Search code examples
ipsnort

how to know ip address of packets which matched by content option in snort?

i am using snort-2.9.7.0 and i inspect packet by this simple code:
alert tcp any any -> $HOME_NET any (msg:"FB found in packet content!!!"; content:"FB"; sid:10000; ) i want to know where packet is comes from and store it. guide me.
Thanks and Regards.

Solution

  • You should adjust the output format of the alerts; to do that add this line in your config file:

    output alert_fast: <full path to output file>/snort.log

    as you here this will print Snort alert messages with full packet headers that contains the source and destination IP addresses and will be saved in snort.log file.

    EDIT: The log file can be in any place you like and it's name can be determined by you. for example:

    output alert_fast: ~/Desktop/my_snort_log.txt