Snort mailing list archives
Testing my own rules/signatures on pcap file
From: Beenish Raza <beenish.raza () hotmail com>
Date: Sun, 22 Dec 2013 22:50:29 +0500
I have a set of rules in a text file and I want to check if the given pcap file contains any signatures/rules from those text file of rules. I have run this command to use pcap file snort -r trace.pcap but how do I specifiy the rules file which I want to use? Secondly, is there any way that I can generate a pcap file from a given ruleset?
------------------------------------------------------------------------------ Rapidly troubleshoot problems before they affect your business. Most IT organizations don't have a clear picture of how application performance affects their revenue. With AppDynamics, you get 100% visibility into your Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro! http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk
_______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Testing my own rules/signatures on pcap file Beenish Raza (Dec 22)
- Re: Testing my own rules/signatures on pcap file Joel Esler (jesler) (Dec 22)
- Re: [Snort-devel] Testing my own rules/signatures on pcap file guillaume . daleux (Dec 22)
- Re: [Snort-devel] Testing my own rules/signatures on pcap file Beenish Raza (Dec 30)
- Re: [Snort-devel] Testing my own rules/signatures on pcap file guillaume . daleux (Dec 22)
- Re: Testing my own rules/signatures on pcap file Joel Esler (jesler) (Dec 22)