From: Russ Combs Date: Tue, 31 Mar 2015 13:03:36 +0000 (-0400) Subject: updated autotools generation of api_options.h; bumped build to 144 X-Git-Tag: 3.0.0-233~1008 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bf86a499665dfb5a23486b57f1945b961293842e;p=thirdparty%2Fsnort3.git updated autotools generation of api_options.h; bumped build to 144 --- diff --git a/ChangeLog b/ChangeLog index f601ac2f8..b2575dafe 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,7 @@ -Pending - build 144 +15/03/31 - build 144 +-- reworked autotools generation of api_options.h +-- updated default manuals -- ported dns inspector 15/03/26 - build 143 diff --git a/configure.ac b/configure.ac index be9a2884c..3c72cc6be 100644 --- a/configure.ac +++ b/configure.ac @@ -31,7 +31,7 @@ AC_PREREQ([2.69]) AC_CONFIG_SRCDIR([src/main.h]) AC_CONFIG_MACRO_DIR([m4]) -AC_CONFIG_HEADERS([config.h]) +AC_CONFIG_HEADERS([config.h src/framework/api_options.h]) AM_INIT_AUTOMAKE @@ -77,8 +77,7 @@ API_OPTIONS="" # API_OPTIONS="$API_OPTIONS option-name" # API_OPTIONS is #defined in config.h but that file is not exported so it -# is also #defined in api_options.h which is installed by -# src/framework/Makefile.am. +# is also #defined in api_options.h. #-------------------------------------------------------------------------- # host magic :( diff --git a/doc/config_changes.txt b/doc/config_changes.txt index da36cf396..45d1d500b 100644 --- a/doc/config_changes.txt +++ b/doc/config_changes.txt @@ -66,6 +66,7 @@ change -> detection: 'max-pattern-len' ==> 'max_pattern_len' change -> detection: 'search-method' ==> 'search_method' change -> detection: 'search-optimize' ==> 'search_optimize' change -> detection: 'split-any-any' ==> 'split_any_any' +change -> dns: 'ports' ==> 'bindings' change -> event_filter: 'gen_id' ==> 'gid' change -> event_filter: 'sig_id' ==> 'sid' change -> event_filter: 'threshold' ==> 'event_filter' @@ -229,6 +230,9 @@ deleted -> csv: ' can no longer be specific' deleted -> csv: 'default' deleted -> csv: 'trheader' deleted -> detection: 'mwm' +deleted -> dns: 'enable_experimental_types' +deleted -> dns: 'enable_obsolete_types' +deleted -> dns: 'enable_rdata_overflow' deleted -> fast: ' can no longer be specific' deleted -> frag3_engine: 'detect_anomalies' deleted -> frag3_global: 'disabled' @@ -252,6 +256,7 @@ deleted -> rule_state: 'action' deleted -> sfportscan: 'detect_ack_scans' deleted -> sfportscan: 'disabled' deleted -> sfportscan: 'logfile' +deleted -> ssh: 'autodetect' deleted -> ssh: 'enable_badmsgdir' deleted -> ssh: 'enable_paysize' deleted -> ssh: 'enable_protomismatch' diff --git a/doc/default_snort_manual.html b/doc/default_snort_manual.html index a4ff8710a..5379d3e1d 100644 --- a/doc/default_snort_manual.html +++ b/doc/default_snort_manual.html @@ -781,7 +781,7 @@ asciidoc.install(2); 
 ,,_     -*> Snort++ <*-
-o"  )~   Version 3.0.0-a1 (Build 140) from 2.9.6-9
+o"  )~   Version 3.0.0-a1 (Build 144) from 2.9.6-9
  ''''    By Martin Roesch & The Snort Team
          http://snort.org/contact#team
          Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved.
@@ -1338,13 +1338,29 @@ ln -s $my_path/conf $my_path/etc

  • -You can also specify a cmake project generator or use ccmake: +You can also specify a cmake project generator: 

    ./configure_cmake.sh --generator=Xcode --prefix=$my_path
    • +
  • +

    +Or use ccmake directly to configure and generate from an arbitrary build + directory like one of these: +

    +
    +
    +
    ccmake -G Xcode /path/to/Snort++/tree
+open snort.xcodeproj
    +
    +
    +
    +
    ccmake -G "Eclipse CDT4 - Unix Makefiles" /path/to/Snort++/tree
+run eclipse and do File > Import > Existing Eclipse Project
    +
    +
    • @@ -1962,7 +1978,7 @@ bool daq.no_promisc = false: whether to put DAQ device into pro

  • -string daq.type = pcap: select type of DAQ +string daq.type: select type of DAQ

  • @@ -2331,12 +2347,12 @@ addr hosts[].ip = 0.0.0.0/32: hosts address / cidr

  • -enum hosts[].frag_policy = linux: defragmentation policy { unknown | first | linux | bsd | bsd_right |last | windows | solaris } +enum hosts[].frag_policy: defragmentation policy { first | linux | bsd | bsd_right | last | windows | solaris }

  • -enum hosts[].tcp_policy = linux: tcp reassembly policy { unknown | first | last | bsd | linux | old-linux | windows | win-2003 | vista | solaris | hpux | hpux10 | irix | macos } +enum hosts[].tcp_policy: tcp reassembly policy { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy }

  • @@ -2379,7 +2395,7 @@ string ips.include: legacy snort rules and includes

  • -enum ips.mode = tap: set policy mode { tap | inline | inline-test } +enum ips.mode: set policy mode { tap | inline | inline-test }

  • @@ -2576,11 +2592,6 @@ enum ppm.pkt_log = none: log event if max_pkt_time is exceeded

  • -bool ppm.debug_pkts = false: enable packet debug -

    -
    • -
  • -

    int ppm.max_rule_time = 0: enable rule latency thresholding (usec), 0 = off { 0: }

    • @@ -2604,11 +2615,6 @@ int ppm.suspend_timeout = 60: seconds to suspend rule, 0 = perm enum ppm.rule_log = none: enable event logging for suspended rules { none|log|alert|both }

    -
  • -

    -bool ppm.debug_rules = false: enable rule debug -

    -

    • Rules:

      @@ -2695,7 +2701,7 @@ bool process.utc = false: use UTC instead of local time for tim

      • -int profile.rules.count = -1: print results to given level (-1 = all, 0 = off?) { -1: } +int profile.rules.count = -1: print results to given level (-1 = all, 0 = off) { -1: }

      • @@ -2705,7 +2711,7 @@ enum profile.rules.sort = avg_ticks: sort by given field { chec

      • -int profile.modules.count = -1: print results to given level (-1 = all, 0 = off?) { -1: } +int profile.modules.count = -1: print results to given level (-1 = all, 0 = off) { -1: }

