Install Snort and Wireshark. They are free software and can be downloaded from their official sites. 2. Copy the Snert Data pcap to Snort home directory, for Windows, usually it is c:lsnortibin. 3. Create a folder "log" under c:snortbin. 3. Start Wireshark to open Snert Data pcap, which is a previously captured tracefile. There are several distinct packet signatures in the packet trace file. In the trace file, there are 30 packets total. 4. Many packets contain suspicious information, analyze each packet and try to find the suspicious information in it. Then write SIX snort rules to alert them. 6. There are at least 6 types of packets with different suspicious information. Each rule only alerts one type of packets with the same suspicious information. Each packet cannot be alerted by 2 or more rules. 2 Install Snort and Wireshark. They are free software and can be downloaded from their official sites. 2. Copy the Snert Data pcap to Snort home directory, for Windows, usually it is c:lsnortibin. 3. Create a folder "log" under c:snortbin. 3. Start Wireshark to open Snert Data pcap, which is a previously captured tracefile. There are several distinct packet signatures in the packet trace file. In the trace file, there are 30 packets total. 4. Many packets contain suspicious information, analyze each packet and try to find the suspicious information in it. Then write SIX snort rules to alert them. 6. There are at least 6 types of packets with different suspicious information. Each rule only alerts one type of packets with the same suspicious information. Each packet cannot be alerted by 2 or more rules. 2