如何知道与snort中的content选项匹配的数据包的ip地址？

Question

i am using snort-2.9.7.0 and i inspect packet by this simple code:
alert tcp any any -> $HOME_NET any (msg:"FB found in packet content!!!"; content:"FB"; sid:10000; ) i want to know where packet is comes from and store it. guide me.
Thanks and Regards.

Answer 1

You should adjust the output format of the alerts; to do that add this line in your config file:

output alert_fast: <full path to output file>/snort.log

as you here this will print Snort alert messages with full packet headers that contains the source and destination IP addresses and will be saved in snort.log file.

EDIT : The log file can be in any place you like and it's name can be determined by you. for example:

output alert_fast: ~/Desktop/my_snort_log.txt