Testing Snort
Now that you have a custom snort.conf, the rules you wish to run on your Snort sensor, it's time to test to see if everything is working.
First, determine which network interface Snort will be monitoring. For servers with only one interface, this is trivial. On systems with multiple interfaces, this becomes only slightly more complex. For UNIX/Linux systems, just look at the output of the "ifconfig a" command. Windows NT and 2000 do not have a true equivalent to the ifconfig command that lists the interface to the driver. The developers of Snort realized this, and added a command line to specifically enumerate the available network interfaces. Run snort.exe with the W command line option, like so:
C:\snort\bin\snort.exe W
This will list all available interfaces with a number preceding the interface info. It is this number that you will use on the Snort command-line.
NOTE
On recent Linux kernels, such as 2.2.18 or newer and the 2.4 series of kernels, you may use the special "any" designation, to listen on any available interface. Be careful because this may overload your Snort process on busy interfaces, and packets may be dropped!
Use the i command-line option to specify the network interface to listen on. Issue the following command-line for UNIX/Linux:
snort dev c /etc/snort/snort.conf l /var/log/snort i eth0
Or this one for Windows NT or 2000:
snort dev c c:\snort\rules\snort.conf l c:\snort\logs i 1
A number of initialization messages should be displayed onscreen, possibly including some packet summaries. If you receive an error, you will have to try and troubleshoot what the problem is by consulting the documentation. If you receive no errors, you can try running a port scanning tool such as nmap against the server from another box. Any packets that would generate alerts or logs will be displayed in your console window.