Snort mailing list archives

Re: Testing my own rules/signatures on pcap file

From: "Joel Esler (jesler)" <jesler () cisco com>
Date: Mon, 23 Dec 2013 00:25:37 +0000

This belongs on the users list.

Look into the -c command.

--
Joel Esler
Intelligence Lead
Open Source Manager
Vulnerability Research Team

Sent from my iPhone.

On Dec 22, 2013, at 12:53, "Beenish Raza" <beenish.raza () hotmail com<mailto:beenish.raza () hotmail com>> wrote:

I have a set of rules in a text file and I want to check if the given pcap file contains any signatures/rules from 
those text file of rules.

I have run this command to use pcap file

snort -r    trace.pcap

but how do I specifiy the rules file which I want to use?

Secondly, is there any way that I can generate a pcap file from a given ruleset?


------------------------------------------------------------------------------
Rapidly troubleshoot problems before they affect your business. Most IT
organizations don't have a clear picture of how application performance
affects their revenue. With AppDynamics, you get 100% visibility into your
Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro!
http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk
_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net<mailto:Snort-devel () lists sourceforge net>
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!

------------------------------------------------------------------------------
Rapidly troubleshoot problems before they affect your business. Most IT 
organizations don't have a clear picture of how application performance 
affects their revenue. With AppDynamics, you get 100% visibility into your 
Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro!
http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!

Current thread:

Testing my own rules/signatures on pcap file Beenish Raza (Dec 22)
- Re: Testing my own rules/signatures on pcap file Joel Esler (jesler) (Dec 22)
  - Re: [Snort-devel] Testing my own rules/signatures on pcap file guillaume . daleux (Dec 22)
    - Re: [Snort-devel] Testing my own rules/signatures on pcap file Beenish Raza (Dec 30)