ] [--pid-path pathname ] [--snaplen snap-length
] [--help ] [--version ] [--dynamic-engine-lib file ] [--dynamic-engine-
lib-dir directory ] [--dynamic-detection-lib file ] [--dynamic-
detection-lib-dir directory ] [--dump-dynamic-rules directory ]
[--dynamic-preprocessor-lib file ] [--dynamic-preprocessor-lib-dir
directory ] [--dynamic-output-lib file ] [--dynamic-output-lib-dir
directory ] [--alert-before-pass ] [--treat-drop-as-alert ] [--treat-
drop-as-ignore ] [--process-all-events ] [--enable-inline-test ]
[--create-pidfile ] [--nolock-pidfile ] [--no-interface-pidfile ]
[--disable-attribute-reload-thread ] [--pcap-single= tcpdump-file ]
[--pcap-filter= filter ] [--pcap-list= list ] [--pcap-dir= directory ]
[--pcap-file= file ] [--pcap-no-filter ] [--pcap-reset ] [--pcap-reload
] [--pcap-show ] [--exit-check count ] [--conf-error-out ] [--enable-
mpls-multicast ] [--enable-mpls-overlapping-ip ] [--max-mpls-labelchain-
len ] [--mpls-payload-type ] [--require-rule-sid ] [--daq type ] [--daq-
mode mode ] [--daq-var name=value ] [--daq-dir dir ] [--daq-list [dir] ]
[--dirty-pig ] [--cs-dir dir ] [--ha-peer ] [--ha-out file ] [--ha-in
file ] expression

like. that's a LOT of flags and we love that for us. 💅

🦋 DESCRIPTION 🦋

Snort is an open source network intrusion detection system, and no cap it can do real-time traffic analysis and packet logging on IP networks. it can perform protocol analysis, content searching/matching, and it can be used to detect a whole variety of attacks and probes — think buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much much more. it's giving main character energy on your network. 👑

Snort uses a flexible rules language to describe traffic that it should collect or pass, plus a detection engine that utilizes a modular plugin architecture. and it also has a modular real-time alerting capability, incorporating alerting and logging plugins for syslog, a ASCII text files, UNIX sockets or XML. obsessed. 🎀

Snort has three primary uses, bestie:

  • it can be a straight packet sniffer like tcpdump(1)
  • it can be a packet logger (useful for network traffic debugging, etc)
  • or it can be a full blown network intrusion detection system 🌈

Snort logs packets in tcpdump(1) binary format or in Snort's decoded ASCII format, into a hierarchy of logging directories that are named based on the IP address of the "foreign" host.