      • @@ -3035,7 +3041,7 @@ string snort.-S: <n=v> set rules file variable n equal to

      • -int snort.-s: <snap> (same as --snaplen) { 68:65535 } +int snort.-s = 1514: <snap> (same as --snaplen) { 68:65535 }

      • @@ -3095,7 +3101,8 @@ implied snort.-y: include year in timestamp in the alert and lo

      • -int snort.-z: <count> maximum number of packet threads (same as --max-packet-threads) { 1: } +int snort.-z = 1: <count> maximum number of packet threads (same as --max-packet-threads) + 0 gets the number of CPU cores reported by the system { 0: }

      • @@ -3110,7 +3117,7 @@ string snort.--bpf: <filter options> are standard BPF opt

      • -string snort.--c2x: output hex for given char +string snort.--c2x: output hex for given char (see also --x2c)

      • @@ -3270,7 +3277,8 @@ implied snort.--markup: output help in asciidoc compatible form

      • -int snort.--max-packet-threads: <count> configure maximum number of packet threads (same as -z) { 0: } +int snort.--max-packet-threads = 1: <count> configure maximum number of packet threads (same as -z) + 0 gets the number of CPU cores reported by the system { 0: }

      • @@ -3390,7 +3398,7 @@ int snort.--skip: <n> skip 1st n packets { 0: }

      • -int snort.--snaplen: <snap> set snaplen of packet (same as -s) { 68:65535 } +int snort.--snaplen = 1514: <snap> set snaplen of packet (same as -s) { 68:65535 }

      • @@ -3420,17 +3428,47 @@ implied snort.--warn-all: enable all warnings

      • +implied snort.--warn-conf: warn about configuration issues +

        +
        • +
      • +

        +implied snort.--warn-daq: warn about DAQ issues, usually related to mode +

        +
        • +
      • +

        implied snort.--warn-flowbits: warn about flowbits that are checked but not set and vice-versa

      • -implied snort.--warn-unknown: warn about unknown symbols in your config +implied snort.--warn-hosts: warn about host table issues +

        +
        • +
      • +

        +implied snort.--warn-rules: warn about duplicate rules and rule parsing issues +

        +
        • +
      • +

        +implied snort.--warn-scripts: warn about issues discovered while processing Lua scripts +

        +
        • +
      • +

        +implied snort.--warn-symbols: warn about unknown symbols in your Lua config +

        +
        • +
      • +

        +implied snort.--warn-vars: warn about variable definition and usage issues

      • -int snort.--x2c: output ASCII char for given hex +int snort.--x2c: output ASCII char for given hex (see also --c2x)

      @@ -5045,7 +5083,7 @@ mac arp_spoof.hosts[].mac: host mac address

      • -int binder[].when.policy_id: unique ID for selection of this config by external logic { 0: } +int binder[].when.policy_id = 0: unique ID for selection of this config by external logic { 0: }

      • @@ -5105,7 +5143,7 @@ string binder[].use.type: select module for binding

      • -string binder[].use.name = defaults to type: symbol name +string binder[].use.name: symbol name (defaults to type)

      @@ -5134,6 +5172,37 @@ string binder[].use.name = defaults to type: symbol name
    +

    dns

    +

    What: dns inspection

    +

    Type: inspector

    +

    Rules:

    +
      +
    • +

      +131:1 (dns) Obsolete DNS RR Types +

      +
      • +
    • +

      +131:2 (dns) Experimental DNS RR Types +

      +
      • +
    • +

      +131:3 (dns) DNS Client rdata txt Overflow +

      +
      • +
    +

    Peg counts:

    +
      +
    • +

      +dns.packets: total packets +

      +
      • +
    +
    +

    ftp_data

    What: FTP data channel handler

    Type: inspector

    @@ -6672,6 +6741,70 @@ bool port_scan.logfile = false: write scan events to file
    +

    ssh

    +

    What: ssh inspection

    +

    Type: inspector

    +

    Configuration:

    +
      +
    • +

      +int ssh.max_encrypted_packets = 25: ignore session after this many encrypted packets { 0:65535 } +

      +
      • +
    • +

      +int ssh.max_client_bytes = 19600: number of unanswered bytes before alerting on challenge-response overflow or CRC32 { 0:65535 } +

      +
      • +
    • +

      +int ssh.max_server_version_len = 80: limit before alerting on secure CRT server version string overflow { 0:255 } +

      +
      • +
    +

    Rules:

    +
      +
    • +

      +128:1 (ssh) Challenge-Response Overflow exploit +

      +
      • +
    • +

      +128:2 (ssh) SSH1 CRC32 exploit +

      +
      • +
    • +

      +128:3 (ssh) Server version string overflow +

      +
      • +
    • +

      +128:5 (ssh) Bad message direction +

      +
      • +
    • +

      +128:6 (ssh) Payload size incorrect for the given payload +

      +
      • +
    • +

      +128:7 (ssh) Failed to detect SSH version string +

      +
      • +
    +

    Peg counts:

    +
      +
    • +

      +ssh.packets: total packets +

      +
      • +
    +
    +

    stream

    What: common flow tracking

    Type: inspector

    @@ -6679,7 +6812,7 @@ bool port_scan.logfile = false: write scan events to file

    • -int stream.icmp_cache.memcap: maximum cache memory { 0: } +int stream.icmp_cache.memcap = 0: maximum cache memory { 0: }

    • @@ -6699,7 +6832,7 @@ int stream.icmp_cache.max_sessions = 262144: maximum simultaneo

    • -int stream.ip_cache.memcap: maximum cache memory { 0: } +int stream.ip_cache.memcap = 0: maximum cache memory { 0: }

    • @@ -6719,7 +6852,7 @@ int stream.ip_cache.max_sessions = 262144: maximum simultaneous

    • -int stream.tcp_cache.memcap: maximum cache memory { 0: } +int stream.tcp_cache.memcap = 0: maximum cache memory { 0: }

    • @@ -6739,7 +6872,7 @@ int stream.tcp_cache.max_sessions = 262144: maximum simultaneou

    • -int stream.udp_cache.memcap: maximum cache memory { 0: } +int stream.udp_cache.memcap = 0: maximum cache memory { 0: }

    • @@ -7025,7 +7158,7 @@ int stream_tcp.max_pdu = 16384: maximum reassembled PDU size {

    • -enum stream_tcp.policy = linux: determines operating system characteristics like reassembly { first | last | linux | old-linux | bsd | macos | solaris | irix | hpux | hpux10 | windows | win-2003 | vista | proxy } +enum stream_tcp.policy = bsd: determines operating system characteristics like reassembly { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy }

    • @@ -7511,7 +7644,7 @@ parse.

