Execute Snort from command line, as mentioned following. This activates Snort so it can start protecting your system:
# snort -c /etc/snort/snort.conf -l /var/log/snort/
Here, -c for rules file and -l for log directory.
Execute Snort from command line, as mentioned following. This activates Snort so it can start protecting your system:
# snort -c /etc/snort/snort.conf -l /var/log/snort/
Here, -c for rules file and -l for log directory.
The following is the example of a Snort alert for this ICMP rule:
root@vishnu:~# head /var/log/snort/alert [**] [1:2925:3] INFO web bug 0x0 gif attempt [**] [Classification: Misc activity] [Priority: 3] 12/02-17:08:40.479756 107.20.221.156:80 -> 192.168.1.64:55747 TCP TTL:42 TOS:0x0 ID:14611 IpLen:20 DgmLen:265 DF ***AP*** Seq: 0x6C1242F9 Ack: 0x74B1A5FE Win: 0x2E TcpLen: 32 TCP Options (3) => NOP NOP TS: 1050377198 1186998 [**] [1:368:6] ICMP PING BSDtype [**] [Classification: Misc activity] [Priority...