🌟 OPTIONS 🌟

  • -A alert-mode — Alert using the specified alert-mode. valid alert modes include fast, full, none, and unsock. fast writes alerts to the default "alert" file in a single-line, syslog style alert message. full writes the alert to the "alert" file with the full decoded header as well as the alert message. none turns off alerting. and unsock is an experimental mode that sends the alert information out over a UNIX socket to another process that attaches to that socket. 🧦
  • -b — Log packets in a tcpdump(1) formatted file. all packets are logged in their native binary state to a tcpdump formatted log file named with the snort start timestamp and "snort.log". this option results in much faster operation of the program, since it doesn't have to spend time in the packet binary->text converters. Snort can keep up pretty well with 100Mbps networks in -b mode. to choose an alternate name for the binary log file, use the -L switch. ⚡
  • -B address-conversion-mask — Convert all IP addresses in home-net to addresses specified by address-conversion-mask. used to obfuscate IP addresses within binary logs. specify home-net with the -h switch. Note: this is not the same as $HOME_NET. 🙈
  • -c config-file — Use the rules located in file config-file.
  • -C — Print the character data from the packet payload only (no hex).
  • -d — Dump the application layer data when displaying packets in verbose or packet logging mode.
  • -D — Run Snort in daemon mode. Alerts are sent to /var/log/snort/alert unless otherwise specified.
  • -e — Display/log the link layer packet headers.
  • -E — *WIN32 ONLY* Log alerts to the Windows Event Log.
  • -f — Activate PCAP line buffering
  • -F bpf-file — Read BPF filters from bpf-file. this is handy for people running Snort as a SHADOW replacement or with a love Of super complex BPF filters. see the "expressions" section of this man page for more info on writing BPF filters. 🫶
  • -g group — Change the group/GID Snort runs under to group after initialization. this switch allows Snort to drop root privileges after its initialization phase has completed, as a security measure. 🔒
  • -G id — Use id as a base event ID when logging events.
  • -h home-net — Set the "home network" to home-net. the format of this address variable is a network prefix plus a CIDR block, such as 192.168.1.0/24. once this variable is set, all decoded packet logging will be done relative to the home network address space. this is useful because of the way that Snort formats its ASCII log data. with this value set to the local network, all decoded output will be logged into decode directories with the address of the foreign computer as the directory name, which is very useful during traffic analysis. this option does not change $HOME_NET in IDS mode. 💫
  • -H — Force hash tables to be deterministic instead of using a random number generator for the seed & scale. useful for testing and generating repeatable results with the same traffic. 🎯
  • -i interface — Sniff packets on interface.
  • -I — Print out the receiving interface name in alerts.
  • -k checksum-mode — Tune the internal checksum verification functionality with checksum-mode. valid checksum modes include all, noip, notcp, noudp, noicmp, and none. all activates checksum verification for all supported protocols. noip turns off IP checksum verification, which is handy if the gateway router is already dropping packets that fail their IP checksum checks. notcp turns off TCP checksum verification, all other checksum modes are on. noudp turns off UDP checksum verification. noicmp turns off ICMP checksum verification. none turns off the entire checksum verification subsystem. 💀
  • -K logging-mode — Select a packet logging mode. the default is pcap. logging-mode. valid logging modes include pcap, ascii, and none. pcap logs packets through the pcap library into pcap (tcpdump) format. ascii logs packets in the old "directories and files" format with packet printouts in each file. none turns off packet logging.
  • -l log-dir — Set the output logging directory to log-dir. all plain text alerts and packet logs go into this directory. if this option is not specified, the default logging directory is set to /var/log/snort. 📂
  • -L binary-log-file — Set the filename of the binary log file to binary-log-file. if this switch is not used, the default name is a timestamp for the time that the file is created plus "snort.log".
  • -m umask — Set the file mode creation mask to umask
  • -M — Log console messages to syslog when not running daemon mode. using both -D and -M will send all messages to syslog including e.g. SIGUSR1 dump packet stats. this switch has no impact on logging of alerts.
  • -n packet-count — Process packet-count packets and exit.
  • -N — Turn off packet logging. the program still generates alerts normally.
  • -O — Obfuscate the IP addresses when in ASCII packet dump mode. this switch changes the IP addresses that get printed to the screen/log file to "xxx.xxx.xxx.xxx". if the homenet address switch is set (-h), only addresses on the homenet will be obfuscated while non-homenet IPs will be left visible. perfect for posting to your favorite security mailing list! 😌
  • -p — Turn off promiscuous mode sniffing.
  • -P snap-length — Set the packet snaplen to snap-length. by default, this is set to 1514. 📏
  • -q — Quiet operation. Don't display banner and initialization information. in daemon mode, banner and initialization information is not logged to syslog. 🤫
  • -Q — Enable inline mode operation.
  • -r tcpdump-file — Read the tcpdump-formatted file tcpdump-file. this will cause Snort to read and process the file fed to it. this is useful if, for instance, you've got a bunch of SHADOW files that you want to process for content, or even if you've got a bunch of reassembled packet fragments which have been written into a tcpdump formatted file. 🍓
  • -R name — Use name as a suffix to the snort pidfile.
  • -s — Send alert messages to syslog. on linux boxen, they will appear in /var/log/secure, /var/log/messages on many other platforms.
  • -S variable=value — Set variable name "variable" to value "value". this is useful for setting the value of a defined variable name in a Snort rules file to a command line specified value. for instance, if you define a HOME_NET variable name inside of a Snort rules file, you can set this value from it's predefined value at the command line. 💜
