Quote:
./snort -dev -l ./log -h 192.168.1.0/24
This rule tells Snort that you want to print out the data link and TCP/IP headers as well as application data into the directory ./log, and you want to log the packets relative to the 192.168.1.0 class C network. All incoming packets will be recorded into subdirectories of the log directory, with the directory names being based on the address of the remote (non-192.168.1) host. Note that if both hosts are on the home network, then they are recorded based upon the higher of the two's port numbers, or in the case of a tie, the source address.
Once you get past the snort basics, my suggestion is to install a web-based front-end like ACID or Demarc (Demarc is unfortunately now a commercial product) and to log to a MySQL database instead of using the default snort logging. Using a front end will make your appreciation of snort much greater. The default logging kind of rots and is not very easy to work with or read.