How to debugging on Snort?

İzzettin Erdem via Snort-devel <[email protected]> Fri, 18 May 2018 05:10:00 +0300

Newsgroups	gmane.comp.security.ids.snort.devel
Message-ID	<CAN_SLJV_miLD6bvW07UnYH9JSBiOLEgeDx_+G2nPMyaXY9zayg@mail.gmail.com>

Hello Everyone ,

I want to debug Snort but I didn't find something help me. Actually I want
to learn that: Packets come in to network and Snort catches them. After
that, Snort checks packets by rules. How can I see what Snort checks at a
time and output of this check process?

Example check process for packet P1;

Searching for :
   content:"sa"
   offset:5
depth:10

output -> found or 1

continue to check packet p1:

content: "|02|"
offset: 33
depth: 45
.
.
.

output -> not found or 0

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!