NAME

SYNOPSIS

DESCRIPTION

Snort has three primary uses. It can be used as a straight packet sniffer like tcpdump(1), a packet logger (useful for network traffic debugging, etc), or as a full blown network intrusion detection system.

Snort logs packets in tcpdump(1) binary format or in Snort's decoded ASCII format to a hierarchy of logging directories that are named based on the IP address of the "foreign" host.

OPTIONS

-A alert-mode

Alert using the specified alert-mode. Valid alert modes include fast, full, none, and unsock. Fast writes alerts to the default "alert" file in a single-line, syslog style alert message. Full writes the alert to the "alert" file with the full decoded header as well as the alert message. None turns off alerting. Unsock is an experimental mode that sends the alert information out over a UNIX socket to another process that attaches to that socket.

-b

Log packets in a tcpdump(1) formatted file. All packets are logged in their native binary state to a tcpdump formatted log file named with the snort start timestamp and "snort.log". This option results in much faster operation of the program since it doesn't have to spend time in the packet binary->text converters. Snort can keep up pretty well with 100Mbps networks in '-b' mode. To choose an alternate name for the binary log file, use the '-L' switch.

-B address-conversion-mask

Convert all IP addresses in home-net to addresses specified by address-conversion-mask. Used to obfuscate IP addresses within binary logs. Specify home-net with the '-h' switch. Note this is not the same as $HOME_NET.

-c config-file

Use the rules located in file config-file.

-C

Print the character data from the packet payload only (no hex).

-d

Dump the application layer data when displaying packets in verbose or packet logging mode.

-D

Run Snort in daemon mode. Alerts are sent to /var/log/snort/alert unless otherwise specified.

-e

Display/log the link layer packet headers.

-E

*WIN32 ONLY* Log alerts to the Windows Event Log.

-f

Activate PCAP line buffering

-F bpf-file

Read BPF filters from bpf-file. This is handy for people running Snort as a SHADOW replacement or with a love Of super complex BPF filters. See the "expressions" section of this man page for more info on writing BPF filters.

-g group

Change the group/GID Snort runs under to group after initialization. This switch allows Snort to drop root privileges after it's initialization phase has completed as a security measure.

-G id

Use id as a base event ID when logging events.

-h home-net

Set the "home network" to home-net. The format of this address variable is a network prefix plus a CIDR block, such as 192.168.1.0/24. Once this variable is set, all decoded packet logging will be done relative to the home network address space. This is useful because of the way that Snort formats its ASCII log data. With this value set to the local network, all decoded output will be logged into decode directories with the address of the foreign computer as the directory name, which is very useful during traffic analysis. This option does not change "$HOME_NET" in IDS mode.

-H

Force hash tables to be deterministic instead of using a random number generator for the seed & scale. Useful for testing and generating repeatable results with the same traffic.

-i interface

Sniff packets on interface.

-I

Print out the receiving interface name in alerts.

-k checksum-mode

Tune the internal checksum verification functionality with alert-mode. Valid checksum modes include all, noip, notcp, noudp, noicmp, and none. All activates checksum verification for all supported protocols. Noip turns off IP checksum verification, which is handy if the gateway router is already dropping packets that fail their IP checksum checks. Notcp turns off TCP checksum verification, all other checksum modes are on. noudp turns off UDP checksum verification. Noicmp turns off ICMP checksum verification. None turns off the entire checksum verification subsystem.

-K logging-mode

Select a packet logging mode. The default is pcap. logging-mode. Valid logging modes include pcap, ascii, and none. Pcap logs packets through the pcap library into pcap (tcpdump) format. Ascii logs packets in the old "directories and files" format with packet printouts in each file. None Turns off packet logging.

-l log-dir

Set the output logging directory to log-dir. All plain text alerts and packet logs go into this directory. If this option is not specified, the default logging directory is set to /var/log/snort.

-L binary-log-file

Set the filename of the binary log file to binary-log-file. If this switch is not used, the default name is a timestamp for the time that the file is created plus "snort.log".

-m umask

Set the file mode creation mask to umask

-M

Log console messages to syslog when not running daemon mode. Using both -D and -M will send all messages to syslog including e.g. SIGUSR1 dump packet stats. This switch has no impact on logging of alerts.

-n packet-count

Process packet-count packets and exit.

-N

Turn off packet logging. The program still generates alerts normally.

-O

Obfuscate the IP addresses when in ASCII packet dump mode. This switch changes the IP addresses that get printed to the screen/log file to "xxx.xxx.xxx.xxx". If the homenet address switch is set (-h), only addresses on the homenet will be obfuscated while non- homenet IPs will be left visible. Perfect for posting to your favorite security mailing list!

-p

Turn off promiscuous mode sniffing.

-P snap-length

Set the packet snaplen to snap-length. By default, this is set to 1514.

-q

Quiet operation. Don't display banner and initialization information. In daemon mode, banner and initialization information is not logged to syslog.

-Q

Enable inline mode operation.

-r tcpdump-file

Read the tcpdump-formatted file tcpdump-file. This will cause Snort to read and process the file fed to it. This is useful if, for instance, you've got a bunch of SHADOW files that you want to process for content, or even if you've got a bunch of reassembled packet fragments which have been written into a tcpdump formatted file.

-R name

Use name as a suffix to the snort pidfile.

-s

Send alert messages to syslog. On linux boxen, they will appear in /var/log/secure, /var/log/messages on many other platforms.

-S variable=value

Set variable name "variable" to value "value". This is useful for setting the value of a defined variable name in a Snort rules file to a command line specified value. For instance, if you define a HOME_NET variable name inside of a Snort rules file, you can set this value from it's predefined value at the command line.

