this mode is used for long-term storage, forensics, or when the need to analyze traffic at a later time is required. Snort, TCPDump and Wireshark can read and handle the binary like output. However, if the logs were created with the "-K ASCII" parameter, Snort can't read them.
LOGGING: BINARY
root@dco:~$ sudo snort -dev -l .
* -v Verbose. Display the TCP/IP output in the console.
* -d display the packet data (payload).
* -e Display the link-layer (TCP/IP/UDP/ICMP) headers.
* the -l creates the logs in the specified directory
- the above example creates the logs in the 'current directory'
- the default output directory can be configured in the snort.config file
- the default log directory is useful for continuous monitoring operations, and the "-l" parameter is much more useful for testing purposes.
LOGGING: ASCII
root@dco:~$ sudo snort -dev -K ASCII
* the -K specifies the output format for logged packets.
* the output will be stored in a readable ASCII format instead of binary data
* this method is useful when tools to parse PCAP are unavailable
- the output can be read by any text editor tools or via the cat utility
READING: BINARY
root@dco:~$ sudo snort -r snort.log.1638459842 -ntc 10
* the -r is used to read a binary log file such as pcaps
- the "-r" parameter also allows users to filter the binary log files
- the filter is used to see specific packets; think Berkeley Packet Filter (BPF)
- sudo snort -r logname.log -X
sudo snort -r logname.log icmp
sudo snort -r logname.log tcp
sudo snort -r logname.log 'udp and port 53'
* the -n Specifies the number of packets to process.
- Useful for debugging or quickly inspecting a sample from the captured traffic
* the -t Suppresses timestamp printing in the packet output.
-Reduces clutter by omitting timestamp details from the analysis output.
- Useful when timestamps are not relevant to your specific analysis.
* the -c Enables packet counting during processing.
- Shows how many packets have been processed in real-time.
- Useful for monitoring progress, especially with large packet capture files.
