Ask Your Question
0

How do I configure WireShark to capture Snort packages on Windows

asked 2020-12-03 16:54:58 +0000

updated 2020-12-05 18:56:19 +0000

Guy Harris gravatar image

Snort Ver. 2.9.17 Windows 10

edit retag flag offensive close merge delete

Comments

Please explain what you want to accomplish. As it sounds like you are trying to mix things that have no relation to one another.

hugo.vanderkooij gravatar imagehugo.vanderkooij ( 2020-12-04 09:23:18 +0000 )edit

What @Chuckc describes in his answer is "capturing packets in Wireshark and having Wireshark feed them to Snort to see what it has to say about them, and report that in the dissection"; is that what you're talking about?

Guy Harris gravatar imageGuy Harris ( 2020-12-05 22:04:09 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2020-12-05 18:26:03 +0000

Chuckc gravatar image

updated 2020-12-05 18:26:26 +0000

From the Wireshark wiki:
"Does not currently run under Windows. The problem seen was a failure to launch Snort using g_spawn_async_with_pipes(). Any suggestions on how to fix this would be welcome."

Please open an issue on the Wireshark GitLab site so that this can be tracked and maybe repaired.
At the very least there should be a warning message similar to:

report_failure("Snort dissector: Can't run snort - config file '%s' not found\n", pref_snort_config_filename);

in packet-snort.c to indicate there is a problem.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2020-12-03 16:54:58 +0000

Seen: 59 times

Last updated: Dec 05 '20