    • -bool react.msg: use rule message in response page +bool react.msg = false: use rule msg in response page instead of default message

    • @@ -7614,7 +7747,7 @@ int base64_decode.bytes: Number of base64 encoded bytes to deco

    • -int base64_decode.offset: Bytes past start of buffer to start decoding. { 0: } +int base64_decode.offset = 0: Bytes past start of buffer to start decoding. { 0: }

    • @@ -7665,12 +7798,12 @@ implied byte_extract.relative: offset from cursor instead of st

    • -int byte_extract.multiplier: scale extracted value by given amount { 1:65535 } +int byte_extract.multiplier = 1: scale extracted value by given amount { 1:65535 }

    • -int byte_extract.align: round the number of converted bytes up to the next 2- or 4-byte boundary { 0:4 } +int byte_extract.align = 0: round the number of converted bytes up to the next 2- or 4-byte boundary { 0:4 }

    • @@ -7738,17 +7871,17 @@ implied byte_jump.from_beginning: jump from start of buffer ins

    • -int byte_jump.multiplier: scale extracted value by given amount { 1:65535 } +int byte_jump.multiplier = 1: scale extracted value by given amount { 1:65535 }

    • -int byte_jump.align: round the number of converted bytes up to the next 2- or 4-byte boundary { 0:4 } +int byte_jump.align = 0: round the number of converted bytes up to the next 2- or 4-byte boundary { 0:4 }

    • -int byte_jump.post_offset: also skip forward or backwards (positive of negative value) this number of bytes { -65535:65535 } +int byte_jump.post_offset = 0: also skip forward or backwards (positive of negative value) this number of bytes { -65535:65535 }

    • @@ -7892,12 +8025,12 @@ implied content.fast_pattern: use this content in the fast patt

    • -int content.fast_pattern_offset: number of leading characters of this content the fast pattern matcher should exclude +int content.fast_pattern_offset = 0: number of leading characters of this content the fast pattern matcher should exclude { 0: }

    • -int content.fast_pattern_length: maximum number of characters from this content the fast pattern matcher should use +int content.fast_pattern_length: maximum number of characters from this content the fast pattern matcher should use { 1: }

    • @@ -8861,7 +8994,7 @@ bool alert_test.msg = false: include alert msg

      • -bool log_codecs.file = stdout: output to log_codecs.txt instead of stdout +bool log_codecs.file = false: output to log_codecs.txt instead of stdout

      • @@ -10026,622 +10159,498 @@ have a .lua or .rules extension appended to the original filename.

    -

    Optional Features

    -

    Listed below are the features that must be explicitly enabled so they are built -into the Snort binary. For a full list of build features, run ./configure ---help.

    -
      -
    • -

      ---enable-ppm: enable packet and rule performance monitoring and coarse - latency enforcement. -

      -
      • -
    • -

      ---enable-perf-profiling: enable module and rule performance profiling. -

      -
      • -
    • -

      ---enable-shell: enable local and remote command line shell support. -

      -
      • -
    +

    Usage

    +

    For the following examples "$my_path" is assumed to be the path to +the Snort++ install directory. Additionally, it is assumed that +"$my_path/bin" is in your PATH.

    +
    +

    Environment

    +

    LUA_PATH is used directly by Lua to load and run required libraries. +SNORT_LUA_PATH is used by Snort to load supplemental configuration files.

    +
    +
    +
    export LUA_PATH=$my_path/include/snort/lua/\?.lua\;\;
+export SNORT_LUA_PATH=$my_path/etc/snort
    +
    -
    -

    Environment Variables

    -
      -
    • -

      -HOSTTYPE: optional string that is output with the version at end of - line. -

      -
      • -
    • -

      -LUA_PATH: you must export as follows so LuaJIT can find required - files. -

      +
      +

      Help

      +

      Print the help summary:

      -
      LUA_PATH=$install_dir/include/snort/lua/\?.lua\;\;
      +
      snort --help
      -
      • -
    • -

      -SNORT_IGNORE: the list of symbols Snort should ignore when parsing the - Lua conf. Unknown symbols not in SNORT_IGNORE will cause warnings with - --warn-unknown or fatals with --warn-unknown --pedantic. -

      -
      • -
    • -

      -SNORT_LUA_PATH: an optional path where Snort can find supplemental conf - files such as classification.lua. -

      -
      • -
    • -

      -SNORT_PROMPT: the character sequence that is printed at startup, - shutdown, and in the shell. The default is the mini-pig: o")~ . -

      -
      • -
    • -

      -SNORT_PLUGIN_PATH: an optional path where Snort can find supplemental - shared libraries. This is only used when Snort is building manuals. - Modules in supplemental shared libraries will be added to the manuals. -

      -
      • -
    +

    Get help on a specific module ("stream", for example):

    +
    +
    +
    snort --help-module stream
    +
    +

    Get help on the "-A" command line option:

    +
    +
    +
    snort --help-options A
    +
    +

    Grep for help on threads:

    +
    +
    +
    snort --help-config | grep thread
    +
    +

    Output help on "rule" options in AsciiDoc format:

    +
    +
    +
    snort --markup --help-options rule
    +
    +
    + + + +
    +Note +Snort++ stops reading command-line options after the "--help-" and +"--list-" options, so any other options should be placed before them.
    -
    -

    Command Line Options

    -
      -
    • -

      ---alert-before-pass process alert, drop, sdrop, or reject before pass; default is pass before alert, drop,… -

      -
      • -
    • -

      ---bpf <filter options> are standard BPF options, as seen in TCPDump -

      -
      • -
    • -

      ---c2x output hex for given char -

      -
      • -
    • -

      ---create-pidfile create PID file, even when not in Daemon mode -

      -
      • -
    • -

      ---daq <type> select packet acquisition module (default is pcap) -

      -
      • -
    • -

      ---daq-dir <dir> tell snort where to find desired DAQ -

      -
      • -
    • -

      ---daq-list list packet acquisition modules available in optional dir, default is static modules only -

