<div class="literalblock">\r
<div class="content">\r
<pre><code> ,,_ -*> Snort++ <*-\r
-o" )~ Version 3.0.0-a1 (Build 140) from 2.9.6-9\r
+o" )~ Version 3.0.0-a1 (Build 144) from 2.9.6-9\r
'''' By Martin Roesch & The Snort Team\r
http://snort.org/contact#team\r
Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved.\r
</li>\r
<li>\r
<p>\r
-You can also specify a cmake project generator or use ccmake:\r
+You can also specify a cmake project generator:\r
</p>\r
<div class="literalblock">\r
<div class="content">\r
<pre><code>./configure_cmake.sh --generator=Xcode --prefix=$my_path</code></pre>\r
</div></div>\r
</li>\r
+<li>\r
+<p>\r
+Or use ccmake directly to configure and generate from an arbitrary build\r
+ directory like one of these:\r
+</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>ccmake -G Xcode /path/to/Snort++/tree\r
+open snort.xcodeproj</code></pre>\r
+</div></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>ccmake -G "Eclipse CDT4 - Unix Makefiles" /path/to/Snort++/tree\r
+run eclipse and do File > Import > Existing Eclipse Project</code></pre>\r
+</div></div>\r
+</li>\r
</ol></div>\r
</li>\r
</ul></div>\r
</li>\r
<li>\r
<p>\r
-string <strong>daq.type</strong> = pcap: select type of DAQ\r
+string <strong>daq.type</strong>: select type of DAQ\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-enum <strong>hosts[].frag_policy</strong> = linux: defragmentation policy { unknown | first | linux | bsd | bsd_right |last | windows | solaris }\r
+enum <strong>hosts[].frag_policy</strong>: defragmentation policy { first | linux | bsd | bsd_right | last | windows | solaris }\r
</p>\r
</li>\r
<li>\r
<p>\r
-enum <strong>hosts[].tcp_policy</strong> = linux: tcp reassembly policy { unknown | first | last | bsd | linux | old-linux | windows | win-2003 | vista | solaris | hpux | hpux10 | irix | macos }\r
+enum <strong>hosts[].tcp_policy</strong>: tcp reassembly policy { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-enum <strong>ips.mode</strong> = tap: set policy mode { tap | inline | inline-test }\r
+enum <strong>ips.mode</strong>: set policy mode { tap | inline | inline-test }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-bool <strong>ppm.debug_pkts</strong> = false: enable packet debug\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
int <strong>ppm.max_rule_time</strong> = 0: enable rule latency thresholding (usec), 0 = off { 0: }\r
</p>\r
</li>\r
enum <strong>ppm.rule_log</strong> = none: enable event logging for suspended rules { none|log|alert|both }\r
</p>\r
</li>\r
-<li>\r
-<p>\r
-bool <strong>ppm.debug_rules</strong> = false: enable rule debug\r
-</p>\r
-</li>\r
</ul></div>\r
<div class="paragraph"><p>Rules:</p></div>\r
<div class="ulist"><ul>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-int <strong>profile.rules.count</strong> = -1: print results to given level (-1 = all, 0 = off?) { -1: }\r
+int <strong>profile.rules.count</strong> = -1: print results to given level (-1 = all, 0 = off) { -1: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>profile.modules.count</strong> = -1: print results to given level (-1 = all, 0 = off?) { -1: }\r
+int <strong>profile.modules.count</strong> = -1: print results to given level (-1 = all, 0 = off) { -1: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>snort.-s</strong>: <snap> (same as --snaplen) { 68:65535 }\r
+int <strong>snort.-s</strong> = 1514: <snap> (same as --snaplen) { 68:65535 }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>snort.-z</strong>: <count> maximum number of packet threads (same as --max-packet-threads) { 1: }\r
+int <strong>snort.-z</strong> = 1: <count> maximum number of packet threads (same as --max-packet-threads)\r
+ 0 gets the number of CPU cores reported by the system { 0: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-string <strong>snort.--c2x</strong>: output hex for given char\r
+string <strong>snort.--c2x</strong>: output hex for given char (see also --x2c)\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>snort.--max-packet-threads</strong>: <count> configure maximum number of packet threads (same as -z) { 0: }\r
+int <strong>snort.--max-packet-threads</strong> = 1: <count> configure maximum number of packet threads (same as -z)\r
+ 0 gets the number of CPU cores reported by the system { 0: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>snort.--snaplen</strong>: <snap> set snaplen of packet (same as -s) { 68:65535 }\r
+int <strong>snort.--snaplen</strong> = 1514: <snap> set snaplen of packet (same as -s) { 68:65535 }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
+implied <strong>snort.--warn-conf</strong>: warn about configuration issues\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+implied <strong>snort.--warn-daq</strong>: warn about DAQ issues, usually related to mode\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
implied <strong>snort.--warn-flowbits</strong>: warn about flowbits that are checked but not set and vice-versa\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>snort.--warn-unknown</strong>: warn about unknown symbols in your config\r
+implied <strong>snort.--warn-hosts</strong>: warn about host table issues\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+implied <strong>snort.--warn-rules</strong>: warn about duplicate rules and rule parsing issues\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+implied <strong>snort.--warn-scripts</strong>: warn about issues discovered while processing Lua scripts\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+implied <strong>snort.--warn-symbols</strong>: warn about unknown symbols in your Lua config\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+implied <strong>snort.--warn-vars</strong>: warn about variable definition and usage issues\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>snort.--x2c</strong>: output ASCII char for given hex\r
+int <strong>snort.--x2c</strong>: output ASCII char for given hex (see also --c2x)\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-int <strong>binder[].when.policy_id</strong>: unique ID for selection of this config by external logic { 0: }\r
+int <strong>binder[].when.policy_id</strong> = 0: unique ID for selection of this config by external logic { 0: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-string <strong>binder[].use.name</strong> = defaults to type: symbol name\r
+string <strong>binder[].use.name</strong>: symbol name (defaults to type)\r
</p>\r
</li>\r
</ul></div>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
+<h3 id="_dns">dns</h3>\r
+<div class="paragraph"><p>What: dns inspection</p></div>\r
+<div class="paragraph"><p>Type: inspector</p></div>\r
+<div class="paragraph"><p>Rules:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<strong>131:1</strong> (dns) Obsolete DNS RR Types\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>131:2</strong> (dns) Experimental DNS RR Types\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>131:3</strong> (dns) DNS Client rdata txt Overflow\r
+</p>\r
+</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<strong>dns.packets</strong>: total packets\r
+</p>\r
+</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
<h3 id="_ftp_data">ftp_data</h3>\r
<div class="paragraph"><p>What: FTP data channel handler</p></div>\r
<div class="paragraph"><p>Type: inspector</p></div>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
+<h3 id="_ssh">ssh</h3>\r
+<div class="paragraph"><p>What: ssh inspection</p></div>\r
+<div class="paragraph"><p>Type: inspector</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+int <strong>ssh.max_encrypted_packets</strong> = 25: ignore session after this many encrypted packets { 0:65535 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>ssh.max_client_bytes</strong> = 19600: number of unanswered bytes before alerting on challenge-response overflow or CRC32 { 0:65535 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>ssh.max_server_version_len</strong> = 80: limit before alerting on secure CRT server version string overflow { 0:255 }\r
+</p>\r
+</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Rules:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<strong>128:1</strong> (ssh) Challenge-Response Overflow exploit\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>128:2</strong> (ssh) SSH1 CRC32 exploit\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>128:3</strong> (ssh) Server version string overflow\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>128:5</strong> (ssh) Bad message direction\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>128:6</strong> (ssh) Payload size incorrect for the given payload\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>128:7</strong> (ssh) Failed to detect SSH version string\r
+</p>\r
+</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<strong>ssh.packets</strong>: total packets\r
+</p>\r
+</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
<h3 id="_stream">stream</h3>\r
<div class="paragraph"><p>What: common flow tracking</p></div>\r
<div class="paragraph"><p>Type: inspector</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-int <strong>stream.icmp_cache.memcap</strong>: maximum cache memory { 0: }\r
+int <strong>stream.icmp_cache.memcap</strong> = 0: maximum cache memory { 0: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream.ip_cache.memcap</strong>: maximum cache memory { 0: }\r
+int <strong>stream.ip_cache.memcap</strong> = 0: maximum cache memory { 0: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream.tcp_cache.memcap</strong>: maximum cache memory { 0: }\r
+int <strong>stream.tcp_cache.memcap</strong> = 0: maximum cache memory { 0: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream.udp_cache.memcap</strong>: maximum cache memory { 0: }\r
+int <strong>stream.udp_cache.memcap</strong> = 0: maximum cache memory { 0: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-enum <strong>stream_tcp.policy</strong> = linux: determines operating system characteristics like reassembly { first | last | linux | old-linux | bsd | macos | solaris | irix | hpux | hpux10 | windows | win-2003 | vista | proxy }\r
+enum <strong>stream_tcp.policy</strong> = bsd: determines operating system characteristics like reassembly { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy }\r
</p>\r
</li>\r
<li>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-bool <strong>react.msg</strong>: use rule message in response page\r
+bool <strong>react.msg</strong> = false: use rule msg in response page instead of default message\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>base64_decode.offset</strong>: Bytes past start of buffer to start decoding. { 0: }\r
+int <strong>base64_decode.offset</strong> = 0: Bytes past start of buffer to start decoding. { 0: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>byte_extract.multiplier</strong>: scale extracted value by given amount { 1:65535 }\r
+int <strong>byte_extract.multiplier</strong> = 1: scale extracted value by given amount { 1:65535 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>byte_extract.align</strong>: round the number of converted bytes up to the next 2- or 4-byte boundary { 0:4 }\r
+int <strong>byte_extract.align</strong> = 0: round the number of converted bytes up to the next 2- or 4-byte boundary { 0:4 }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>byte_jump.multiplier</strong>: scale extracted value by given amount { 1:65535 }\r
+int <strong>byte_jump.multiplier</strong> = 1: scale extracted value by given amount { 1:65535 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>byte_jump.align</strong>: round the number of converted bytes up to the next 2- or 4-byte boundary { 0:4 }\r
+int <strong>byte_jump.align</strong> = 0: round the number of converted bytes up to the next 2- or 4-byte boundary { 0:4 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>byte_jump.post_offset</strong>: also skip forward or backwards (positive of negative value) this number of bytes { -65535:65535 }\r
+int <strong>byte_jump.post_offset</strong> = 0: also skip forward or backwards (positive of negative value) this number of bytes { -65535:65535 }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>content.fast_pattern_offset</strong>: number of leading characters of this content the fast pattern matcher should exclude\r
+int <strong>content.fast_pattern_offset</strong> = 0: number of leading characters of this content the fast pattern matcher should exclude { 0: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>content.fast_pattern_length</strong>: maximum number of characters from this content the fast pattern matcher should use\r
+int <strong>content.fast_pattern_length</strong>: maximum number of characters from this content the fast pattern matcher should use { 1: }\r
</p>\r
</li>\r
<li>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-bool <strong>log_codecs.file</strong> = stdout: output to log_codecs.txt instead of stdout\r
+bool <strong>log_codecs.file</strong> = false: output to log_codecs.txt instead of stdout\r
</p>\r
</li>\r
<li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_optional_features">Optional Features</h3>\r
-<div class="paragraph"><p>Listed below are the features that must be explicitly enabled so they are built\r
-into the Snort binary. For a full list of build features, run ./configure\r
---help.</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-<strong>--enable-ppm</strong>: enable packet and rule performance monitoring and coarse\r
- latency enforcement.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--enable-perf-profiling</strong>: enable module and rule performance profiling.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--enable-shell</strong>: enable local and remote command line shell support.\r
-</p>\r
-</li>\r
-</ul></div>\r
+<h3 id="_usage_2">Usage</h3>\r
+<div class="paragraph"><p>For the following examples "$my_path" is assumed to be the path to\r
+the Snort++ install directory. Additionally, it is assumed that\r
+"$my_path/bin" is in your PATH.</p></div>\r
+<div class="sect3">\r
+<h4 id="_environment">Environment</h4>\r
+<div class="paragraph"><p>LUA_PATH is used directly by Lua to load and run required libraries.\r
+SNORT_LUA_PATH is used by Snort to load supplemental configuration files.</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>export LUA_PATH=$my_path/include/snort/lua/\?.lua\;\;\r
+export SNORT_LUA_PATH=$my_path/etc/snort</code></pre>\r
+</div></div>\r
</div>\r
-<div class="sect2">\r
-<h3 id="_environment_variables">Environment Variables</h3>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-<strong>HOSTTYPE</strong>: optional string that is output with the version at end of\r
- line.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>LUA_PATH</strong>: you must export as follows so LuaJIT can find required\r
- files.\r
-</p>\r
+<div class="sect3">\r
+<h4 id="_help_2">Help</h4>\r
+<div class="paragraph"><p>Print the help summary:</p></div>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>LUA_PATH=$install_dir/include/snort/lua/\?.lua\;\;</code></pre>\r
+<pre><code>snort --help</code></pre>\r
</div></div>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>SNORT_IGNORE</strong>: the list of symbols Snort should ignore when parsing the\r
- Lua conf. Unknown symbols not in SNORT_IGNORE will cause warnings with\r
- --warn-unknown or fatals with --warn-unknown --pedantic.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>SNORT_LUA_PATH</strong>: an optional path where Snort can find supplemental conf\r
- files such as classification.lua.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>SNORT_PROMPT</strong>: the character sequence that is printed at startup,\r
- shutdown, and in the shell. The default is the mini-pig: o")~ .\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>SNORT_PLUGIN_PATH</strong>: an optional path where Snort can find supplemental\r
- shared libraries. This is only used when Snort is building manuals.\r
- Modules in supplemental shared libraries will be added to the manuals.\r
-</p>\r
-</li>\r
-</ul></div>\r
+<div class="paragraph"><p>Get help on a specific module ("stream", for example):</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --help-module stream</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Get help on the "-A" command line option:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --help-options A</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Grep for help on threads:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --help-config | grep thread</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Output help on "rule" options in AsciiDoc format:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --markup --help-options rule</code></pre>\r
+</div></div>\r
+<div class="admonitionblock">\r
+<table><tr>\r
+<td class="icon">\r
+<img src="./images/icons/note.png" alt="Note" />\r
+</td>\r
+<td class="content">Snort++ stops reading command-line options after the "--help-<strong>" and\r
+"--list-</strong>" options, so any other options should be placed before them.</td>\r
+</tr></table>\r
</div>\r
-<div class="sect2">\r
-<h3 id="_command_line_options">Command Line Options</h3>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-<strong>--alert-before-pass</strong> process alert, drop, sdrop, or reject before pass; default is pass before alert, drop,…\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--bpf</strong> <filter options> are standard BPF options, as seen in TCPDump\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--c2x</strong> output hex for given char\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--create-pidfile</strong> create PID file, even when not in Daemon mode\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--daq</strong> <type> select packet acquisition module (default is pcap)\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--daq-dir</strong> <dir> tell snort where to find desired DAQ\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--daq-list</strong> list packet acquisition modules available in optional dir, default is static modules only\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--daq-mode</strong> <mode> select the DAQ operating mode\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--daq-var</strong> <name=value> specify extra DAQ configuration variable\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--dirty-pig</strong> don’t flush packets on shutdown\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--dump-builtin-rules</strong> [<module prefix>] output stub rules for selected modules\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--dump-defaults</strong> [<module prefix>] output module defaults in Lua format\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--dump-dynamic-rules</strong> output stub rules for all loaded rules libraries\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--dump-version</strong> output the version, the whole version, and only the version\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--enable-inline-test</strong> enable Inline-Test Mode Operation\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--help</strong> list command line options\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--help-commands</strong> [<module prefix>] output matching commands\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--help-config</strong> [<module prefix>] output matching config options\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--help-counts</strong> [<module prefix>] output matching peg counts\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--help-module</strong> <module> output description of given module\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--help-modules</strong> list all available modules with brief help\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--help-options</strong> <option prefix> output matching command line option quick help (same as -?)\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--help-plugins</strong> list all available plugins with brief help\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--help-signals</strong> dump available control signals\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--id-subdir</strong> create/use instance subdirectories in logdir instead of instance filename prefix\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--id-zero</strong> use id prefix / subdirectory even with one packet thread\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--list-buffers</strong> output available inspection buffers\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--list-builtin</strong> <module prefix> output matching builtin rules\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--list-gids</strong> [<module prefix>] output matching generators\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--list-modules</strong> [<module type>] list all known modules of given type\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--list-plugins</strong> list all known plugins\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--logid</strong> <0xid> log Identifier to uniquely id events for multiple snorts (same as -G)\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--lua</strong> <chunk> extend/override conf with chunk; may be repeated\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--markup</strong> output help in asciidoc compatible format\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--max-packet-threads</strong> <count> configure maximum number of packet threads (same as -z)\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--nolock-pidfile</strong> do not try to lock Snort PID file\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--nostamps</strong> don’t include timestamps in log file names\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--pause</strong> wait for resume/quit command before processing packets/terminating\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--pcap-dir</strong> <dir> a directory to recurse to look for pcaps - read mode is implied\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--pcap-file</strong> <file> file that contains a list of pcaps to read - read mode is implied\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--pcap-filter</strong> <filter> filter to apply when getting pcaps from file or directory\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--pcap-list</strong> <list> a space separated list of pcaps to read - read mode is implied\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--pcap-loop</strong> <count> read all pcaps <count> times; 0 will read until Snort is terminated\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--pcap-no-filter</strong> reset to use no filter when getting pcaps from file or directory\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--pcap-reload</strong> if reading multiple pcaps, reload snort config between pcaps\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--pcap-reset</strong> ignored - for REG_TEST only\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--pcap-show</strong> print a line saying what pcap is currently being read\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--pedantic</strong> warnings are fatal\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--plugin-path</strong> <path> where to find plugins\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--process-all-events</strong> process all action groups\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--rule</strong> <rules> to be added to configuration; may be repeated\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--rule-to-hex</strong> output so rule header to stdout for text rule on stdin\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--rule-to-text</strong> output plain so rule header to stdout for text rule on stdin\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--run-prefix</strong> <pfx> prepend this to each output file\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--script-path</strong> <path> where to find luajit scripts\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--shell</strong> enable the interactive command line\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--show-plugins</strong> list module and plugin versions\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--skip</strong> <n> skip 1st n packets\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--snaplen</strong> <snap> set snaplen of packet (same as -s)\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--stdin-rules</strong> read rules from stdin until EOF or a line starting with END is read\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--treat-drop-as-alert</strong> converts drop, sdrop, and reject rules into alert rules during startup\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--treat-drop-as-ignore</strong> use drop, sdrop, and reject rules to ignore session traffic when not inline\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--version</strong> show version number (same as -V)\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--warn-all</strong> enable all warnings\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--warn-flowbits</strong> warn about flowbits that are checked but not set and vice-versa\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--warn-unknown</strong> warn about unknown symbols in your config\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--x2c</strong> output ASCII char for given hex\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-?