Snort- ips
 

I have made the simplest rule in local.rules as below:-

alert tcp any any -> any any (msg:"Japan Dave"; gid:1000001; sid:1000002; rev:1;)

I too get packets trapped in log files as I execute the command

sudo snort -i eth0 -c /etc/snort/snort.conf -l /etc/snort


But the only thing which annoy me is I cant find anything like "JAPAN DAVE", which is specified in option msg.......in log files...... :(

you need a content match. the 'msg:"Japan Dave"' portion of your rule is just a description of the rule. Your current rule will fire on an tcp traffic.

Try this instead: