Troubleshooting Snort 3
After you have migrated the configuration (from Snort 2 to Snort 3) and Snort 3 is running, there are various scenarios where the system is not working as you expected it to. Does the Snort rule you wrote work as expected? What to do if Snort crashes? Where do we reach out for support when needed? Let’s discuss a few of these topics in this section.
Why is the Snort rule for XYZ not alerting?
This is a very common question that is often asked. We have a Snort signature that is meant to detect an attack or some malicious traffic. Why is it not alerting when the IDS is inspecting bad traffic?
We will keep this discussion simple and address some of the common reasons:
- Get the packet capture: To debug and troubleshoot the situation, the best way is to get the traffic under consideration as a packet capture (pcap) file. This will enable us to have Snort analyze the traffic in a controlled fashion, and also repeat the test as many times as...