</strong> <option prefix> output matching command line option quick help (same as --help-options)\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-A</strong> <mode> set alert mode: none, cmg, or alert_*\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-B</strong> <mask> obfuscated IP addresses in alerts and packet dumps using CIDR mask\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-C</strong> print out payloads with character data only (no hex)\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-D</strong> run Snort in background (daemon) mode\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-E</strong> enable daemon restart\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-G</strong> <0xid> (same as --logid)\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-H</strong> make hash tables deterministic\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-K</strong> <mode> logging mode\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-M</strong> log messages to syslog (not alerts)\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-N</strong> ignored - for REG_TEST only\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-O</strong> obfuscate the logged IP addresses\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-Q</strong> enable inline mode operation\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-R</strong> <rules> include this rules file in the default policy\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-S</strong> <n=v> set rules file variable n equal to value v\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-T</strong> test and report on the current Snort configuration\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-U</strong> use UTC for timestamps\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-V</strong> (same as --version)\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-W</strong> lists available interfaces\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-X</strong> dump the raw packet data starting at the link layer\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-c</strong> <conf> use this configuration\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-d</strong> dump the Application Layer\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-e</strong> display the second layer header info\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-f</strong> turn off fflush() calls after binary log writes\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-g</strong> <gname> run snort gid as <gname> group (or gid) after initialization\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-i</strong> <iface>… list of interfaces\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-j</strong> <port> to listen for telnet connections\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-k</strong> <mode> checksum mode (all,noip,notcp,noudp,noicmp,none)\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-l</strong> <logdir> log to this directory instead of current directory\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-m</strong> <umask> set umask = <umask>\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-n</strong> <count> stop after count packets\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>-q</strong> quiet mode - Don’t show banner and status report\r
-</p>\r
-</li>\r
+</div>\r
+<div class="sect3">\r
+<h4 id="_sniffing_and_logging">Sniffing and Logging</h4>\r
+<div class="paragraph"><p>Read a pcap:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -r /path/to/my.pcap</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Dump the packets to stdout:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -r /path/to/my.pcap -K text</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Dump packets with application data and layer 2 headers</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -r /path/to/my.pcap -K text -d -e</code></pre>\r
+</div></div>\r
+<div class="admonitionblock">\r
+<table><tr>\r
+<td class="icon">\r
+<img src="./images/icons/note.png" alt="Note" />\r
+</td>\r
+<td class="content">Command line options must be specified separately. "snort -de" won’t\r
+work. You can still concatenate options and their arguments, however, so\r
+"snort -Ktext" will work.</td>\r
+</tr></table>\r
+</div>\r
+<div class="paragraph"><p>Dump packets from all pcaps in a directory:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --pcap-dir /path/to/pcap/dir --pcap-filter '*.pcap' -K text -d -e</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Log packets to a directory:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --pcap-dir /path/to/pcap/dir --pcap-filter '*.pcap' -K pcap -l /path/to/log/dir</code></pre>\r
+</div></div>\r
+</div>\r
+<div class="sect3">\r
+<h4 id="_configuration_2">Configuration</h4>\r
+<div class="paragraph"><p>Validate a configuration file:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Validate a configuration file and a separate rules file:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Read rules from stdin and validate:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua --stdin-rules < $my_path/etc/snort/sample.rules</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Enable warnings for Lua configurations and make warnings fatal:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua --warn-all --pedantic</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Tell Snort++ where to look for additional Lua scripts:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --script-path /path/to/script/dir</code></pre>\r
+</div></div>\r
+</div>\r
+<div class="sect3">\r
+<h4 id="_ids_mode">IDS mode</h4>\r
+<div class="paragraph"><p>Run Snort++ in IDS mode, reading packets from a pcap:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Log any generated alerts to the console using the "-A" option:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A alert_full</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Add or modify a configuration from the command line using the "--lua" option:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A cmg \\r
+ --lua 'ips = { enable_builtin_rules = true }'</code></pre>\r
+</div></div>\r
+<div class="admonitionblock">\r
+<table><tr>\r
+<td class="icon">\r
+<img src="./images/icons/note.png" alt="Note" />\r
+</td>\r
+<td class="content">The "--lua" option can be specified multiple times.</td>\r
+</tr></table>\r
+</div>\r
+<div class="paragraph"><p>Run Snort++ in IDS mode on an entire directory of pcaps, processing each\r
+input source on a separate thread:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \\r
+ --pcap-filter '*.pcap' --max-packet-threads 8</code></pre>\r
+</div></div>\r
+</div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_plugins">Plugins</h3>\r
+<div class="paragraph"><p>Load external plugins and use the "ex" alert:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua \\r
+ --plugin-path $my_path/lib/snort_extra \\r
+ -A alert_ex -r /path/to/my.pcap</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Test the LuaJIT rule option <em>find</em> loaded from stdin:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua \\r