      -
      • -
    • -

      ---daq-mode <mode> select the DAQ operating mode -

      -
      • -
    • -

      ---daq-var <name=value> specify extra DAQ configuration variable -

      -
      • -
    • -

      ---dirty-pig don’t flush packets on shutdown -

      -
      • -
    • -

      ---dump-builtin-rules [<module prefix>] output stub rules for selected modules -

      -
      • -
    • -

      ---dump-defaults [<module prefix>] output module defaults in Lua format -

      -
      • -
    • -

      ---dump-dynamic-rules output stub rules for all loaded rules libraries -

      -
      • -
    • -

      ---dump-version output the version, the whole version, and only the version -

      -
      • -
    • -

      ---enable-inline-test enable Inline-Test Mode Operation -

      -
      • -
    • -

      ---help list command line options -

      -
      • -
    • -

      ---help-commands [<module prefix>] output matching commands -

      -
      • -
    • -

      ---help-config [<module prefix>] output matching config options -

      -
      • -
    • -

      ---help-counts [<module prefix>] output matching peg counts -

      -
      • -
    • -

      ---help-module <module> output description of given module -

      -
      • -
    • -

      ---help-modules list all available modules with brief help -

      -
      • -
    • -

      ---help-options <option prefix> output matching command line option quick help (same as -?) -

      -
      • -
    • -

      ---help-plugins list all available plugins with brief help -

      -
      • -
    • -

      ---help-signals dump available control signals -

      -
      • -
    • -

      ---id-subdir create/use instance subdirectories in logdir instead of instance filename prefix -

      -
      • -
    • -

      ---id-zero use id prefix / subdirectory even with one packet thread -

      -
      • -
    • -

      ---list-buffers output available inspection buffers -

      -
      • -
    • -

      ---list-builtin <module prefix> output matching builtin rules -

      -
      • -
    • -

      ---list-gids [<module prefix>] output matching generators -

      -
      • -
    • -

      ---list-modules [<module type>] list all known modules of given type -

      -
      • -
    • -

      ---list-plugins list all known plugins -

      -
      • -
    • -

      ---logid <0xid> log Identifier to uniquely id events for multiple snorts (same as -G) -

      -
      • -
    • -

      ---lua <chunk> extend/override conf with chunk; may be repeated -

      -
      • -
    • -

      ---markup output help in asciidoc compatible format -

      -
      • -
    • -

      ---max-packet-threads <count> configure maximum number of packet threads (same as -z) -

      -
      • -
    • -

      ---nolock-pidfile do not try to lock Snort PID file -

      -
      • -
    • -

      ---nostamps don’t include timestamps in log file names -

      -
      • -
    • -

      ---pause wait for resume/quit command before processing packets/terminating -

      -
      • -
    • -

      ---pcap-dir <dir> a directory to recurse to look for pcaps - read mode is implied -

      -
      • -
    • -

      ---pcap-file <file> file that contains a list of pcaps to read - read mode is implied -

      -
      • -
    • -

      ---pcap-filter <filter> filter to apply when getting pcaps from file or directory -

      -
      • -
    • -

      ---pcap-list <list> a space separated list of pcaps to read - read mode is implied -

      -
      • -
    • -

      ---pcap-loop <count> read all pcaps <count> times; 0 will read until Snort is terminated -

      -
      • -
    • -

      ---pcap-no-filter reset to use no filter when getting pcaps from file or directory -

      -
      • -
    • -

      ---pcap-reload if reading multiple pcaps, reload snort config between pcaps -

      -
      • -
    • -

      ---pcap-reset ignored - for REG_TEST only -

      -
      • -
    • -

      ---pcap-show print a line saying what pcap is currently being read -

      -
      • -
    • -

      ---pedantic warnings are fatal -

      -
      • -
    • -

      ---plugin-path <path> where to find plugins -

      -
      • -
    • -

      ---process-all-events process all action groups -

      -
      • -
    • -

      ---rule <rules> to be added to configuration; may be repeated -

      -
      • -
    • -

      ---rule-to-hex output so rule header to stdout for text rule on stdin -

      -
      • -
    • -

      ---rule-to-text output plain so rule header to stdout for text rule on stdin -

      -
      • -
    • -

      ---run-prefix <pfx> prepend this to each output file -

      -
      • -
    • -

      ---script-path <path> where to find luajit scripts -

      -
      • -
    • -

      ---shell enable the interactive command line -

      -
      • -
    • -

      ---show-plugins list module and plugin versions -

      -
      • -
    • -

      ---skip <n> skip 1st n packets -

      -
      • -
    • -

      ---snaplen <snap> set snaplen of packet (same as -s) -

      -
      • -
    • -

      ---stdin-rules read rules from stdin until EOF or a line starting with END is read -

      -
      • -
    • -

      ---treat-drop-as-alert converts drop, sdrop, and reject rules into alert rules during startup -

      -
      • -
    • -

      ---treat-drop-as-ignore use drop, sdrop, and reject rules to ignore session traffic when not inline -

      -
      • -
    • -

      ---version show version number (same as -V) -

      -
      • -
    • -

      ---warn-all enable all warnings -

      -
      • -
    • -

      ---warn-flowbits warn about flowbits that are checked but not set and vice-versa -

      -
      • -
    • -

      ---warn-unknown warn about unknown symbols in your config -

      -
      • -
    • -

      ---x2c output ASCII char for given hex -

      -
      • -
    • -

      --? <option prefix> output matching command line option quick help (same as --help-options) -

      -
      • -
    • -

      --A <mode> set alert mode: none, cmg, or alert_* -

      -
      • -
    • -

      --B <mask> obfuscated IP addresses in alerts and packet dumps using CIDR mask -

      -
      • -
    • -

      --C print out payloads with character data only (no hex) -

      -
      • -
    • -

      --D run Snort in background (daemon) mode -

      -
      • -
    • -

      --E enable daemon restart -

      -
      • -
    • -

      --G <0xid> (same as --logid) -

      -
      • -
    • -

      --H make hash tables deterministic -

      -
      • -
    • -

      --K <mode> logging mode -

      -
      • -
    • -

      --M log messages to syslog (not alerts) -

      -
      • -
    • -

      --N ignored - for REG_TEST only -

      -
      • -
    • -

      --O obfuscate the logged IP addresses -

      -
      • -
    • -

      --Q enable inline mode operation -

      -
      • -
    • -

      --R <rules> include this rules file in the default policy -

      -
      • -
    • -

      --S <n=v> set rules file variable n equal to value v -

      -
      • -
    • -

      --T test and report on the current Snort configuration -

      -
      • -
    • -

      --U use UTC for timestamps -

      -
      • -
    • -

      --V (same as --version) -

      -
      • -
    • -

      --W lists available interfaces -

      -
      • -
    • -

      --X dump the raw packet data starting at the link layer -

      -
      • -
    • -

      --c <conf> use this configuration -

      -
      • -
    • -

      --d dump the Application Layer -

      -
      • -
    • -

      --e display the second layer header info -

      -
      • -
    • -

      --f turn off fflush() calls after binary log writes -

      -
      • -
    • -

      --g <gname> run snort gid as <gname> group (or gid) after initialization -

      -
      • -
    • -

      --i <iface>… list of interfaces -

      -
      • -
    • -

      --j <port> to listen for telnet connections -

      -
      • -
    • -

      --k <mode> checksum mode (all,noip,notcp,noudp,noicmp,none) -

      -
      • -
    • -

      --l <logdir> log to this directory instead of current directory -

      -
      • -
    • -

      --m <umask> set umask = <umask> -

      -
      • -
    • -

      --n <count> stop after count packets -

      -
      • -
    • -

      --q quiet mode - Don’t show banner and status report -

      -
      • +
    +
    +

    Sniffing and Logging

    +

    Read a pcap:

