writing snort rules
Step 2: Viewing Snort Rules. The Snort rules files are simple text files, so we can open and edit them with any text editor. I'll be using KWrite. Let's open the file porn.rules. This set of rules is designed to detect pornography on the wire. This is a rather old set of rules and most system admins no longer use it. kwrite /etc/snort/porn.rules.