I'm new to snort and i think that i have it set up right, i just have a few questions about the log files. Snort is logging to /var/log/snort directory, i have the ip addresses of my network machines showing up as folders, is this supposed to happen. Plus there are 2 other ip's i don't know 239.255.255.250 and 255.255.255.255 are they network broadcast?. Also my log files are being log like snort.log.1072483058, snort.log.1072496953, this is the same for suspicious.log and tcpdump.log. Can i have these logged as 1 file each for that day with the date in the file name.

thanks

the ip addresses of my network machines showing up as folders, is this supposed to happen.
Depends on how you configure Snort.


Plus there are 2 other ip's i don't know 239.255.255.250 and 255.255.255.255 are they network broadcast?.
Could be and yes.


Also my log files are being log like snort.log.1072483058, snort.log.1072496953, this is the same for suspicious.log and tcpdump.log. Can i have these logged as 1 file each for that day with the date in the file name.
No, not that I know of.

Thanks for that, i've been doing a bit more reading and research since I posted the question