+ --script-path $my_path/lib/snort_extra \\r
+ --stdin-rules -A cmg -r /path/to/my.pcap << END\r
+alert tcp any any -> any 80 (\r
+ sid:3; msg:"found"; content:"GET";\r
+ find:"pat='HTTP/1%.%d'" ; )\r
+END</code></pre>\r
+</div></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_output_files">Output Files</h3>\r
+<div class="paragraph"><p>To make it simple to configure outputs when you run with multiple packet\r
+threads, output files are not explicitly configured. Instead, you can use\r
+the options below to format the paths:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code><logdir>/[<run_prefix>][<id#>][<X>]<name></code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Log to unified in the current directory:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Log to unified in the current directory with a different prefix:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2 \\r
+ --run-prefix take2</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Log to unified in /tmp:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2 -l /tmp</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Run 4 packet threads and log with thread number prefix (0-3):</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \\r
+ --pcap-filter '*.pcap' -z 4 -A unified2</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Run 4 packet threads and log in thread number subdirs (0-3):</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \\r
+ --pcap-filter '*.pcap' -z 4 -A unified2 --id-subdir</code></pre>\r
+</div></div>\r
+<div class="admonitionblock">\r
+<table><tr>\r
+<td class="icon">\r
+<img src="./images/icons/note.png" alt="Note" />\r
+</td>\r
+<td class="content">subdirectories are created automatically if required. Log filename\r
+is based on module name that writes the file. All text mode outputs\r
+default to stdout. These options can be combined.</td>\r
+</tr></table>\r
+</div>\r
+<div class="sect3">\r
+<h4 id="_shell">Shell</h4>\r
+<div class="paragraph"><p>You must build with --enable-shell to make the command line shell available.</p></div>\r
+<div class="paragraph"><p>Enable shell mode:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --shell <args></code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>You will see the shell mode command prompt, which looks like this:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>o")~</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>(The prompt can be changed with the SNORT_PROMPT environment variable.)</p></div>\r
+<div class="paragraph"><p>You can pause immediately after loading the configuration and again before\r
+exiting with:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --shell --pause <args></code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>In that case you must issue the resume() command to continue. Enter quit()\r
+to terminate Snort or detach() to exit the shell. You can list the\r
+available commands with help().</p></div>\r
+<div class="paragraph"><p>To enable local telnet access on port 12345:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --shell -j 12345 <args></code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>The command line interface is still under development. Suggestions are\r
+welcome.</p></div>\r
+</div>\r
+<div class="sect3">\r
+<h4 id="_signals">Signals</h4>\r
+<div class="admonitionblock">\r
+<table><tr>\r
+<td class="icon">\r
+<img src="./images/icons/note.png" alt="Note" />\r
+</td>\r
+<td class="content">The following examples assume that Snort++ is currently running and\r
+has a process ID of <pid>.</td>\r
+</tr></table>\r
+</div>\r
+<div class="paragraph"><p>Modify and Reload Configuration:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>echo 'suppress = { { gid = 1, sid = 2215 } }' >> $my_path/etc/snort/snort.lua\r
+kill -hup <pid></code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Dump stats to stdout:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>kill -usr1 <pid></code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Shutdown normally:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>kill -term <pid></code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Exit without flushing packets:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>kill -quit <pid></code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>List available signals:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --help-signals</code></pre>\r
+</div></div>\r
+<div class="admonitionblock">\r
+<table><tr>\r
+<td class="icon">\r
+<img src="./images/icons/note.png" alt="Note" />\r
+</td>\r
+<td class="content">The available signals may vary from platform to platform.</td>\r
+</tr></table>\r
+</div>\r
+</div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_optional_features">Optional Features</h3>\r
+<div class="paragraph"><p>Listed below are the features that must be explicitly enabled so they are built\r
+into the Snort binary. For a full list of build features, run ./configure\r
+--help.</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>-r</strong> <pcap>… (same as --pcap-list)\r
+<strong>--enable-ppm</strong>: enable packet and rule performance monitoring and coarse\r
+ latency enforcement.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>-s</strong> <snap> (same as --snaplen)\r
+<strong>--enable-perf-profiling</strong>: enable module and rule performance profiling.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>-t</strong> <dir> chroots process to <dir> after initialization\r
+<strong>--enable-shell</strong>: enable local and remote command line shell support.\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_environment_variables">Environment Variables</h3>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>-u</strong> <uname> run snort as <uname> or <uid> after initialization\r
+<strong>HOSTTYPE</strong>: optional string that is output with the version at end of\r
+ line.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>-v</strong> be verbose\r
+<strong>LUA_PATH</strong>: you must export as follows so LuaJIT can find required\r
+ files.\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>LUA_PATH=$install_dir/include/snort/lua/\?.lua\;\;</code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-<strong>-w</strong> dump 802.11 management and control frames\r
+<strong>SNORT_IGNORE</strong>: the list of symbols Snort should ignore when parsing the\r
+ Lua conf. Unknown symbols not in SNORT_IGNORE will cause warnings with\r
+ --warn-unknown or fatals with --warn-unknown --pedantic.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>-x</strong> same as --pedantic\r
+<strong>SNORT_LUA_PATH</strong>: an optional path where Snort can find supplemental conf\r
+ files such as classification.lua.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>-y</strong> include year in timestamp in the alert and log files\r
+<strong>SNORT_PROMPT</strong>: the character sequence that is printed at startup,\r
+ shutdown, and in the shell. The default is the mini-pig: o")~ .\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>-z</strong> <count> maximum number of packet threads (same as --max-packet-threads)\r
+<strong>SNORT_PLUGIN_PATH</strong>: an optional path where Snort can find supplemental\r
+ shared libraries. This is only used when Snort is building manuals.\r
+ Modules in supplemental shared libraries will be added to the manuals.\r
</p>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
+<h3 id="_command_line_options">Command Line Options</h3>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code> 0 gets the number of CPU cores reported by the system\r
+ 0 gets the number of CPU cores reported by the system\r
+* *--alert-before-pass* process alert, drop, sdrop, or reject before pass; default is pass before alert, drop,...\r
+* *--bpf* <filter options> are standard BPF options, as seen in TCPDump\r
+* *--c2x* output hex for given char (see also --x2c)\r
+* *--create-pidfile* create PID file, even when not in Daemon mode\r
+* *--daq* <type> select packet acquisition module (default is pcap)\r
