How do I configure WireShark to capture Snort packages on Windows
Snort Ver. 2.9.17 Windows 10
1 Answer
- Sort by
oldest newest most voted
0
From the Wireshark wiki:
"Does not currently run under Windows. The problem seen was a failure to launch Snort using g_spawn_async_with_pipes(). Any suggestions on how to fix this would be welcome."
Please open an issue on the Wireshark GitLab site so that this can be tracked and maybe repaired.
At the very least there should be a warning message similar to:
report_failure("Snort dissector: Can't run snort - config file '%s' not found\n", pref_snort_config_filename);
in packet-snort.c to indicate there is a problem.
Your Answer
Please start posting anonymously - your entry will be published after you log in or create a new account.
This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.
Comments
Please explain what you want to accomplish. As it sounds like you are trying to mix things that have no relation to one another.
What @Chuckc describes in his answer is "capturing packets in Wireshark and having Wireshark feed them to Snort to see what it has to say about them, and report that in the dissection"; is that what you're talking about?