    +
    +
    +
    snort -r /path/to/my.pcap
    +
    +

    Dump the packets to stdout:

    +
    +
    +
    snort -r /path/to/my.pcap -K text
    +
    +

    Dump packets with application data and layer 2 headers

    +
    +
    +
    snort -r /path/to/my.pcap -K text -d -e
    +
    +
    + + + +
    +Note +Command line options must be specified separately. "snort -de" won’t +work. You can still concatenate options and their arguments, however, so +"snort -Ktext" will work.
    +
    +

    Dump packets from all pcaps in a directory:

    +
    +
    +
    snort --pcap-dir /path/to/pcap/dir --pcap-filter '*.pcap' -K text -d -e
    +
    +

    Log packets to a directory:

    +
    +
    +
    snort --pcap-dir /path/to/pcap/dir --pcap-filter '*.pcap' -K pcap -l /path/to/log/dir
    +
    +
    +
    +

    Configuration

    +

    Validate a configuration file:

    +
    +
    +
    snort -c $my_path/etc/snort/snort.lua
    +
    +

    Validate a configuration file and a separate rules file:

    +
    +
    +
    snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules
    +
    +

    Read rules from stdin and validate:

    +
    +
    +
    snort -c $my_path/etc/snort/snort.lua --stdin-rules < $my_path/etc/snort/sample.rules
    +
    +

    Enable warnings for Lua configurations and make warnings fatal:

    +
    +
    +
    snort -c $my_path/etc/snort/snort.lua --warn-all --pedantic
    +
    +

    Tell Snort++ where to look for additional Lua scripts:

    +
    +
    +
    snort --script-path /path/to/script/dir
    +
    +
    +
    +

    IDS mode

    +

    Run Snort++ in IDS mode, reading packets from a pcap:

    +
    +
    +
    snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap
    +
    +

    Log any generated alerts to the console using the "-A" option:

    +
    +
    +
    snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A alert_full
    +
    +

    Add or modify a configuration from the command line using the "--lua" option:

    +
    +
    +
    snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A cmg \
+    --lua 'ips = { enable_builtin_rules = true }'
    +
    +
    + + + +
    +Note +The "--lua" option can be specified multiple times.
    +
    +

    Run Snort++ in IDS mode on an entire directory of pcaps, processing each +input source on a separate thread:

    +
    +
    +
    snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \
+    --pcap-filter '*.pcap' --max-packet-threads 8
    +
    +
    +
    +
    +

    Plugins

    +

    Load external plugins and use the "ex" alert:

    +
    +
    +
    snort -c $my_path/etc/snort/snort.lua \
+    --plugin-path $my_path/lib/snort_extra \
+    -A alert_ex -r /path/to/my.pcap
    +
    +

    Test the LuaJIT rule option find loaded from stdin:

    +
    +
    +
    snort -c $my_path/etc/snort/snort.lua \
+    --script-path $my_path/lib/snort_extra \
+    --stdin-rules -A cmg -r /path/to/my.pcap << END
+alert tcp any any -> any 80 (
+    sid:3; msg:"found"; content:"GET";
+    find:"pat='HTTP/1%.%d'" ; )
+END
    +
    +
    +
    +

    Output Files

    +

    To make it simple to configure outputs when you run with multiple packet +threads, output files are not explicitly configured. Instead, you can use +the options below to format the paths:

    +
    +
    +
    <logdir>/[<run_prefix>][<id#>][<X>]<name>
    +
    +

    Log to unified in the current directory:

    +
    +
    +
    snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2
    +
    +

    Log to unified in the current directory with a different prefix:

    +
    +
    +
    snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2 \
+    --run-prefix take2
    +
    +

    Log to unified in /tmp:

    +
    +
    +
    snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2 -l /tmp
    +
    +

    Run 4 packet threads and log with thread number prefix (0-3):

    +
    +
    +
    snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \
+    --pcap-filter '*.pcap' -z 4 -A unified2
    +
    +

    Run 4 packet threads and log in thread number subdirs (0-3):

    +
    +
    +
    snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \
+    --pcap-filter '*.pcap' -z 4 -A unified2 --id-subdir
    +
    +
    + + + +
    +Note +subdirectories are created automatically if required. Log filename +is based on module name that writes the file. All text mode outputs +default to stdout. These options can be combined.
    +
    +
    +

    Shell

    +

    You must build with --enable-shell to make the command line shell available.

    +

    Enable shell mode:

    +
    +
    +
    snort --shell <args>
    +
    +

    You will see the shell mode command prompt, which looks like this:

    +
    +
    +
    o")~
    +
    +

    (The prompt can be changed with the SNORT_PROMPT environment variable.)

    +

    You can pause immediately after loading the configuration and again before +exiting with:

    +
    +
    +
    snort --shell --pause <args>
    +
    +

    In that case you must issue the resume() command to continue. Enter quit() +to terminate Snort or detach() to exit the shell. You can list the +available commands with help().

    +

    To enable local telnet access on port 12345:

    +
    +
    +
    snort --shell -j 12345 <args>
    +
    +

    The command line interface is still under development. Suggestions are +welcome.

    +
    +
    +

    Signals

    +
    + + + +
    +Note +The following examples assume that Snort++ is currently running and +has a process ID of <pid>.
    +
    +

    Modify and Reload Configuration:

    +
    +
    +
    echo 'suppress = { { gid = 1, sid = 2215 } }' >> $my_path/etc/snort/snort.lua
+kill -hup <pid>
    +
    +

    Dump stats to stdout:

    +
    +
    +
    kill -usr1 <pid>
    +
    +

    Shutdown normally:

    +
    +
    +
    kill -term <pid>
    +
    +

    Exit without flushing packets:

    +
    +
    +
    kill -quit <pid>
    +
    +

    List available signals:

    +
    +
    +
    snort --help-signals
    +
    +
    + + + +
    +Note +The available signals may vary from platform to platform.
    +
    +
    +
    +
    +

    Optional Features

    +

    Listed below are the features that must be explicitly enabled so they are built +into the Snort binary. For a full list of build features, run ./configure +--help.

