Snort mailing list archives
Re: Testing my own rules/signatures on pcap file
From: "Joel Esler (jesler)" <jesler () cisco com>
Date: Mon, 23 Dec 2013 00:25:37 +0000
This belongs on the users list. Look into the -c command. -- Joel Esler Intelligence Lead Open Source Manager Vulnerability Research Team Sent from my iPhone. On Dec 22, 2013, at 12:53, "Beenish Raza" <beenish.raza () hotmail com<mailto:beenish.raza () hotmail com>> wrote: I have a set of rules in a text file and I want to check if the given pcap file contains any signatures/rules from those text file of rules. I have run this command to use pcap file snort -r trace.pcap but how do I specifiy the rules file which I want to use? Secondly, is there any way that I can generate a pcap file from a given ruleset? ------------------------------------------------------------------------------ Rapidly troubleshoot problems before they affect your business. Most IT organizations don't have a clear picture of how application performance affects their revenue. With AppDynamics, you get 100% visibility into your Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro! http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk _______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net<mailto:Snort-devel () lists sourceforge net> https://lists.sourceforge.net/lists/listinfo/snort-devel Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel Please visit http://blog.snort.org for the latest news about Snort!
------------------------------------------------------------------------------ Rapidly troubleshoot problems before they affect your business. Most IT organizations don't have a clear picture of how application performance affects their revenue. With AppDynamics, you get 100% visibility into your Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro! http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk
_______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Testing my own rules/signatures on pcap file Beenish Raza (Dec 22)
- Re: Testing my own rules/signatures on pcap file Joel Esler (jesler) (Dec 22)
- Re: [Snort-devel] Testing my own rules/signatures on pcap file guillaume . daleux (Dec 22)
- Re: [Snort-devel] Testing my own rules/signatures on pcap file Beenish Raza (Dec 30)
- Re: [Snort-devel] Testing my own rules/signatures on pcap file guillaume . daleux (Dec 22)
- Re: Testing my own rules/signatures on pcap file Joel Esler (jesler) (Dec 22)