  • -t chroot — Changes Snort's root directory to chroot after initialization. please note that all log/alert filenames are relative to the chroot directory if chroot is used.
  • -T — Snort will start up in self-test mode, checking all the supplied command line switches and rules files that are handed to it and indicating that everything is ready to proceed. this is a good switch to use if daemon mode is going to be used, it verifies that the Snort configuration that is about to be used is valid and won't fail at run time. Note, Snort looks for either /etc/snort.conf or ./snort.conf. if your config lives elsewhere, use the -c option to specify a valid config-file. ✅
  • -u user — Change the user/UID Snort runs under to user after initialization.
  • -U — switches every timestamp in your logs over to UTC. timezone chaos? not on her watch 💅
  • -v — be verbose, bestie: it literally prints packets out to the console. but here's the tea — verbose mode is slow. like, if you're doing IDS work with Snort, do NOT use -v, because you WILL drop packets. no cap. 😭
  • -V — show the version number and dip. ✌️
  • -w — show management frames if you're running on an 802.11 (wireless) network. wifi girlies rise 🦋
  • -W — WIN32 ONLY — enumerate the network interfaces that are available. windows-only behavior, iykyk.
  • -x — exit if Snort configuration problems pop up, like duplicate gid/sid or flowbits without Stream5. it's giving "we don't do broken configs here." 💅
  • -X — dump the raw packet data starting all the way at the link layer. heads up: this switch overrides the -d switch. it ate and left no crumbs 🔥
  • -y — include the year in alert and log files. so your timestamps are giving full context, periodt.
  • -Z pathname — set the perfmonitor preprocessor path/filename to pathname. 📁
  • -? — show the program usage statement and exit. the classic "idk what to do" button 🫶
  • --logid id — same as -G.
  • --perfmon-file pathname — same as -Z.
  • --pid-path directory — specify the directory for the Snort PID file. 📍
  • --snaplen snap-length — same as -P.
  • --help — same as -?.
  • --version — same as -V.
  • --dynamic-engine-lib file — load a dynamic detection engine shared library specified by file. ✨
  • --dynamic-engine-lib-dir directory — load all the dynamic detection engine shared libraries specified from directory. the whole squad 🎀
  • --dynamic-detection-lib file — load a dynamic detection rules shared library specified by file.
  • --dynamic-detection-lib-dir directory — load all the dynamic detection rules shared libraries specified from directory.
  • --dump-dynamic-rules directory — create stub rule files from all the loaded dynamic detection rules libraries. the files get created in directory. > this is required to be done prior to running snort using those detection rules, and the generated rules files must be included in snort.conf. don't skip this step bestie, it's not optional 😤
  • --dynamic-preprocessor-lib file — load a dynamic preprocessor shared library specified by file.
  • --dynamic-preprocessor-lib-dir directory — load all the dynamic preprocessor shared libraries specified from directory.
  • --alert-before-pass — process alert, drop, sdrop, or reject before pass. the default, for the record, is pass before alert, drop, etc. so this flips the order. 🔄
  • --treat-drop-as-alert — converts drop, sdrop, and reject rules into alert rules during startup. glow-up for your drop rules 💅
  • --treat-drop-as-ignore — use drop, sdrop, and reject rules to ignore session traffic when not inline.
  • --process-all-events — process all triggered events in group order, per the Rule Ordering configuration. the default just stops after the first group. so this is the "finish the whole playlist" option 🎶
  • --enable-inline-test — enable Inline-Test Mode Operation. ✨
  • --pid-path directory — specify the path for Snort's PID file.
  • --create-pidfile — create the PID file, even when you're not in Daemon mode. 📝
  • --nolock-pidfile — do not try to lock the Snort PID file. living dangerously, we love that 🔓
  • --no-interface-pidfile — do not include the interface name in the Snort PID file.
  • --pcap-single=tcpdump-file — same as -r. added for completeness. they just wanted the whole set, slay.
  • --pcap-filter=filter — a shell style filter to apply when getting pcaps from a file or directory. this filter applies to any --pcap-file or --pcap-dir arguments that follow. use --pcap-no-filter to delete the filter for following --pcap-file or --pcap-dir arguments, or specify --pcap-filter again to forget the previous filter and apply to the following --pcap-file or --pcap-dir arguments. it's giving stateful filter vibes 🧚
  • --pcap-list="list" — a space separated list of pcaps to read. 📋
  • --pcap-dir=directory — a directory to recurse through looking for pcaps. sorted in ascii order. 🗂️
  • --pcap-file=file — a file that contains a list of pcaps to read. you can specify a path to a pcap or a directory to recurse to get pcaps.
  • --pcap-no-filter — reset to use no filter when getting pcaps from a file or directory.
  • --pcap-reset — if you're reading multiple pcaps, reset snort to the post-configuration state before reading the next pcap. the default (i.e. without this option) is to not reset state. 🧼
  • --pcap-show — print a line saying what pcap is currently being read. so you always know who's on aux 🎧
  • --exit-check=count — signal termination after count callbacks from DAQ_Acquire(), showing the time it takes from signaling until DAQ_Stop() is called. ⏱️
  • --conf-error-out — same as -x.
  • --require-rule-sid — require an SID for every rule to be correctly threshold all rules. no SID? no entry. 💅
  • --daq <type> — select the packet acquisition module (the default is pcap).
  • --daq-mode <mode> — select the DAQ operating mode.
  • --daq-var <name=value> — specify an extra DAQ configuration variable.
  • --daq-dir <dir> — tell Snort where to find the desired DAQ. 📍
  • --daq-list [<dir>] — list the packet acquisition modules available in dir.
  • --cs-dir <dir> — tell Snort to use the control socket and create the socket in dir. 🔌

