https://www.securityarchitecture.

com/learning/intrusion-detection-systems-learning-with-
snort/installing-snort-on-windows/

C:\Snort\bin>snort -c

snort: option requires an argument -- c

,,_ -*> Snort! <*-

o" )~ Version 2.9.17-WIN32 GRE (Build 199)

'''' By Martin Roesch & The Snort Team: http://www.snort.org/contact#team

Copyright (C) 2014-2020 Cisco and/or its affiliates. All rights reser

ved.

Copyright (C) 1998-2013 Sourcefire, Inc., et al.

Using PCRE version: 8.10 2010-06-25

Using ZLIB version: 1.2.3

USAGE: snort [-options] <filter options>

snort /SERVICE /INSTALL [-options] <filter options>

snort /SERVICE /UNINSTALL

snort /SERVICE /SHOW

Options:

-A Set alert mode: fast, full, console, test or none (alert fil

e alerts only)

-b Log packets in tcpdump format (much faster!)

-B <mask> Obfuscated IP addresses in alerts and packet dumps using CIDR

mask

-c <rules> Use Rules File <rules>

-C Print out payloads with character data only (no hex)

-d Dump the Application Layer

-e Display the second layer header info

 -E Log alert messages to NT Eventlog. (Win32 only)

-f Turn off fflush() calls after binary log writes

-F <bpf> Read BPF filters from file <bpf>

-G <0xid> Log Identifier (to uniquely id events for multiple snorts)

-h <hn> Set home network = <hn>

(for use with -l or -B, does NOT change $HOME_NET in IDS mode

-H Make hash tables deterministic.

-i <if> Listen on interface <if>

-I Add Interface name to alert output

-k <mode> Checksum mode (all,noip,notcp,noudp,noicmp,none)

-K <mode> Logging mode (pcap[default],ascii,none)

-l <ld> Log to directory <ld>

-L <file> Log to this tcpdump file

-n <cnt> Exit after receiving <cnt> packets

-N Turn off logging (alerts still work)

-O Obfuscate the logged IP addresses

-p Disable promiscuous mode sniffing

-P <snap> Set explicit snaplen of packet (default: 1514)

-q Quiet. Don't show banner and status report

-r <tf> Read and process tcpdump file <tf>

-R <id> Include 'id' in snort_intf<id>.pid file name

-s Log alert messages to syslog

-S <n=v> Set rules file variable n equal to value v

-T Test and report on the current Snort configuration

-U Use UTC for timestamps

-v Be verbose

-V Show version number

-W Lists available interfaces. (Win32 only)

 -X Dump the raw packet data starting at the link layer

-x Exit if Snort configuration problems occur

-y Include year in timestamp in the alert and log files

-Z <file> Set the performonitor preprocessor file path and name

-? Show this information

<Filter Options> are standard BPF options, as seen in TCPDump

Longname options and their corresponding single char version

--logid <0xid> Same as -G

--perfmon-file <file> Same as -Z

--pid-path <dir> Specify the directory for the Snort PID file

--snaplen <snap> Same as -P

--help Same as -?

--version Same as -V

--alert-before-pass Process alert, drop, sdrop, or reject before

pass, default is pass before alert, drop,...

--treat-drop-as-alert Converts drop, sdrop, and reject rules into a

lert rules during startup

--treat-drop-as-ignore Use drop, sdrop, and reject rules to ignore s

ession traffic when not inline.

--process-all-events Process all queued events (drop, alert,...),

default stops after 1st action group

--enable-inline-test Enable Inline-Test Mode Operation

--dynamic-engine-lib <file> Load a dynamic detection engine

--dynamic-engine-lib-dir <path> Load all dynamic engines from directory

--dynamic-detection-lib <file> Load a dynamic rules library

--dynamic-detection-lib-dir <path> Load all dynamic rules libraries from dire

ctory

--dump-dynamic-rules <path> Creates stub rule files of all loaded rules l

ibraries
 --dynamic-preprocessor-lib <file> Load a dynamic preprocessor library

--dynamic-preprocessor-lib-dir <path> Load all dynamic preprocessor libraries

from directory

--dynamic-output-lib <file> Load a dynamic output library

--dynamic-output-lib-dir <path> Load all dynamic output libraries from direct

ory

--pcap-single <tf> Same as -r.

