diff --git a/misc/snort.md b/misc/snort.md index a0d500b..c4de562 100644 --- a/misc/snort.md +++ b/misc/snort.md @@ -1,6 +1,12 @@ # Snort -Comprised of __packet decoder__, __pre processor__, __detection engine__, __logging and alerting__, __output and plugins__ +Snort is comprised of multiple modules to process network packets. + + * __packet decoder__ + * __pre processor__ + * __detection engine__ + * __logging and alerting__ + * __output and plugins__ ## Data Aquisition Modules @@ -21,7 +27,7 @@ snort -c -T ### Sniffing | Parameter | Description | -+-----------+-------------+ +|-----------|-------------| | -v | Verbose. Display the TCP/IP output in the console.| | -d | Display the packet data (payload).| | -e | Display the link-layer (TCP/IP/UDP/ICMP) headers. | @@ -80,7 +86,9 @@ snort -c /etc/snort/rules/local.rules -A full * IDS -> `alert` * IPS -> `reject` -` <> (msg: "; ; ;` +```sh + <> (msg: "; ; ; +``` * Actions * `alert`