🌈 expression 🌈

So this one selects which packets get dumped. If you don't give it any expression at all, literally all packets on the net will be dumped. but if you do give it one, then only the packets for which expression is true get dumped. simple as that, bestie. ✨

The expression is made up of one or more primitives. A primitive usually is an id (a name or number) preceded by one or more qualifiers. There are three different kinds of qualifier:

  • type — these qualifiers say what kind of thing the id name or number refers to. possible types are host, net and port. e.g., host foo, net 128.3, port 20. if there's no type qualifier, host is assumed.
  • dir — these qualifiers specify a particular transfer direction to and/or from id. possible directions are src, dst, src or dst and src and dst. e.g., src foo, dst net 128.3, src or dst port ftp-data. if there's no dir qualifier, src or dst is assumed. for null link layers (i.e. point to point protocols such as slip) the inbound and outbound qualifiers can be used to specify a desired direction. 🧭
  • proto — these qualifiers restrict the match to a particular protocol. possible protos are: ether, fddi, ip, arp, rarp, decnet, lat, sca, moprc, mopdl, tcp and udp. e.g., ether src foo, arp net 128.3, tcp port 21. if there's no proto qualifier, all protocols consistent with the type are assumed. e.g., src foo means (ip or arp or rarp) src foo (except the latter is not legal syntax), net bar means (ip or arp or rarp) net bar and port 53 means (tcp or udp) port 53.
[fddi is actually an alias for ether; the parser treats them identically as meaning ``the data link level used on the specified network interface.'' FDDI headers contain Ethernet-like source and destination addresses, and often contain Ethernet-like packet types, so you can filter on these FDDI fields just as with the analogous Ethernet fields. FDDI headers also contain other fields, but you cannot name them explicitly in a filter expression.]

On top of all that, there are some special primitive keywords that just don't follow the pattern: gateway, broadcast, less, greater and arithmetic expressions. all of these are described below. 👀

More complex filter expressions get built up by using the words and, or and not to combine primitives. e.g., host foo and not port ftp and not port ftp-data. to save typing, identical qualifier lists can be omitted. e.g., tcp dst port ftp or ftp-data or domain is exactly the same as tcp dst port ftp or tcp dst port ftp-data or tcp dst port domain. we love a shortcut 💅

The allowable primitives are:

  • dst host host — true if the IP destination field of the packet is host, which may be either an address or a name.
  • src host host — true if the IP source field of the packet is host.
  • host host — true if either the IP source or destination of the packet is host. any of the above host expressions can be prepended with the keywords, ip, arp, or rarp, as in:
ip host host

which is equivalent to:

ether proto \ip and host host

if host is a name with multiple IP addresses, each address will be checked for a match. 🔍

  • ether dst ehost — true if the ethernet destination address is ehost. ehost may be either a name from /etc/ethers or a number (see ethers(3N) for numeric format).
  • ether src ehost — true if the ethernet source address is ehost.
  • ether host ehost — true if either the ethernet source or destination address is ehost.
  • gateway host — true if the packet used host as a gateway. i.e., the ethernet source or destination address was host but neither the IP source nor the IP destination was host. host must be a name and must be found in both /etc/hosts and /etc/ethers. (an equivalent expression is:
ether host ehost and not host host

which can be used with either names or numbers for host / ehost.) 🚪

  • dst net net — true if the IP destination address of the packet has a network number of net. net may be either a name from /etc/networks or a network number (see networks(4) for details).
  • src net net — true if the IP source address of the packet has a network number of net.
  • net net — true if either the IP source or destination address of the packet has a network number of net.
  • net net mask mask — true if the IP address matches net with the specific netmask. may be qualified with src or dst.
  • net net/len — true if the IP address matches net a netmask len bits wide. may be qualified with src or dst. ✨
  • dst port port — true when the packet is ip/tcp or ip/udp and its destination port is port. That port can be a number OR a name from /etc/services (peep tcp(4P) and udp(4P) for the lore). If you use a name, both the port number AND the protocol get checked 💅. If you use a number or an ambiguous name, only the port number gets checked — like, dst port 513 will print both tcp/login traffic and udp/who traffic, and port domain will print both tcp/domain and udp/domain traffic. iykyk.
  • src port port — true when the packet has a source port value of port. same energy, other direction 🦋
  • port port — true when EITHER the source or destination port is port. And bestie, any of the port expressions above can be prepended with the keywords tcp or udp, like:
tcp src port port

which only matches tcp packets whose source port is port. slay.

  • less length — true when the packet length is less than or equal to length. literally the same as:
len <= length
  • greater length — true when the packet length is greater than or equal to length. equivalent to:
len >= length
  • ip proto protocol — true when the packet is an ip packet (see ip(4P)) of protocol type protocol. Protocol can be a number, or one of the names icmp, igrp, udp, nd, or tcp. ⚠️ Heads up: the identifiers tcp, udp, and icmp are ALSO keywords, so you have to escape them with a backslash (\) — and that's \\ if you're in the C-shell. no cap.
  • ether broadcast — true when the packet is an ethernet broadcast packet. the ether keyword is optional ✨
  • ip broadcast — true when the packet is an IP broadcast packet. it checks for BOTH the all-zeroes and all-ones broadcast conventions, and it looks up the local subnet mask. thorough queen 👑
  • ether multicast — true when the packet is an ethernet multicast packet. the ether keyword is optional. this is just shorthand for ether[0] & 1 != 0. periodt.
  • ip multicast — true when the packet is an IP multicast packet.
  • ether proto protocol — true when the packet is of ether type protocol. Protocol can be a number or a name like ip, arp, or rarp. 📌 note: these identifiers are also keywords and must be escaped via backslash (\). [In the case of FDDI (e.g., fddi protocol arp), the protocol identification comes from the 802.2 Logical Link Control (LLC) header, which is usually layered on top of the FDDI header. Tcpdump assumes, when filtering on the protocol identifier, that all FDDI packets include an LLC header, and that the LLC header is in so-called SNAP format.]
  • decnet src host — true when the DECNET source address is host, which can be an address like ``10.123'' or a DECNET host name. [DECNET host name support only exists on Ultrix systems that are configured to run DECNET. vintage fr fr 🕰️]
  • decnet dst host — true when the DECNET destination address is host.
  • decnet host host — true when EITHER the DECNET source or destination address is host.
  • ip, arp, rarp, decnet — abbreviations for:
ether proto p