-t chroot

Changes Snort's root directory to chroot after initialization. Please note that all log/alert filenames are relative to the chroot directory if chroot is used.

-T

Snort will start up in self-test mode, checking all the supplied command line switches and rules files that are handed to it and indicating that everything is ready to proceed. This is a good switch to use if daemon mode is going to be used, it verifies that the Snort configuration that is about to be used is valid and won't fail at run time. Note, Snort looks for either /usr/local/etc/snort/snort.conf or ./snort.conf. If your config lives elsewhere, use the -c option to specify a valid config-file.

-u user

Change the user/UID Snort runs under to user after initialization.

-U

Changes the timestamp in all logs to be in UTC

-v

Be verbose. Prints packets out to the console. There is one big problem with verbose mode: it's slow. If you are doing IDS work with Snort, don't use the '-v' switch, you WILL drop packets.

-V

Show the version number and exit.

-w

Show management frames if running on an 802.11 (wireless) network.

-W

*WIN32 ONLY* Enumerate the network interfaces available.

-x

Exit if Snort configuration problems occur such as duplicate gid/sid or flowbits without Stream5.

-X

Dump the raw packet data starting at the link layer. This switch overrides the '-d' switch.

-y

Include the year in alert and log files

-Z pathname

Set the perfmonitor preprocessor path/filename to pathname.

-?

Show the program usage statement and exit.

--logid id

Same as -G.

--perfmon-file pathname

Same as -Z.

--pid-path directory

Specify the directory for the Snort PID file.

--snaplen snap-length

Same as -P.

--help

Same as -?

--version

Same as -V

--dynamic-engine-lib file

Load a dynamic detection engine shared library specified by file.

--dynamic-engine-lib-dir directory

Load all dynamic detection engine shared libraries specified from directory.

--dynamic-detection-lib file

Load a dynamic detection rules shared library specified by file.

--dynamic-detection-lib-dir directory

Load all dynamic detection rules shared libraries specified from directory.

--dump-dynamic-rules directory

Create stub rule files from all loaded dynamic detection rules libraries. Files will be created in directory. This is required to be done prior to running snort using those detection rules and the generated rules files must be included in snort.conf.

--dynamic-preprocessor-lib file

Load a dynamic preprocessor shared library specified by file.

--dynamic-preprocessor-lib-dir directory

Load all dynamic preprocessor shared libraries specified from directory.

--alert-before-pass

Process alert, drop, sdrop, or reject before pass. Default is pass before alert, drop, etc.

--treat-drop-as-alert

Converts drop, sdrop, and reject rules into alert rules during startup.

--treat-drop-as-ignore

Use drop, sdrop, and reject rules to ignore session traffic when not inline.

--process-all-events

Process all triggered events in group order, per Rule Ordering configuration. Default stops after first group.

--enable-inline-test

Enable Inline-Test Mode Operation.

--pid-path directory

Specify the path for Snort's PID file.

--create-pidfile

Create PID file, even when not in Daemon mode.

--nolock-pidfile

Do not try to lock Snort PID file.

--no-interface-pidfile

Do not include the interface name in Snort PID file

--pcap-single=tcpdump-file

Same as -r. Added for completeness.

--pcap-filter=filter

Shell style filter to apply when getting pcaps from file or directory. This filter will apply to any --pcap-file or --pcap-dir arguments following. Use --pcap-no-filter to delete filter for following --pcap-file or --pcap-dir arguments or specify --pcap-filter again to forget previous filter and to apply to following --pcap-file or --pcap-dir arguments.

--pcap-list="list"

A space separated list of pcaps to read.

--pcap-dir=directory

A directory to recurse to look for pcaps. Sorted in ascii order.

--pcap-file=file

File that contains a list of pcaps to read. Can specify path to pcap or directory to recurse to get pcaps.

--pcap-no-filter

Reset to use no filter when getting pcaps from file or directory.

--pcap-reset

If reading multiple pcaps, reset snort to post-configuration state before reading next pcap. The default, i.e. without this option, is not to reset state.

--pcap-show

Print a line saying what pcap is currently being read.

--exit-check=count

Signal termination after <count> callbacks from DAQ_Acquire(), showing the time it takes from signaling until DAQ_Stop() is called.

--conf-error-out

Same as -x.

--require-rule-sid

Require an SID for every rule to be correctly threshold all rules.

--daq <type>

Select packet acquisition module (default is pcap).

--daq-mode <mode>

Select the DAQ operating mode.

--daq-var <name=value>

Specify extra DAQ configuration variable.

--daq-dir <dir>

Tell Snort where to find desired DAQ.

--daq-list [<dir>]

List packet acquisition modules available in dir.

--cs-dir <dir>

Tell Snort to use control socket and create the socket in dir.

expression

not host vs and ace

not host vs and host ace

not ( host vs or ace )

READING PCAPS

Read a single pcap

RULES

NOTES

SIGHUP

Causes the daemon to close all opened files and restart. Please note that this will only work if the full pathname is used to invoke snort in daemon mode, otherwise snort will just exit with an error message being sent to syslogd(8).

SIGUSR1

Causes the program to dump its current packet statistical information to the console or syslogd(8) if in daemon mode.

SIGUSR2

Causes the program to rotate Perfmonitor statistical information to the console or syslogd(8) if in daemon mode.

SIGURG

Causes the program to reload attribute table.

SIGCHLD

Used internally.

Please refer to manual for more details. Any other signal might cause the daemon to close all opened files and exit.

HISTORY

DIAGNOSTICS

BUGS

AUTHOR

SEE ALSO