def _snort_cmd(self, pcap):
        """
        Given a pcap filename, get the commandline to run.

        :param pcap: Pcap filename to scan
        :returns: list of snort command args to scan supplied pcap file
        """
        cmdline = "'{0}' -A console -N -y -c '{1}' {2} -r '{3}'" \
            .format(self.conf['path'], self.conf['config'],
                    self.conf['extra_args'] or '', pcap)
        # can't seem to capture stderr from snort on windows
        # unless launched via cmd shell
        if 'nt' in os.name:
            cmdline = "cmd.exe /c " + cmdline
        return shlex.split(cmdline)