where p is one of the protocols above. ✨

  • lat, moprc, mopdl — also abbreviations for:
ether proto p

where p is one of the protocols above. but heads up: Snort does not currently know how to parse these protocols. it's giving "not on the menu" 💀

  • tcp, udp, icmp — abbreviations for:
ip proto p

where p is one of the protocols above.

  • expr relop expr — true when the relation holds, where relop is one of >, <, >=, <=, =, !=, and expr is an arithmetic expression built from integer constants (written in standard C syntax), the normal binary operators [+, -, *, /, &, |], a length operator, and special packet data accessors. 🧚 To reach inside the packet, use this syntax:
proto [ expr : size ]

Proto is one of ether, fddi, ip, arp, rarp, tcp, udp, or icmp, and it says which protocol layer the index operation is relative to. The byte offset, relative to that indicated protocol layer, is given by expr. Size is optional and says how many bytes are in the field of interest — it can be one, two, or four, and it defaults to one. The length operator, spelled with the keyword len, gives the length of the packet. 🌈

For example, ether[0] & 1 != 0 catches all multicast traffic. The expression ip[0] & 0xf != 5 catches all IP packets with options. The expression ip[6:2] & 0x1fff = 0 catches only unfragmented datagrams and frag zero of fragmented datagrams. This check is implicitly applied to the tcp and udp index operations. For instance, tcp[0] ALWAYS means the first byte of the TCP header, and never means the first byte of an intervening fragment. 💯

Primitives may be combined using:

  • A parenthesized group of primitives and operators (parentheses are special to the Shell and must be escaped).
  • Negation (! or not).
  • Concatenation (&& or and).
  • Alternation (|| or or).

Negation has the highest precedence. Alternation and concatenation have EQUAL precedence and associate left to right. And note that explicit and tokens, not juxtaposition, are now required for concatenation. 👀

If an identifier is given without a keyword, the most recent keyword is assumed. For example,

not host vs and ace

is short for

not host vs and host ace

which should NOT be confused with

not ( host vs or ace )

Expression arguments can be passed to Snort as either a single argument or as multiple arguments, whichever is more convenient. Generally, if the expression contains Shell metacharacters, it's easier to pass it as a single, quoted argument. Multiple arguments get concatenated with spaces before being parsed. 💅

✨ READING PCAPS ✨

Instead of making Snort listen on an interface, you can just hand it a packet capture to read. 🎀 Snort will read and analyze the packets as if they came off the wire. This is highkey useful for testing and debugging Snort.

Read a single pcap

$ snort -r foo.pcap
$ snort --pcap-single=foo.pcap

Read pcaps from a file

$ cat foo.txt
foo1.pcap
foo2.pcap
/home/foo/pcaps

$ snort --pcap-file=foo.txt

This will read foo1.pcap, foo2.pcap and all files under /home/foo/pcaps. ⚠️ Note that Snort will not try to determine whether the files under that directory are really pcap files or not. it trusts you. iconic.