+* *--daq-dir* <dir> tell snort where to find desired DAQ\r
+* *--daq-list* list packet acquisition modules available in optional dir, default is static modules only\r
+* *--daq-mode* <mode> select the DAQ operating mode\r
+* *--daq-var* <name=value> specify extra DAQ configuration variable\r
+* *--dirty-pig* don't flush packets on shutdown\r
+* *--dump-builtin-rules* [<module prefix>] output stub rules for selected modules\r
+* *--dump-defaults* [<module prefix>] output module defaults in Lua format\r
+* *--dump-dynamic-rules* output stub rules for all loaded rules libraries\r
+* *--dump-version* output the version, the whole version, and only the version\r
+* *--enable-inline-test* enable Inline-Test Mode Operation\r
+* *--help* list command line options\r
+* *--help-commands* [<module prefix>] output matching commands\r
+* *--help-config* [<module prefix>] output matching config options\r
+* *--help-counts* [<module prefix>] output matching peg counts\r
+* *--help-module* <module> output description of given module\r
+* *--help-modules* list all available modules with brief help\r
+* *--help-options* <option prefix> output matching command line option quick help (same as -?)\r
+* *--help-plugins* list all available plugins with brief help\r
+* *--help-signals* dump available control signals\r
+* *--id-subdir* create/use instance subdirectories in logdir instead of instance filename prefix\r
+* *--id-zero* use id prefix / subdirectory even with one packet thread\r
+* *--list-buffers* output available inspection buffers\r
+* *--list-builtin* <module prefix> output matching builtin rules\r
+* *--list-gids* [<module prefix>] output matching generators\r
+* *--list-modules* [<module type>] list all known modules of given type\r
+* *--list-plugins* list all known plugins\r
+* *--logid* <0xid> log Identifier to uniquely id events for multiple snorts (same as -G)\r
+* *--lua* <chunk> extend/override conf with chunk; may be repeated\r
+* *--markup* output help in asciidoc compatible format\r
+* *--max-packet-threads* <count> configure maximum number of packet threads (same as -z)\r
+* *--nolock-pidfile* do not try to lock Snort PID file\r
+* *--nostamps* don't include timestamps in log file names\r
+* *--pause* wait for resume/quit command before processing packets/terminating\r
+* *--pcap-dir* <dir> a directory to recurse to look for pcaps - read mode is implied\r
+* *--pcap-file* <file> file that contains a list of pcaps to read - read mode is implied\r
+* *--pcap-filter* <filter> filter to apply when getting pcaps from file or directory\r
+* *--pcap-list* <list> a space separated list of pcaps to read - read mode is implied\r
+* *--pcap-loop* <count> read all pcaps <count> times; 0 will read until Snort is terminated\r
+* *--pcap-no-filter* reset to use no filter when getting pcaps from file or directory\r
+* *--pcap-reload* if reading multiple pcaps, reload snort config between pcaps\r
+* *--pcap-reset* ignored - for REG_TEST only\r
+* *--pcap-show* print a line saying what pcap is currently being read\r
+* *--pedantic* warnings are fatal\r
+* *--plugin-path* <path> where to find plugins\r
+* *--process-all-events* process all action groups\r
+* *--rule* <rules> to be added to configuration; may be repeated\r
+* *--rule-to-hex* output so rule header to stdout for text rule on stdin\r
+* *--rule-to-text* output plain so rule header to stdout for text rule on stdin\r
+* *--run-prefix* <pfx> prepend this to each output file\r
+* *--script-path* <path> where to find luajit scripts\r
+* *--shell* enable the interactive command line\r
+* *--show-plugins* list module and plugin versions\r
+* *--skip* <n> skip 1st n packets\r
+* *--snaplen* <snap> set snaplen of packet (same as -s)\r
+* *--stdin-rules* read rules from stdin until EOF or a line starting with END is read\r
+* *--treat-drop-as-alert* converts drop, sdrop, and reject rules into alert rules during startup\r
+* *--treat-drop-as-ignore* use drop, sdrop, and reject rules to ignore session traffic when not inline\r
+* *--version* show version number (same as -V)\r
+* *--warn-all* enable all warnings\r
+* *--warn-conf* warn about configuration issues\r
+* *--warn-daq* warn about DAQ issues, usually related to mode\r
+* *--warn-flowbits* warn about flowbits that are checked but not set and vice-versa\r
+* *--warn-hosts* warn about host table issues\r
+* *--warn-rules* warn about duplicate rules and rule parsing issues\r
+* *--warn-scripts* warn about issues discovered while processing Lua scripts\r
+* *--warn-symbols* warn about unknown symbols in your Lua config\r
+* *--warn-vars* warn about variable definition and usage issues\r
+* *--x2c* output ASCII char for given hex (see also --c2x)\r
+* *-?* <option prefix> output matching command line option quick help (same as --help-options)\r
+* *-A* <mode> set alert mode: none, cmg, or alert_*\r
+* *-B* <mask> obfuscated IP addresses in alerts and packet dumps using CIDR mask\r
+* *-C* print out payloads with character data only (no hex)\r
+* *-D* run Snort in background (daemon) mode\r
+* *-E* enable daemon restart\r
+* *-G* <0xid> (same as --logid)\r
+* *-H* make hash tables deterministic\r
+* *-K* <mode> logging mode\r
+* *-M* log messages to syslog (not alerts)\r
+* *-N* ignored - for REG_TEST only\r
+* *-O* obfuscate the logged IP addresses\r
+* *-Q* enable inline mode operation\r
+* *-R* <rules> include this rules file in the default policy\r
+* *-S* <n=v> set rules file variable n equal to value v\r
+* *-T* test and report on the current Snort configuration\r
+* *-U* use UTC for timestamps\r
+* *-V* (same as --version)\r
+* *-W* lists available interfaces\r
+* *-X* dump the raw packet data starting at the link layer\r
+* *-c* <conf> use this configuration\r
+* *-d* dump the Application Layer\r
+* *-e* display the second layer header info\r
+* *-f* turn off fflush() calls after binary log writes\r
+* *-g* <gname> run snort gid as <gname> group (or gid) after initialization\r
+* *-i* <iface>... list of interfaces\r
+* *-j* <port> to listen for telnet connections\r
+* *-k* <mode> checksum mode (all,noip,notcp,noudp,noicmp,none)\r
+* *-l* <logdir> log to this directory instead of current directory\r
+* *-m* <umask> set umask = <umask>\r
+* *-n* <count> stop after count packets\r
+* *-q* quiet mode - Don't show banner and status report\r
+* *-r* <pcap>... (same as --pcap-list)\r
+* *-s* <snap> (same as --snaplen)\r
+* *-t* <dir> chroots process to <dir> after initialization\r
+* *-u* <uname> run snort as <uname> or <uid> after initialization\r
+* *-v* be verbose\r
+* *-w* dump 802.11 management and control frames\r
+* *-x* same as --pedantic\r
+* *-y* include year in timestamp in the alert and log files\r
+* *-z* <count> maximum number of packet threads (same as --max-packet-threads)</code></pre>\r
+</div></div>\r
+</div>\r
+<div class="sect2">\r
<h3 id="_parameters">Parameters</h3>\r
<div class="paragraph"><p>Parameters are given with this format:</p></div>\r
<div class="literalblock">\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_configuration_2">Configuration</h3>\r
+<h3 id="_configuration_3">Configuration</h3>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
</li>\r
<li>\r
<p>\r
-int <strong>base64_decode.offset</strong>: Bytes past start of buffer to start decoding. { 0: }\r
+int <strong>base64_decode.offset</strong> = 0: Bytes past start of buffer to start decoding. { 0: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-string <strong>binder[].use.name</strong> = defaults to type: symbol name\r
+string <strong>binder[].use.name</strong>: symbol name (defaults to type)\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>binder[].when.policy_id</strong>: unique ID for selection of this config by external logic { 0: }\r
+int <strong>binder[].when.policy_id</strong> = 0: unique ID for selection of this config by external logic { 0: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>byte_extract.align</strong>: round the number of converted bytes up to the next 2- or 4-byte boundary { 0:4 }\r
+int <strong>byte_extract.align</strong> = 0: round the number of converted bytes up to the next 2- or 4-byte boundary { 0:4 }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>byte_extract.multiplier</strong>: scale extracted value by given amount { 1:65535 }\r
