Why I have this error message while i'm trying to verify my snort configuration

Question

I'm trying to verify my snort configuration with 'snort -c C:\snort\etc\snort.conf –T' .The i got a failed message: 'ERROR: active response: can't open ip' like this one

I can't understand why i got this. Is there anyone can help me to fix this. Thanks a lot.

Answer 1

By default, Snort attempts to open up a socket and fails because it does not have admin privileges. Here is a link I found about someone who had the same problem.

Run the command with elevated permissions (the Windows equivalent to sudo) to pass.

Answer 2

You forget specify the interface -i 3 in my case, try it

snort -i 3 c: C:/snort/etc/snort.conf -T

Good luck