Read pcaps from a command line list

$ snort --pcap-list="foo1.pcap foo2.pcap foo3.pcap"

This will read foo1.pcap, foo2.pcap and foo3.pcap. ✨

Read pcaps under a directory

$ snort --pcap-dir="/home/foo/pcaps"

This will include all of the files under /home/foo/pcaps. 🦋

Using filters

$ cat foo.txt
foo1.pcap
foo2.pcap
/home/foo/pcaps

$ snort --pcap-filter="*.pcap" --pcap-file=foo.txt
$ snort --pcap-filter="*.pcap" --pcap-dir=/home/foo/pcaps

The above will only include files that match the shell pattern "*.pcap" — in other words, any file ending in ".pcap". 🌸

$ snort --pcap-filter="*.pcap --pcap-file=foo.txt \
> --pcap-filter="*.cap" --pcap-dir=/home/foo/pcaps

In the above, the first filter "*.pcap" will only be applied to the pcaps in the file "foo.txt" (and any directories that are recursed in that file). The addition of the second filter "*.cap" will cause the first filter to be forgotten and then applied to the directory /home/foo/pcaps, so only files ending in ".cap" will be included from that directory. 💅

$ snort --pcap-filter="*.pcap --pcap-file=foo.txt \
> --pcap-no-filter --pcap-dir=/home/foo/pcaps

In this example, the first filter will be applied to foo.txt, then no filter will be applied to the files found under /home/foo/pcaps, so ALL files found under /home/foo/pcaps will be included. 🔥

$ snort --pcap-filter="*.pcap --pcap-file=foo.txt \
> --pcap-no-filter --pcap-dir=/home/foo/pcaps \
> --pcap-filter="*.cap" --pcap-dir=/home/foo/pcaps2

In this example, the first filter will be applied to foo.txt, then no filter will be applied to the files found under /home/foo/pcaps, so all files found under /home/foo/pcaps will be included, then the filter "*.cap" will be applied to files found under /home/foo/pcaps2. ✨

Resetting state

$ snort --pcap-dir=/home/foo/pcaps --pcap-reset

The above example will read all of the files under /home/foo/pcaps, but after each pcap is read, Snort will be reset to a post-configuration state — meaning all buffers will be flushed, statistics reset, etc. For each pcap, it will be like Snort is seeing traffic for the first time. main character energy, every single time 👑

Printing the pcap

$ snort --pcap-dir=/home/foo/pcaps --pcap-show

The above example will read all of the files under /home/foo/pcaps and will print a line indicating which pcap is currently being read. so you always know what's on screen 🎀

✨ RULES ✨

Snort uses a simple but flexible rules language to describe network packet signatures and associate them with actions. 🦋 The current rules document can be found at http://www.snort.org/snort-rules. go read it bestie, it's giving essential 💖

💅 NOTES 💅

okay so this is the part where we talk about signals, because snort is a daemon and daemons love getting messages from kill(1). here's what each one does when you send it to the daemon process, no cap:

  • SIGHUP — makes the daemon close all its opened files and restart. ✨ BUT bestie, listen: this only works if you used the full pathname to invoke snort in daemon mode. otherwise snort just straight up exits and sends an error message to syslogd(8). it's giving "I tried my best" 😭
  • SIGUSR1 — tells the program to dump its current packet statistical info to the console, or to syslogd(8) if it's in daemon mode. receipts! 🧾
  • SIGUSR2 — tells the program to rotate Perfmonitor statistical info to the console, or to syslogd(8) if it's in daemon mode. spin that wheel 🎡
  • SIGURG — makes the program reload the attribute table. refreshed and reborn 💅
  • SIGCHLD — used internally. it's a private matter, mind your business 🙈

please refer to the manual for more details. any other signal might cause the daemon to close all opened files and exit. so like. be careful which buttons you press, okay? 🫶

🎀 CONFIGURATION 🎀

in Debian there's a whole several ways situation going on for configuring Snort. let's break it down:

  • the config file /etc/snort/snort.conf is the main character here — it configures the software itself, and you can customise it however you want. it's yours, decorate it 💖
  • on systems with multiple interfaces, you can run a different Snort instance per network interface, and tune the config for one specific interface using /etc/snort/snort.INTERFACE.conf (where INTERFACE gets swapped out for the actual interface name). slay per-interface customisation 🌈
  • there are also extra config files hanging out in /etc/snort that modify Snort's behaviour. these include: attribute_table.dtd, file_magic.conf, threshold.conf and unicode.map. the squad ✨

on top of all that, Debian ships its own special config file to manage Snort's startup: /etc/snort/snort.debian.conf. this one gets modified by the packaging system using debconf, and it defines:

