how can I open snort alert.ids
Can I open the Snort alert.ids file in WireShark or do I need to configure Snort to create a different alerts log file?
1 Answer
- Sort by
oldest newest most voted
0
Wireshark can't open any Snort alert output format. Is there a format that contains full frames?
https://gitlab.com/wireshark/wireshar... describes how Wireshark can load pcap files and feed them through Snort, then show where/how in the capture any alerts were detected. The Snort post-dissector doesn't currently work for Windows.
Your Answer
Please start posting anonymously - your entry will be published after you log in or create a new account.
This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.
Comments