    +

    • --r <pcap>… (same as --pcap-list) +--enable-ppm: enable packet and rule performance monitoring and coarse + latency enforcement.

    • --s <snap> (same as --snaplen) +--enable-perf-profiling: enable module and rule performance profiling.

    • --t <dir> chroots process to <dir> after initialization +--enable-shell: enable local and remote command line shell support.

      • +
    +
    +
    +

    Environment Variables

    +

    • --u <uname> run snort as <uname> or <uid> after initialization +HOSTTYPE: optional string that is output with the version at end of + line.

    • --v be verbose +LUA_PATH: you must export as follows so LuaJIT can find required + files.

      +
      +
      +
      LUA_PATH=$install_dir/include/snort/lua/\?.lua\;\;
      +

    • --w dump 802.11 management and control frames +SNORT_IGNORE: the list of symbols Snort should ignore when parsing the + Lua conf. Unknown symbols not in SNORT_IGNORE will cause warnings with + --warn-unknown or fatals with --warn-unknown --pedantic.

    • --x same as --pedantic +SNORT_LUA_PATH: an optional path where Snort can find supplemental conf + files such as classification.lua.

    • --y include year in timestamp in the alert and log files +SNORT_PROMPT: the character sequence that is printed at startup, + shutdown, and in the shell. The default is the mini-pig: o")~ .

    • --z <count> maximum number of packet threads (same as --max-packet-threads) +SNORT_PLUGIN_PATH: an optional path where Snort can find supplemental + shared libraries. This is only used when Snort is building manuals. + Modules in supplemental shared libraries will be added to the manuals.

    +

    Command Line Options

    +
    +
    +
            0 gets the number of CPU cores reported by the system
+        0 gets the number of CPU cores reported by the system
+* *--alert-before-pass* process alert, drop, sdrop, or reject before pass; default is pass before alert, drop,...
+* *--bpf* <filter options> are standard BPF options, as seen in TCPDump
+* *--c2x* output hex for given char (see also --x2c)
+* *--create-pidfile* create PID file, even when not in Daemon mode
+* *--daq* <type> select packet acquisition module (default is pcap)
+* *--daq-dir* <dir> tell snort where to find desired DAQ
+* *--daq-list* list packet acquisition modules available in optional dir, default is static modules only
+* *--daq-mode* <mode> select the DAQ operating mode
+* *--daq-var* <name=value> specify extra DAQ configuration variable
+* *--dirty-pig* don't flush packets on shutdown
+* *--dump-builtin-rules* [<module prefix>] output stub rules for selected modules
+* *--dump-defaults* [<module prefix>] output module defaults in Lua format
+* *--dump-dynamic-rules* output stub rules for all loaded rules libraries
+* *--dump-version* output the version, the whole version, and only the version
+* *--enable-inline-test* enable Inline-Test Mode Operation
+* *--help* list command line options
+* *--help-commands* [<module prefix>] output matching commands
+* *--help-config* [<module prefix>] output matching config options
+* *--help-counts* [<module prefix>] output matching peg counts
+* *--help-module* <module> output description of given module
+* *--help-modules* list all available modules with brief help
+* *--help-options* <option prefix> output matching command line option quick help (same as -?)
+* *--help-plugins* list all available plugins with brief help
+* *--help-signals* dump available control signals
+* *--id-subdir* create/use instance subdirectories in logdir instead of instance filename prefix
+* *--id-zero* use id prefix / subdirectory even with one packet thread
+* *--list-buffers* output available inspection buffers
+* *--list-builtin* <module prefix> output matching builtin rules
+* *--list-gids* [<module prefix>] output matching generators
+* *--list-modules* [<module type>] list all known modules of given type
+* *--list-plugins* list all known plugins
+* *--logid* <0xid> log Identifier to uniquely id events for multiple snorts (same as -G)
+* *--lua* <chunk> extend/override conf with chunk; may be repeated
+* *--markup* output help in asciidoc compatible format
+* *--max-packet-threads* <count> configure maximum number of packet threads (same as -z)
+* *--nolock-pidfile* do not try to lock Snort PID file
+* *--nostamps* don't include timestamps in log file names
+* *--pause* wait for resume/quit command before processing packets/terminating
+* *--pcap-dir* <dir> a directory to recurse to look for pcaps - read mode is implied
+* *--pcap-file* <file> file that contains a list of pcaps to read - read mode is implied
+* *--pcap-filter* <filter> filter to apply when getting pcaps from file or directory
+* *--pcap-list* <list> a space separated list of pcaps to read - read mode is implied
+* *--pcap-loop* <count> read all pcaps <count> times;  0 will read until Snort is terminated
+* *--pcap-no-filter* reset to use no filter when getting pcaps from file or directory
+* *--pcap-reload* if reading multiple pcaps, reload snort config between pcaps
+* *--pcap-reset* ignored - for REG_TEST only
+* *--pcap-show* print a line saying what pcap is currently being read
+* *--pedantic* warnings are fatal
+* *--plugin-path* <path> where to find plugins
+* *--process-all-events* process all action groups
+* *--rule* <rules> to be added to configuration; may be repeated
+* *--rule-to-hex* output so rule header to stdout for text rule on stdin
+* *--rule-to-text* output plain so rule header to stdout for text rule on stdin
+* *--run-prefix* <pfx> prepend this to each output file
+* *--script-path* <path> where to find luajit scripts
+* *--shell* enable the interactive command line
+* *--show-plugins* list module and plugin versions
+* *--skip* <n> skip 1st n packets
+* *--snaplen* <snap> set snaplen of packet (same as -s)
+* *--stdin-rules* read rules from stdin until EOF or a line starting with END is read
+* *--treat-drop-as-alert* converts drop, sdrop, and reject rules into alert rules during startup
+* *--treat-drop-as-ignore* use drop, sdrop, and reject rules to ignore session traffic when not inline
+* *--version* show version number (same as -V)
+* *--warn-all* enable all warnings
+* *--warn-conf* warn about configuration issues
+* *--warn-daq* warn about DAQ issues, usually related to mode
+* *--warn-flowbits* warn about flowbits that are checked but not set and vice-versa
+* *--warn-hosts* warn about host table issues
+* *--warn-rules* warn about duplicate rules and rule parsing issues
+* *--warn-scripts* warn about issues discovered while processing Lua scripts
+* *--warn-symbols* warn about unknown symbols in your Lua config
+* *--warn-vars* warn about variable definition and usage issues
+* *--x2c* output ASCII char for given hex (see also --c2x)
+* *-?* <option prefix> output matching command line option quick help (same as --help-options)
+* *-A* <mode> set alert mode: none, cmg, or alert_*
+* *-B* <mask> obfuscated IP addresses in alerts and packet dumps using CIDR mask
+* *-C* print out payloads with character data only (no hex)
+* *-D* run Snort in background (daemon) mode
+* *-E* enable daemon restart
+* *-G* <0xid> (same as --logid)
+* *-H* make hash tables deterministic
+* *-K* <mode> logging mode
+* *-M* log messages to syslog (not alerts)
+* *-N* ignored - for REG_TEST only
+* *-O* obfuscate the logged IP addresses
+* *-Q* enable inline mode operation
+* *-R* <rules> include this rules file in the default policy
+* *-S* <n=v> set rules file variable n equal to value v
+* *-T* test and report on the current Snort configuration
+* *-U* use UTC for timestamps
+* *-V* (same as --version)
+* *-W* lists available interfaces
+* *-X* dump the raw packet data starting at the link layer
+* *-c* <conf> use this configuration
+* *-d* dump the Application Layer
+* *-e* display the second layer header info
+* *-f* turn off fflush() calls after binary log writes
+* *-g* <gname> run snort gid as <gname> group (or gid) after initialization
+* *-i* <iface>... list of interfaces
+* *-j* <port> to listen for telnet connections
+* *-k* <mode> checksum mode (all,noip,notcp,noudp,noicmp,none)
+* *-l* <logdir> log to this directory instead of current directory
+* *-m* <umask> set umask = <umask>
+* *-n* <count> stop after count packets
+* *-q* quiet mode - Don't show banner and status report
+* *-r* <pcap>... (same as --pcap-list)
+* *-s* <snap> (same as --snaplen)
+* *-t* <dir> chroots process to <dir> after initialization
+* *-u* <uname> run snort as <uname> or <uid> after initialization
+* *-v* be verbose
+* *-w* dump 802.11 management and control frames
+* *-x* same as --pedantic
+* *-y* include year in timestamp in the alert and log files
+* *-z* <count> maximum number of packet threads (same as --max-packet-threads)
    +
    +
    +

