Snort mailing list archives

Testing my own rules/signatures on pcap file


From: Beenish Raza <beenish.raza () hotmail com>
Date: Sun, 22 Dec 2013 22:50:29 +0500

I have a set of rules in a text file and I want to check if the given pcap file contains any signatures/rules from 
those text file of rules.
I have run this command to use pcap file
snort -r    trace.pcap
but how do I specifiy the rules file which I want to use?
Secondly, is there any way that I can generate a pcap file from a given ruleset?


                                          
------------------------------------------------------------------------------
Rapidly troubleshoot problems before they affect your business. Most IT 
organizations don't have a clear picture of how application performance 
affects their revenue. With AppDynamics, you get 100% visibility into your 
Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro!
http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk
_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!

Current thread: