I recently installed Snort version 2.9.20 on my Windows system using the installer named "Snort_2_9_20_Installer.x64.exe." During the setup, I was configuring some necessary options for FTP and Telnet normalization and anomaly detection, as outlined around line 331 in the configuration file, where it mentions 'README.ftptelnet' for further guidance.
To confirm that everything was set up correctly, I ran Snort in Test mode with the following command:
C:\Snort\etc>snort -i 1 -c c:\Snort\etc\snort.conf -T
This essentially instructs Snort to stare at interface 1 and use the configuration file located at c:\Snort\etc\snort.conf, then initiate a test to ensure all configurations are valid and operational.
As I embarked on this process, one of my key goals was not only to establish an effective monitoring environment but also to ensure that all aspects of configuration were handled accurately to avoid any issues during deployment. The detailed approach helped me systematically verify each step involved in setting up and running Snore effectively on a Windows platform.