+int <strong>byte_extract.multiplier</strong> = 1: scale extracted value by given amount { 1:65535 }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>byte_jump.align</strong>: round the number of converted bytes up to the next 2- or 4-byte boundary { 0:4 }\r
+int <strong>byte_jump.align</strong> = 0: round the number of converted bytes up to the next 2- or 4-byte boundary { 0:4 }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>byte_jump.multiplier</strong>: scale extracted value by given amount { 1:65535 }\r
+int <strong>byte_jump.multiplier</strong> = 1: scale extracted value by given amount { 1:65535 }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>byte_jump.post_offset</strong>: also skip forward or backwards (positive of negative value) this number of bytes { -65535:65535 }\r
+int <strong>byte_jump.post_offset</strong> = 0: also skip forward or backwards (positive of negative value) this number of bytes { -65535:65535 }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>content.fast_pattern_length</strong>: maximum number of characters from this content the fast pattern matcher should use\r
+int <strong>content.fast_pattern_length</strong>: maximum number of characters from this content the fast pattern matcher should use { 1: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>content.fast_pattern_offset</strong>: number of leading characters of this content the fast pattern matcher should exclude\r
+int <strong>content.fast_pattern_offset</strong> = 0: number of leading characters of this content the fast pattern matcher should exclude { 0: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-string <strong>daq.type</strong> = pcap: select type of DAQ\r
+string <strong>daq.type</strong>: select type of DAQ\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-enum <strong>hosts[].frag_policy</strong> = linux: defragmentation policy { unknown | first | linux | bsd | bsd_right |last | windows | solaris }\r
+enum <strong>hosts[].frag_policy</strong>: defragmentation policy { first | linux | bsd | bsd_right | last | windows | solaris }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-enum <strong>hosts[].tcp_policy</strong> = linux: tcp reassembly policy { unknown | first | last | bsd | linux | old-linux | windows | win-2003 | vista | solaris | hpux | hpux10 | irix | macos }\r
+enum <strong>hosts[].tcp_policy</strong>: tcp reassembly policy { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-enum <strong>ips.mode</strong> = tap: set policy mode { tap | inline | inline-test }\r
+enum <strong>ips.mode</strong>: set policy mode { tap | inline | inline-test }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-bool <strong>log_codecs.file</strong> = stdout: output to log_codecs.txt instead of stdout\r
+bool <strong>log_codecs.file</strong> = false: output to log_codecs.txt instead of stdout\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-bool <strong>ppm.debug_pkts</strong> = false: enable packet debug\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-bool <strong>ppm.debug_rules</strong> = false: enable rule debug\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
bool <strong>ppm.fastpath_expensive_packets</strong> = false: stop inspection if the max_pkt_time is exceeded\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-int <strong>profile.modules.count</strong> = -1: print results to given level (-1 = all, 0 = off?) { -1: }\r
+int <strong>profile.modules.count</strong> = -1: print results to given level (-1 = all, 0 = off) { -1: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>profile.rules.count</strong> = -1: print results to given level (-1 = all, 0 = off?) { -1: }\r
+int <strong>profile.rules.count</strong> = -1: print results to given level (-1 = all, 0 = off) { -1: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-bool <strong>react.msg</strong>: use rule message in response page\r
+bool <strong>react.msg</strong> = false: use rule msg in response page instead of default message\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-string <strong>snort.--c2x</strong>: output hex for given char\r
+string <strong>snort.--c2x</strong>: output hex for given char (see also --x2c)\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>snort.--max-packet-threads</strong>: <count> configure maximum number of packet threads (same as -z) { 0: }\r
+int <strong>snort.--max-packet-threads</strong> = 1: <count> configure maximum number of packet threads (same as -z)\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>snort.--snaplen</strong>: <snap> set snaplen of packet (same as -s) { 68:65535 }\r
+int <strong>snort.--snaplen</strong> = 1514: <snap> set snaplen of packet (same as -s) { 68:65535 }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
+implied <strong>snort.--warn-conf</strong>: warn about configuration issues\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+implied <strong>snort.--warn-daq</strong>: warn about DAQ issues, usually related to mode\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
implied <strong>snort.--warn-flowbits</strong>: warn about flowbits that are checked but not set and vice-versa\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>snort.--warn-unknown</strong>: warn about unknown symbols in your config\r
+implied <strong>snort.--warn-hosts</strong>: warn about host table issues\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>snort.--x2c</strong>: output ASCII char for given hex\r
+implied <strong>snort.--warn-rules</strong>: warn about duplicate rules and rule parsing issues\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+implied <strong>snort.--warn-scripts</strong>: warn about issues discovered while processing Lua scripts\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+implied <strong>snort.--warn-symbols</strong>: warn about unknown symbols in your Lua config\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+implied <strong>snort.--warn-vars</strong>: warn about variable definition and usage issues\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>snort.--x2c</strong>: output ASCII char for given hex (see also --c2x)\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>snort.-s</strong>: <snap> (same as --snaplen) { 68:65535 }\r
+int <strong>snort.-s</strong> = 1514: <snap> (same as --snaplen) { 68:65535 }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>snort.-z</strong>: <count> maximum number of packet threads (same as --max-packet-threads) { 1: }\r
+int <strong>snort.-z</strong> = 1: <count> maximum number of packet threads (same as --max-packet-threads)\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
+int <strong>ssh.max_client_bytes</strong> = 19600: number of unanswered bytes before alerting on challenge-response overflow or CRC32 { 0:65535 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>ssh.max_encrypted_packets</strong> = 25: ignore session after this many encrypted packets { 0:65535 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>ssh.max_server_version_len</strong> = 80: limit before alerting on secure CRT server version string overflow { 0:255 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
int <strong>stream.icmp_cache.idle_timeout</strong> = 60: maximum inactive time before retiring session tracker { 1: }\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream.icmp_cache.memcap</strong>: maximum cache memory { 0: }\r
+int <strong>stream.icmp_cache.memcap</strong> = 0: maximum cache memory { 0: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream.ip_cache.memcap</strong>: maximum cache memory { 0: }\r
+int <strong>stream.ip_cache.memcap</strong> = 0: maximum cache memory { 0: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream.tcp_cache.memcap</strong>: maximum cache memory { 0: }\r
+int <strong>stream.tcp_cache.memcap</strong> = 0: maximum cache memory { 0: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream.udp_cache.memcap</strong>: maximum cache memory { 0: }\r