  • whether Snort starts up on system boot or manually
  • specific options for the Snort daemon when it's started
  • the values used by the snort-stat cron script (if it's enabled)

and finally — the grand finale — /etc/default/snort defines parameters that apply to the Snort startup (init.d) script. those include:

  • daemon startup parameters
  • the user and group Snort will run as
  • the log directory
  • whether to run Snort when the interfaces to be monitored are not available
it's giving layered config cake. every layer matters, don't skip one 🍰

📓 LOGS AND ALERTS 📓

in Debian, your Snort logs live under /var/log/snort/ and they include /var/log/snort/snort.log, /var/log/snort/snort.alert and /var/log/snort/snort.alert.fast. three icons, three vibes 💅

the first two logs are saved in unified format, which you can read with the u2spewfoo tool. for more info, read /usr/share/doc/snort/README.unified2, which comes from the snort-doc package. 📖

the log files in unified2 format can also be converted into other formats (currently only pcap is supported) using the u2boat tool. cute little converter 🛶

the last log file (snort.alert.fast) is a one line format that provides fast alerts. these alerts get read by snort-stat and emailed to a designated administrator — if that's enabled in the Debian package configuration. no email subscription, no drama 🍓

you can adjust where the log directory points by configuring the LOGDIR parameter in the /etc/default/snort configuration file. move it wherever, bestie 🚚

quick breakdown of who does what:

  • /var/log/snort/snort.log contains the packets logged
  • /var/log/snort/snort.alert contains only the alerts generated

and in addition to all of that, all alerts are logged into syslog using LOG_AUTH and LOG_ALERT. double logging, double the receipts 🗂️

the logging and alerting mode can be modified by configuring the /etc/snort/snort.conf file. your house, your rules 🏠

👑 HISTORY 👑

Snort has been freely available under the GPL license since 1998. that's not a phase, that's a legacy. iconic behavior, honestly 🫡

🔍 DIAGNOSTICS 🔍

Snort returns a 0 on a successful exit, and 1 if it exits on an error. short, simple, zero ambiguity. we love a decisive queen ✨

💀 BUGS 💀

okay so first things first: consult the BUGS file included with the source distribution — on Debian systems that's at /usr/share/doc/BUGS — and also check the Debian-specific bugs published at:

https://bugs.debian.org/cgi-bin/pkgreport.cgi?package=snort

after that, please send bug reports to Debian using the reportbug program. for more info about reporting bugs in Debian, read:

https://www.debian.org/Bugs/Reporting

and if you believe the bug actually lies with the upstream package, then send your bug reports directly to:

snort-devel@lists.snort.org

go straight to the source, bestie, they'll know what's up 📨

🌸 AUTHOR 🌸

the main author of Snort is Martin Roesch <roesch@snort.org>. 👑

in addition, many people have contributed to Snort development — for the full list please read /usr/share/doc/snort/CREDITS.gz. everyone say thank you to the contributors 🫶

this Debian package was created by:

  • Christian Hammers <ch@debian.org> (from 1999 to 2001)
  • Robert van der Meulen <rvdm@debian.org> (2001 to 2002)
  • Sander Smeenk <ssmeenk@debian.org> (2002 to 2004)
  • Javier Fernández-Sanguino <jfs@debian.org> (2004 to 2020)

it includes contributions from many different Debian developers and users, and all of them are credited in the Debian changelog file, which you can find at /usr/share/doc/snort/changelog.Debian.gz and /usr/share/doc/snort/copyright. legends, all of them 🌈

🦋 SEE ALSO 🦋

go read those too, iykyk 📚

and that's the whole page, bestie!! 💖 this one's dated December 2011 and it's section SNORT(8) — you made it to the end of the man page, which is honestly main character energy. go forth and sniff responsibly 🌸✨👑

📦 where this page comes from