--pcap-file <file> file that contains a list of pcaps to read -

read mode is implied.

--pcap-list "<list>" a space separated list of pcaps to read - rea

d mode is implied.

--pcap-loop <count> this option will read the pcaps specified on

command line continuously.

for <count> times. A value of 0 will read un

til Snort is terminated.

--pcap-reset if reading multiple pcaps, reset snort to pos

t-configuration state before reading next pcap.

--pcap-show print a line saying what pcap is currently be

ing read.

--exit-check <count> Signal termination after <count> callbacks fr

om DAQ_Acquire(), showing the time it

takes from signaling until DAQ_Stop() is call

ed.

--conf-error-out Same as -x

--enable-mpls-multicast Allow multicast MPLS

--enable-mpls-overlapping-ip Handle overlapping IPs within MPLS clouds

--max-mpls-labelchain-len Specify the max MPLS label chain

--mpls-payload-type Specify the protocol (ipv4, ipv6, ethernet) t

hat is encapsulated by MPLS

 --require-rule-sid Require that all snort rules have SID specifi

ed.

--daq <type> Select packet acquisition module (default is

pcap).

--daq-mode <mode> Select the DAQ operating mode.

--daq-var <name=value> Specify extra DAQ configuration variable.

--daq-dir <dir> Tell snort where to find desired DAQ.

--daq-list[=<dir>] List packet acquisition modules available in

dir. Default is static modules only.

--dirty-pig Don't flush packets and release memory on shu

tdown.

--cs-dir <dir> Directory to use for control socket.

--ha-peer Activate live high-availability state sharing

with peer.

--ha-out <file> Write high-availability events to this file.

--ha-in <file> Read high-availability events from this file

on startup (warm-start).

--suppress-config-log Suppress configuration information output.

C:\Snort\bin>snort -r

snort: option requires an argument -- r

,,_ -*> Snort! <*-

o" )~ Version 2.9.17-WIN32 GRE (Build 199)

'''' By Martin Roesch & The Snort Team: http://www.snort.org/contact#team

Copyright (C) 2014-2020 Cisco and/or its affiliates. All rights reser

ved.

Copyright (C) 1998-2013 Sourcefire, Inc., et al.

Using PCRE version: 8.10 2010-06-25

 Using ZLIB version: 1.2.3

USAGE: snort [-options] <filter options>

snort /SERVICE /INSTALL [-options] <filter options>

snort /SERVICE /UNINSTALL

snort /SERVICE /SHOW

Options:

-A Set alert mode: fast, full, console, test or none (alert fil

e alerts only)

-b Log packets in tcpdump format (much faster!)

-B <mask> Obfuscated IP addresses in alerts and packet dumps using CIDR

mask

-c <rules> Use Rules File <rules>

-C Print out payloads with character data only (no hex)

-d Dump the Application Layer

-e Display the second layer header info

-E Log alert messages to NT Eventlog. (Win32 only)

-f Turn off fflush() calls after binary log writes

-F <bpf> Read BPF filters from file <bpf>

-G <0xid> Log Identifier (to uniquely id events for multiple snorts)

-h <hn> Set home network = <hn>

(for use with -l or -B, does NOT change $HOME_NET in IDS mode

-H Make hash tables deterministic.

-i <if> Listen on interface <if>

-I Add Interface name to alert output

-k <mode> Checksum mode (all,noip,notcp,noudp,noicmp,none)

-K <mode> Logging mode (pcap[default],ascii,none)

-l <ld> Log to directory <ld>

 -L <file> Log to this tcpdump file

-n <cnt> Exit after receiving <cnt> packets

-N Turn off logging (alerts still work)

-O Obfuscate the logged IP addresses

-p Disable promiscuous mode sniffing

-P <snap> Set explicit snaplen of packet (default: 1514)

-q Quiet. Don't show banner and status report

-r <tf> Read and process tcpdump file <tf>

-R <id> Include 'id' in snort_intf<id>.pid file name

-s Log alert messages to syslog

-S <n=v> Set rules file variable n equal to value v

-T Test and report on the current Snort configuration

-U Use UTC for timestamps

-v Be verbose

-V Show version number

-W Lists available interfaces. (Win32 only)

-X Dump the raw packet data starting at the link layer

-x Exit if Snort configuration problems occur

-y Include year in timestamp in the alert and log files

-Z <file> Set the performonitor preprocessor file path and name

-? Show this information

<Filter Options> are standard BPF options, as seen in TCPDump

Longname options and their corresponding single char version

--logid <0xid> Same as -G

--perfmon-file <file> Same as -Z

--pid-path <dir> Specify the directory for the Snort PID file

--snaplen <snap> Same as -P

--help Same as -?

