Lab 3-execute Snort
Execute Snort from command line, as mentioned following. This activates Snort so it can start protecting your system:
# snort -c /etc/snort/snort.conf -l /var/log/snort/

Here, -c
for rules file and -l
for log directory.
Show log alert
The following is the example of a Snort alert for this ICMP rule:
root@vishnu:~# head /var/log/snort/alert [**] [1:2925:3] INFO web bug 0x0 gif attempt [**] [Classification: Misc activity] [Priority: 3] 12/02-17:08:40.479756 107.20.221.156:80 -> 192.168.1.64:55747 TCP TTL:42 TOS:0x0 ID:14611 IpLen:20 DgmLen:265 DF ***AP*** Seq: 0x6C1242F9 Ack: 0x74B1A5FE Win: 0x2E TcpLen: 32 TCP Options (3) => NOP NOP TS: 1050377198 1186998 [**] [1:368:6] ICMP PING BSDtype [**] [Classification: Misc activity] [Priority: 3] 12/02-17:09:01.112440 192.168.1.14 -> 192.168.1.64
Alert explanation
A couple of lines are added for each alert, which includes the following:
- Message is printed in the first line
- Source IP
- Destination IP
- Type of packet, and header information...