No, I didn't edit snort.conf, but that seems to be what I was looking for, thanks . I got one more question.. How about using snort as a packet sniffer so I can see all incomming/outgoing packets. Think someone can give me a grip on that?