+int <strong>stream.udp_cache.memcap</strong> = 0: maximum cache memory { 0: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-enum <strong>stream_tcp.policy</strong> = linux: determines operating system characteristics like reassembly { first | last | linux | old-linux | bsd | macos | solaris | irix | hpux | hpux10 | windows | win-2003 | vista | proxy }\r
+enum <strong>stream_tcp.policy</strong> = bsd: determines operating system characteristics like reassembly { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy }\r
</p>\r
</li>\r
<li>\r
<li>\r
<p>\r
string <strong>wizard.spells[].to_server[].spell</strong>: sequence of data with wild cards (*)\r
+ 0 gets the number of CPU cores reported by the system { 0: }\r
+ 0 gets the number of CPU cores reported by the system { 0: }\r
</p>\r
</li>\r
</ul></div>\r
</li>\r
<li>\r
<p>\r
+<strong>dns.packets</strong>: total packets\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>ftp_data.packets</strong>: total packets\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>ssh.packets</strong>: total packets\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>stream.icmp flows</strong>: total icmp sessions\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>128</strong>: ssh\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>129</strong>: stream_tcp\r
</p>\r
</li>\r
<li>\r
<p>\r
+<strong>131</strong>: dns\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>134</strong>: ppm\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>128:1</strong> (ssh) Challenge-Response Overflow exploit\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>128:2</strong> (ssh) SSH1 CRC32 exploit\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>128:3</strong> (ssh) Server version string overflow\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>128:5</strong> (ssh) Bad message direction\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>128:6</strong> (ssh) Payload size incorrect for the given payload\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>128:7</strong> (ssh) Failed to detect SSH version string\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>129:1</strong> (stream_tcp) SYN on established session\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>131:1</strong> (dns) Obsolete DNS RR Types\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>131:2</strong> (dns) Experimental DNS RR Types\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>131:3</strong> (dns) DNS Client rdata txt Overflow\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>134:1</strong> (ppm) rule options disabled by rule latency\r
</p>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_signals">Signals</h3>\r
+<h3 id="_signals_2">Signals</h3>\r
<div class="admonitionblock">\r
<table><tr>\r
<td class="icon">\r
change -> detection: 'search-method' ==> 'search_method'\r
change -> detection: 'search-optimize' ==> 'search_optimize'\r
change -> detection: 'split-any-any' ==> 'split_any_any'\r
+change -> dns: 'ports' ==> 'bindings'\r
change -> event_filter: 'gen_id' ==> 'gid'\r
change -> event_filter: 'sig_id' ==> 'sid'\r
change -> event_filter: 'threshold' ==> 'event_filter'\r
change -> perfmonitor: 'snortfile' ==> 'file = true'\r
change -> perfmonitor: 'time' ==> 'seconds'\r
change -> policy_mode: 'inline_test' ==> 'inline-test'\r
-change -> ppm: 'debug-pkts' ==> 'debug_pkts'\r
change -> ppm: 'max-pkt-time' ==> 'max_pkt_time'\r
change -> ppm: 'max-rule-time' ==> 'max_rule_time'\r
change -> ppm: 'pkt-log' ==> 'pkt_log'\r
change -> rule_state: 'enabled' ==> 'enable'\r
change -> sfportscan: 'proto' ==> 'protos'\r
change -> sfportscan: 'scan_type' ==> 'scan_types'\r
+change -> ssh: 'server_ports' ==> 'bindings'\r
change -> stream5_global: 'max_active_responses' ==> 'max_responses'\r
change -> stream5_global: 'max_icmp' ==> 'max_sessions'\r
change -> stream5_global: 'max_ip' ==> 'max_sessions'\r
change -> stream5_tcp: 'dont_reassemble_async' ==> 'reassemble_async'\r
change -> stream5_tcp: 'max_queued_bytes' ==> 'queue_limit.max_bytes'\r
change -> stream5_tcp: 'max_queued_segs' ==> 'queue_limit.max_segments'\r
-change -> stream5_tcp: 'policy hpux11' ==> 'stream_tcp.policy = hpux'\r
-change -> stream5_tcp: 'policy win2k3' ==> 'stream_tcp.policy = win-2003'\r
+change -> stream5_tcp: 'policy hpux' ==> 'stream_tcp.policy = hpux11'\r
change -> stream5_tcp: 'timeout' ==> 'session_timeout'\r
change -> stream5_tcp: 'use_static_footprint_sizes' ==> 'footprint'\r
change -> stream5_udp: 'timeout' ==> 'session_timeout'\r
deleted -> csv: 'default'\r
deleted -> csv: 'trheader'\r
deleted -> detection: 'mwm'\r
+deleted -> dns: 'enable_experimental_types'\r
+deleted -> dns: 'enable_obsolete_types'\r
+deleted -> dns: 'enable_rdata_overflow'\r
deleted -> fast: '<filename> can no longer be specific'\r
deleted -> frag3_engine: 'detect_anomalies'\r
deleted -> frag3_global: 'disabled'\r
deleted -> perfmonitor: 'atexitonly: events-stats'\r
deleted -> perfmonitor: 'atexitonly: flow-ip-stats'\r
deleted -> perfmonitor: 'atexitonly: flow-stats'\r
+deleted -> ppm: 'debug-pkts'\r
deleted -> react: 'block'\r
deleted -> react: 'warn'\r
deleted -> rpc_decode: 'alert_fragments'\r
deleted -> sfportscan: 'detect_ack_scans'\r
deleted -> sfportscan: 'disabled'\r
deleted -> sfportscan: 'logfile'\r
+deleted -> ssh: 'autodetect'\r
+deleted -> ssh: 'enable_badmsgdir'\r
+deleted -> ssh: 'enable_paysize'\r
+deleted -> ssh: 'enable_protomismatch'\r
+deleted -> ssh: 'enable_recognition'\r
+deleted -> ssh: 'enable_respoverflow'\r
+deleted -> ssh: 'enable_srvoverflow'\r
+deleted -> ssh: 'enable_ssh1crc32'\r
deleted -> stream5_global: 'disabled'\r
deleted -> stream5_global: 'flush_on_alert'\r
deleted -> stream5_global: 'no_midstream_drop_alerts'\r
</li>\r
<li>\r
<p>\r
+<strong>dns</strong> (inspector): dns inspection\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>dsize</strong> (ips_option): rule option to test payload size\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>ssh</strong> (inspector): ssh inspection\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>stream</strong> (inspector): common flow tracking\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>inspector::dns</strong>: dns inspection\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>inspector::ftp_data</strong>: FTP data channel handler\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>inspector::ssh</strong>: ssh inspection\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>inspector::stream</strong>: common flow tracking\r
</p>\r
</li>\r
<div class="sect2">\r
<h3 id="_extending_snort">Extending Snort++</h3>\r
<div class="sect3">\r
-<h4 id="_plugins">Plugins</h4>\r
+<h4 id="_plugins_2">Plugins</h4>\r
<div class="paragraph"><p>Snort++ uses a variety of plugins to accomplish much of its processing\r
objectives, including:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
Don’t hesitate to create a new header if it is needed. Don’t lump\r
- unrelated stuff into a header because it is convenient.\r
+ unrelated stuff into an header because it is convenient.\r
</p>\r
</li>\r
<li>\r
<p>\r
Includes from a different directory should specify parent directory.\r
This makes it clear exactly what is included and avoids the primordial\r
- soup that results from using -I this -I that -I the-other-thing … .\r
+ soup that results from using -I this -I that -I the_other_thing … .\r
</p>\r
<div class="literalblock">\r
<div class="content">\r
<div class="paragraph"><p>Currently using uncrustify from at <a href="https://github.com/bengardner/uncrustify">https://github.com/bengardner/uncrustify</a>\r
to reformat legacy code and anything that happens to need a makeover at\r
some point.</p></div>\r
-<div class="paragraph"><p>The working config is crusty.cfg in the top level directory. It does well,\r
+<div class="paragraph"><p>The working config is crusty.cfg in the top level directory. It does well\r
but will munge some things. Specially formatted INDENT-OFF comments were\r
added in 2 places to avoid a real mess.</p></div>\r
</div>\r
<div id="footnotes"><hr /></div>\r
<div id="footer">\r
<div id="footer-text">\r
-Last updated 2015-02-27 09:57:19 EST\r
+Last updated 2015-03-30 16:54:22 EDT\r
</div>\r
</div>\r
</body>\r
projects / thirdparty / snort3.git / commitdiff
