From 213be0b54141a4a6a1b3f50d2d72c568dd0e2ef0 Mon Sep 17 00:00:00 2001
From: whx <stefan@stefan.works>
Date: Mon, 26 Sep 2022 19:35:29 +0200
Subject: [PATCH] layout

---
 misc/snort.md | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/misc/snort.md b/misc/snort.md
index a0d500b..c4de562 100644
--- a/misc/snort.md
+++ b/misc/snort.md
@@ -1,6 +1,12 @@
 # Snort
 
-Comprised of __packet decoder__, __pre processor__, __detection engine__, __logging and alerting__, __output and plugins__
+Snort is comprised of multiple modules to process network packets.
+
+ * __packet decoder__
+ * __pre processor__  
+ * __detection engine__
+ * __logging and alerting__
+ * __output and plugins__
 
 ## Data Aquisition Modules
 
@@ -21,7 +27,7 @@ snort -c <config> -T
 
 ### Sniffing
 | Parameter | Description |
-+-----------+-------------+
+|-----------|-------------|
 | -v | Verbose. Display the TCP/IP output in the console.|
 | -d | Display the packet data (payload).|
 | -e | Display the link-layer (TCP/IP/UDP/ICMP) headers. |
@@ -80,7 +86,9 @@ snort -c /etc/snort/rules/local.rules -A full
 * IDS -> `alert`
 * IPS -> `reject`
 
-`<action> <protocol> <ip.src> <src.port>  <> <ip.dst> <dst.port>(msg: "<msg>; <reference>; <ruleID>;<revision info>`
+```sh
+<action> <protocol> <ip.src> <src.port>  <> <ip.dst> <dst.port>(msg: "<msg>; <reference>; <ruleID>;<revision info>
+```
 
 * Actions
     * `alert`