--version Same as -V
 --alert-before-pass Process alert, drop, sdrop, or reject before

pass, default is pass before alert, drop,...

--treat-drop-as-alert Converts drop, sdrop, and reject rules into a

lert rules during startup

--treat-drop-as-ignore Use drop, sdrop, and reject rules to ignore s

ession traffic when not inline.

--process-all-events Process all queued events (drop, alert,...),

default stops after 1st action group

--enable-inline-test Enable Inline-Test Mode Operation

--dynamic-engine-lib <file> Load a dynamic detection engine

--dynamic-engine-lib-dir <path> Load all dynamic engines from directory

--dynamic-detection-lib <file> Load a dynamic rules library

--dynamic-detection-lib-dir <path> Load all dynamic rules libraries from dire

ctory

--dump-dynamic-rules <path> Creates stub rule files of all loaded rules l

ibraries

--dynamic-preprocessor-lib <file> Load a dynamic preprocessor library

--dynamic-preprocessor-lib-dir <path> Load all dynamic preprocessor libraries

from directory

--dynamic-output-lib <file> Load a dynamic output library

--dynamic-output-lib-dir <path> Load all dynamic output libraries from direct

ory

--pcap-single <tf> Same as -r.

--pcap-file <file> file that contains a list of pcaps to read -

read mode is implied.

--pcap-list "<list>" a space separated list of pcaps to read - rea

d mode is implied.

--pcap-loop <count> this option will read the pcaps specified on

command line continuously.

 for <count> times. A value of 0 will read un

til Snort is terminated.

--pcap-reset if reading multiple pcaps, reset snort to pos

t-configuration state before reading next pcap.

--pcap-show print a line saying what pcap is currently be

ing read.

--exit-check <count> Signal termination after <count> callbacks fr

om DAQ_Acquire(), showing the time it

takes from signaling until DAQ_Stop() is call

ed.

--conf-error-out Same as -x

--enable-mpls-multicast Allow multicast MPLS

--enable-mpls-overlapping-ip Handle overlapping IPs within MPLS clouds

--max-mpls-labelchain-len Specify the max MPLS label chain

--mpls-payload-type Specify the protocol (ipv4, ipv6, ethernet) t

hat is encapsulated by MPLS

--require-rule-sid Require that all snort rules have SID specifi

ed.

--daq <type> Select packet acquisition module (default is

pcap).

--daq-mode <mode> Select the DAQ operating mode.

--daq-var <name=value> Specify extra DAQ configuration variable.

--daq-dir <dir> Tell snort where to find desired DAQ.

--daq-list[=<dir>] List packet acquisition modules available in

dir. Default is static modules only.

--dirty-pig Don't flush packets and release memory on shu

tdown.

--cs-dir <dir> Directory to use for control socket.

--ha-peer Activate live high-availability state sharing

with peer.

--ha-out <file> Write high-availability events to this file.

--ha-in <file> Read high-availability events from this file

on startup (warm-start).

--suppress-config-log Suppress configuration information output.

netsh trace start capture=yes IPv4.Address=10.15.35.248

snort -E -l C:\Snort\log -c C:\Snort\etc\snort.conf

snort -l C:\Snort\log -h 10.15.35.0/24

snort -i eth2 -c C:\Snort\etc\snort.conf

tail -f C:\Snort\log

snort -i 1 -A full

snort -T -i eth0 -c C:\Snort\etc\snort.conf

Testing config

snort -A console -q -c C:\Snort\etc\snort.conf -i eht1

W@h@b@2468

/SERVICE and /INSTALL

snort -E -i C:\Snort\log -c C:\Snort\etc\snort.conf

snort -I 2 C:\Snort -c C:\Snort\etc\snort.conf -s

snort -C C:\Snort\etc\snort.conf -A console -i 1