If you already build Snort, you may have everything you need. If not, grab the latest:
* autotools or cmake to build from source
-* g++ >= 4.8 or other C++11 compiler
+* g++ >= 4.8 or other C++11 compiler
* daq from http://www.snort.org for packet IO
* dnet from http://code.google.com/p/libdnet/ for network utility functions
* LuaJIT from http://luajit.org for configuration and scripting
There are two sets of source tarballs, once for autotools and one for cmake. snort-3 contains the base program and snort_extra has example plugins.
- snort-3.0.0-a1-129-auto.tar.gz
- snort-3.0.0-a1-129-cmake.tar.gz
+ snort-3.0.0-a1-130-auto.tar.gz
+ snort-3.0.0-a1-130-cmake.tar.gz
BUILD SNORT
There are two extra tarballs, once for autotools and one for cmake:
- snort_extra-1.0.0-a1-129-auto.tar.gz
- snort_extra-1.0.0-a1-129-cmake.tar.gz
+ snort_extra-1.0.0-a1-130-auto.tar.gz
+ snort_extra-1.0.0-a1-130-cmake.tar.gz
BUILD EXTRAS
To build with cmake, do the following:
- mkdir build && cd build
+ mkdir build && cd build
cmake ..
make -j 8 install
The last example demonstrates a LuaJIT rule option called find. The rule, supplied on stdin, uses the Lua [[ multiline string ]] delimiters to avoid shell escape issues:
- echo 'alert tcp any any -> any 80 ( sid:1; msg:"test"; http_method; find:"pat = [[GET]]"; )' | \
+ echo 'alert tcp any any -> any 80 ( sid:1; msg:"test"; http_method; find:"pat = [[GET]]"; )' | \
$my_path/bin/snort -c $my_path/etc/snort/snort.lua -r pcap \
-A cmg --script-path $my_path/lib/snort_extra --stdin-rules