    Parameters

    Parameters are given with this format:

    @@ -10778,7 +10787,7 @@ bit_list is typically used to store a set of byte, port, or VLAN ID
    -

    Configuration

    +

    Configuration

    • @@ -11012,7 +11021,7 @@ int base64_decode.bytes: Number of base64 encoded bytes to deco

    • -int base64_decode.offset: Bytes past start of buffer to start decoding. { 0: } +int base64_decode.offset = 0: Bytes past start of buffer to start decoding. { 0: }

    • @@ -11032,7 +11041,7 @@ string binder[].use.file: use configuration in given file

    • -string binder[].use.name = defaults to type: symbol name +string binder[].use.name: symbol name (defaults to type)

    • @@ -11057,7 +11066,7 @@ addr_list binder[].when.nets: list of networks

    • -int binder[].when.policy_id: unique ID for selection of this config by external logic { 0: } +int binder[].when.policy_id = 0: unique ID for selection of this config by external logic { 0: }

    • @@ -11092,7 +11101,7 @@ string bufferlen.~range: len | min<>max | <max | >m

    • -int byte_extract.align: round the number of converted bytes up to the next 2- or 4-byte boundary { 0:4 } +int byte_extract.align = 0: round the number of converted bytes up to the next 2- or 4-byte boundary { 0:4 }

    • @@ -11122,7 +11131,7 @@ implied byte_extract.little: little endian

    • -int byte_extract.multiplier: scale extracted value by given amount { 1:65535 } +int byte_extract.multiplier = 1: scale extracted value by given amount { 1:65535 }

    • @@ -11157,7 +11166,7 @@ int byte_extract.~offset: number of bytes into the buffer to st

    • -int byte_jump.align: round the number of converted bytes up to the next 2- or 4-byte boundary { 0:4 } +int byte_jump.align = 0: round the number of converted bytes up to the next 2- or 4-byte boundary { 0:4 }

    • @@ -11192,7 +11201,7 @@ implied byte_jump.little: little endian

    • -int byte_jump.multiplier: scale extracted value by given amount { 1:65535 } +int byte_jump.multiplier = 1: scale extracted value by given amount { 1:65535 }

    • @@ -11202,7 +11211,7 @@ implied byte_jump.oct: convert from octal string

    • -int byte_jump.post_offset: also skip forward or backwards (positive of negative value) this number of bytes { -65535:65535 } +int byte_jump.post_offset = 0: also skip forward or backwards (positive of negative value) this number of bytes { -65535:65535 }

    • @@ -11322,12 +11331,12 @@ implied content.fast_pattern: use this content in the fast patt

    • -int content.fast_pattern_length: maximum number of characters from this content the fast pattern matcher should use +int content.fast_pattern_length: maximum number of characters from this content the fast pattern matcher should use { 1: }

    • -int content.fast_pattern_offset: number of leading characters of this content the fast pattern matcher should exclude +int content.fast_pattern_offset = 0: number of leading characters of this content the fast pattern matcher should exclude { 0: }

    • @@ -11382,7 +11391,7 @@ int daq.snaplen = deflt: set snap length (same as -P) { 0:65535

    • -string daq.type = pcap: select type of DAQ +string daq.type: select type of DAQ

    • @@ -11762,7 +11771,7 @@ int gid.~: generator id { 1: }

    • -enum hosts[].frag_policy = linux: defragmentation policy { unknown | first | linux | bsd | bsd_right |last | windows | solaris } +enum hosts[].frag_policy: defragmentation policy { first | linux | bsd | bsd_right | last | windows | solaris }

    • @@ -11787,7 +11796,7 @@ enum hosts[].services[].proto = tcp: ip protocol { tcp | udp }

    • -enum hosts[].tcp_policy = linux: tcp reassembly policy { unknown | first | last | bsd | linux | old-linux | windows | win-2003 | vista | solaris | hpux | hpux10 | irix | macos } +enum hosts[].tcp_policy: tcp reassembly policy { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy }

    • @@ -12152,7 +12161,7 @@ string ips.include: legacy snort rules and includes

    • -enum ips.mode = tap: set policy mode { tap | inline | inline-test } +enum ips.mode: set policy mode { tap | inline | inline-test }

    • @@ -12177,7 +12186,7 @@ string itype.~range: check if icmp type is type | min<&g

    • -bool log_codecs.file = stdout: output to log_codecs.txt instead of stdout +bool log_codecs.file = false: output to log_codecs.txt instead of stdout

    • @@ -12652,16 +12661,6 @@ int port_scan_global.memcap = 1048576: maximum tracker memory {

