Question

What command do I use to run my pcap file through SNORT?

Answer 1

To read pcap files from command line

$ snort --pcap-list="foo1.pcap foo2.pcap foo3.pcap"

This command will read three pcap files foo1.pcap , foo2.pcap , foo3.pcap. You can be specific with the no.of pcap files.

To read pcap files from a file :

    $ cat foo.txt
    foo1.pcap
    /home/foo/pcaps

$ snort --pcap-file=foo.txt

This will read foo1.pcap and all files under home/foo/pcaps.

To read multiple pcaps, reset snort to post configuration state to read next pcap. To do this use this command :

-pcap-reset

To print a line saying what pcap is currently being read, use this command :

-pcap-show

Hope this answer helps you.