Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hi im trying to use snort as an IDS on some pcap files I have, I was hoping I would get a log of any intrusions. I know for a fact that there is port scans and ping sweeps etc in the pcap files but when I try this command:

C:\Snort\bin> snort -r c:\snort\log\trace_part01.pcap -l c:\snort\log -c c:\snort\etc\snort.conf -K ascii

Nothing happens, I can log the the data like so:

snort -r c:\snort\log\trace_part01.pcap -l c:\snort\log -K ascii

Which structures all the files in there relevant ip folders and they have .ids as an extension.

Im new to using snort so not quite sure how I can just detect what intrusions are in the pcap files and output them in a file.

share|improve this question

migrated from Jul 18 '12 at 10:04

This question came from our site for professional and enthusiast programmers.

Belongs on serverfault – NotMe Jul 18 '12 at 0:20
Can anyone migrate? – Garrith Graham Jul 18 '12 at 1:14

I suspect that the issue is with your snort.conf file.

Have you got the following line

include $PREPROC_RULE_PATH/preprocessor.rules

uncommented? If not, uncomment the rule to enable it and try again forcing Snort to re-read the configuration file.

You may also need to ensure the following line in snort.conf is set to high but I'm not 100% sure that it'd be necessary -

preprocessor sfportscan: proto { all } memcap { 1000000 } sense_level { high } scan_type { all }
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.