The Snort++ project has been hard at work for a while now and we are
finally ready to release the first alpha of the next generation Snort IPS
-(Intrusion Prevention System). This post will show you what Snort++ has to
+(Intrusion Prevention System). This file will show you what Snort++ has to
offer and guide you through the steps from download to demo. If you are
unfamiliar with Snort you should take a look at the Snort documentation
first. We will cover the following topics:
snort-3.0.0-a1-130-auto.tar.gz
snort-3.0.0-a1-130-cmake.tar.gz
+You can also git the code with:
+
+ git clone git://github.com/snortadmin/snort3.git
+
BUILD SNORT
-First do these setup steps:
+Follow these steps:
+
+1. Set up source directory:
+
+* If you are using a github clone:
+
+ cd snort3/
+
+* Otherwise, do this:
- export my_path=/path/to/snorty
tar zxf snort-tarball
cd snort-3.0.0*
-Then do one of the following:
+2. Setup install path:
+
+ export my_path=/path/to/snorty
-To build with autotools, simply do the usual from the top level directory:
+3. Compile and install:
+
+* To build with autotools, simply do the usual from the top level directory:
./configure --prefix=$my_path
make -j 8 install
-To build with cmake and make, run configure_cmake.sh. It will
-automatically create and populate a new subdirectory named 'build'.
+* To build with cmake and make, run configure_cmake.sh. It will
+ automatically create and populate a new subdirectory named 'build'.
./configure_cmake.sh --prefix=$my_path
cd build
Note:
+* If you are using autotools with a github clone, first do autoreconf -isvf.
* If you can do src/snort -V you built successfully.
-* If you are familiar with cmake, you can run cmake/ccmake instead of configure_cmake.sh.
+* If you are familiar with cmake, you can run cmake/ccmake instead of
+ configure_cmake.sh.
* cmake --help will list any available generators, such as Xcode. Feel
- free to use one, however help with those will be provided in a later
- post.
+ free to use one, however help with those will be provided separately.
RUN SNORT
Then give it a go:
-Snort++ provides lots of help from the command line. Here are some examples:
+* Snort++ provides lots of help from the command line. Here are some examples:
$my_path/bin/snort --help
$my_path/bin/snort --help-module suppress
$my_path/bin/snort --help-config | grep thread
-Examine and dump a pcap. In the following, replace a.pcap with your
-favorite:
+* Examine and dump a pcap. In the following, replace a.pcap with your
+ favorite:
$my_path/bin/snort -r a.pcap
$my_path/bin/snort -K text -d -e -q -r a.pcap
-Verify a config, with or w/o rules:
+* Verify a config, with or w/o rules:
$my_path/bin/snort -c $my_path/etc/snort/snort.lua
$my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules
-
-Run IDS mode. In the following, replace pcaps/ with a path to a directory
-with one or more *.pcap files:
+* Run IDS mode. In the following, replace pcaps/ with a path to a directory
+ with one or more *.pcap files:
$my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \
-r a.pcap -A alert_test -n 100000
-Let's suppress 1:2123. We could edit the conf or just do this:
+* Let's suppress 1:2123. We could edit the conf or just do this:
$my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \
-r a.pcap -A alert_test -n 100000 --lua "suppress = { { gid = 1, sid = 2123 } }"
-Go whole hog on a directory with multiple packet threads:
+* Go whole hog on a directory with multiple packet threads:
$my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \
--pcap-filter \*.pcap --pcap-dir pcaps/ -A alert_fast --max-packet-threads 8
Snort++ Extras
Snort++ is all about plugins. It has over 140 by default and makes it easy
-to add more in C++ or LuaJIT. This post will walk you through building and
+to add more in C++ or LuaJIT. This file will walk you through building and
running a set of extra example plugins. If you haven't installed and
verified Snort++, you will need to do that first. We will cover the
following topics:
DOWNLOAD
-There are two extra tarballs, once for autotools and one for cmake:
+There are two extra tarballs, one for autotools and one for cmake:
snort_extra-1.0.0-a1-130-auto.tar.gz
snort_extra-1.0.0-a1-130-cmake.tar.gz
+If you cloned from github, you have already have everything.
+
BUILD EXTRAS
-To build the example plugins, first do these setup steps:
+Follow these steps:
+
+1. Set up source directory:
+
+* If you are using a github clone:
+
+ cd extra/
+
+* Otherwise do this:
tar zxf extra-tarball
cd snort_extra-1.0.0*
+
+2. Setup install path (same as for snort):
+
+ export my_path=/path/to/snorty
export PKG_CONFIG_PATH=$my_path/lib/pkgconfig
-Then do one of the following:
+3. Compile and install:
-To build with autotools, simply do the usual from the top level directory:
+* To build with autotools, simply do the usual from the top level directory:
./configure --prefix=$my_path --with-snort-includes=$my_path/include/snort
make -j 8 install
-To build with cmake, do the following:
+* To build with cmake, do the following:
mkdir build && cd build
cmake ..
make -j 8 install
+Note:
+
+* If you are using autotools with a github clone, first do autoreconf -isvf.
+* If you are familiar with cmake, you can run cmake/ccmake instead of
+ configure_cmake.sh.
+* cmake --help will list any available generators, such as Xcode. Feel
+ free to use one, however help with those will be provided separately.
+
RUN EXTRAS
In the following, replace a.pcap with your favorite.
-The following demonstrates a C++ logger and a LuaJIT logger:
+* The following demonstrates a C++ logger and a LuaJIT logger:
$my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \
-r a.pcap --plugin-path $my_path/lib/snort_extra -A alert_ex
$my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \
-r a.pcap --script-path $my_path/lib/snort_extra -A lualert
-You can edit $my_path/lib/snort_extra/loggers/alert.lua to tweak the output format and rerun the above command to try it out.
+You can edit $my_path/lib/snort_extra/loggers/alert.lua to tweak the output
+format and rerun the above command to try it out.
-The last example demonstrates a LuaJIT rule option called find. The rule, supplied on stdin, uses the Lua [[ multiline string ]] delimiters to avoid shell escape issues:
+* The last example demonstrates a LuaJIT rule option called find. The rule,
+ supplied on stdin, uses the Lua [[ multiline string ]] delimiters to avoid
+ shell escape issues:
echo 'alert tcp any any -> any 80 ( sid:1; msg:"test"; http_method; find:"pat = [[GET]]"; )' | \
$my_path/bin/snort -c $my_path/etc/snort/snort.lua -r a.pcap \
projects / thirdparty / snort3.git / commitdiff
