Ask Your Question

How do I configure WireShark to capture Snort packages on Windows

asked 2020-12-03 16:54:58 +0000

updated 2020-12-05 18:56:19 +0000

Guy Harris gravatar image

Snort Ver. 2.9.17 Windows 10

edit retag flag offensive close merge delete


Please explain what you want to accomplish. As it sounds like you are trying to mix things that have no relation to one another.

hugo.vanderkooij gravatar imagehugo.vanderkooij ( 2020-12-04 09:23:18 +0000 )edit

What @Chuckc describes in his answer is "capturing packets in Wireshark and having Wireshark feed them to Snort to see what it has to say about them, and report that in the dissection"; is that what you're talking about?

Guy Harris gravatar imageGuy Harris ( 2020-12-05 22:04:09 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2020-12-05 18:26:03 +0000

Chuckc gravatar image

updated 2020-12-05 18:26:26 +0000

From the Wireshark wiki:
"Does not currently run under Windows. The problem seen was a failure to launch Snort using g_spawn_async_with_pipes(). Any suggestions on how to fix this would be welcome."

Please open an issue on the Wireshark GitLab site so that this can be tracked and maybe repaired.
At the very least there should be a warning message similar to:

report_failure("Snort dissector: Can't run snort - config file '%s' not found\n", pref_snort_config_filename);

in packet-snort.c to indicate there is a problem.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2020-12-03 16:54:58 +0000

Seen: 139 times

Last updated: Dec 05 '20