    • -bool ppm.debug_pkts = false: enable packet debug -

      -
      • -
    • -

      -bool ppm.debug_rules = false: enable rule debug -

      -
      • -
    • -

      bool ppm.fastpath_expensive_packets = false: stop inspection if the max_pkt_time is exceeded

      • @@ -12757,7 +12756,7 @@ bool process.utc = false: use UTC instead of local time for tim

    • -int profile.modules.count = -1: print results to given level (-1 = all, 0 = off?) { -1: } +int profile.modules.count = -1: print results to given level (-1 = all, 0 = off) { -1: }

    • @@ -12767,7 +12766,7 @@ enum profile.modules.sort = avg_ticks: sort by given field { ch

    • -int profile.rules.count = -1: print results to given level (-1 = all, 0 = off?) { -1: } +int profile.rules.count = -1: print results to given level (-1 = all, 0 = off) { -1: }

    • @@ -12817,7 +12816,7 @@ enum rate_filter[].track = by_src: filter only matching source

    • -bool react.msg: use rule message in response page +bool react.msg = false: use rule msg in response page instead of default message

    • @@ -13042,7 +13041,7 @@ string snort.--bpf: <filter options> are standard BPF opt

    • -string snort.--c2x: output hex for given char +string snort.--c2x: output hex for given char (see also --x2c)

    • @@ -13202,7 +13201,7 @@ implied snort.--markup: output help in asciidoc compatible form

    • -int snort.--max-packet-threads: <count> configure maximum number of packet threads (same as -z) { 0: } +int snort.--max-packet-threads = 1: <count> configure maximum number of packet threads (same as -z)

    • @@ -13322,7 +13321,7 @@ int snort.--skip: <n> skip 1st n packets { 0: }

    • -int snort.--snaplen: <snap> set snaplen of packet (same as -s) { 68:65535 } +int snort.--snaplen = 1514: <snap> set snaplen of packet (same as -s) { 68:65535 }

    • @@ -13352,17 +13351,47 @@ implied snort.--warn-all: enable all warnings

    • +implied snort.--warn-conf: warn about configuration issues +

      +
      • +
    • +

      +implied snort.--warn-daq: warn about DAQ issues, usually related to mode +

      +
      • +
    • +

      implied snort.--warn-flowbits: warn about flowbits that are checked but not set and vice-versa

    • -implied snort.--warn-unknown: warn about unknown symbols in your config +implied snort.--warn-hosts: warn about host table issues

    • -int snort.--x2c: output ASCII char for given hex +implied snort.--warn-rules: warn about duplicate rules and rule parsing issues +

      +
      • +
    • +

      +implied snort.--warn-scripts: warn about issues discovered while processing Lua scripts +

      +
      • +
    • +

      +implied snort.--warn-symbols: warn about unknown symbols in your Lua config +

      +
      • +
    • +

      +implied snort.--warn-vars: warn about variable definition and usage issues +

      +
      • +
    • +

      +int snort.--x2c: output ASCII char for given hex (see also --c2x)

    • @@ -13532,7 +13561,7 @@ string snort.-r: <pcap>… (same as --pcap-list)

    • -int snort.-s: <snap> (same as --snaplen) { 68:65535 } +int snort.-s = 1514: <snap> (same as --snaplen) { 68:65535 }

    • @@ -13567,7 +13596,7 @@ implied snort.-y: include year in timestamp in the alert and lo

    • -int snort.-z: <count> maximum number of packet threads (same as --max-packet-threads) { 1: } +int snort.-z = 1: <count> maximum number of packet threads (same as --max-packet-threads)

    • @@ -13582,6 +13611,21 @@ string soid.~: SO rule ID has <gid>|<sid> format, l

    • +int ssh.max_client_bytes = 19600: number of unanswered bytes before alerting on challenge-response overflow or CRC32 { 0:65535 } +

      +
      • +
    • +

      +int ssh.max_encrypted_packets = 25: ignore session after this many encrypted packets { 0:65535 } +

      +
      • +
    • +

      +int ssh.max_server_version_len = 80: limit before alerting on secure CRT server version string overflow { 0:255 } +

      +
      • +
    • +

      int stream.icmp_cache.idle_timeout = 60: maximum inactive time before retiring session tracker { 1: }

      • @@ -13592,7 +13636,7 @@ int stream.icmp_cache.max_sessions = 262144: maximum simultaneo

    • -int stream.icmp_cache.memcap: maximum cache memory { 0: } +int stream.icmp_cache.memcap = 0: maximum cache memory { 0: }

    • @@ -13612,7 +13656,7 @@ int stream.ip_cache.max_sessions = 262144: maximum simultaneous

    • -int stream.ip_cache.memcap: maximum cache memory { 0: } +int stream.ip_cache.memcap = 0: maximum cache memory { 0: }

    • @@ -13632,7 +13676,7 @@ int stream.tcp_cache.max_sessions = 262144: maximum simultaneou

    • -int stream.tcp_cache.memcap: maximum cache memory { 0: } +int stream.tcp_cache.memcap = 0: maximum cache memory { 0: }

    • @@ -13652,7 +13696,7 @@ int stream.udp_cache.max_sessions = 262144: maximum simultaneou

    • -int stream.udp_cache.memcap: maximum cache memory { 0: } +int stream.udp_cache.memcap = 0: maximum cache memory { 0: }

    • @@ -13757,7 +13801,7 @@ int stream_tcp.overlap_limit = 0: maximum number of allowed ove

    • -enum stream_tcp.policy = linux: determines operating system characteristics like reassembly { first | last | linux | old-linux | bsd | macos | solaris | irix | hpux | hpux10 | windows | win-2003 | vista | proxy } +enum stream_tcp.policy = bsd: determines operating system characteristics like reassembly { first | last | linux | old_linux | bsd | macos | solaris | irix | hpux11 | hpux10 | windows | win_2003 | vista | proxy }

    • @@ -13978,6 +14022,8 @@ string wizard.spells[].to_client[].spell: sequence of data with

    • string wizard.spells[].to_server[].spell: sequence of data with wild cards (*) + 0 gets the number of CPU cores reported by the system { 0: } + 0 gets the number of CPU cores reported by the system { 0: }

    @@ -14157,6 +14203,11 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +dns.packets: total packets +

    +
    • +
  • +

    ftp_data.packets: total packets

    • @@ -14607,6 +14658,11 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +ssh.packets: total packets +

    +
    • +
  • +

    stream.icmp flows: total icmp sessions

    • @@ -15082,11 +15138,21 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +128: ssh +

    +
    • +
  • +

    129: stream_tcp

  • +131: dns +

    +
    • +
  • +

    134: ppm

    • @@ -16417,6 +16483,36 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +128:1 (ssh) Challenge-Response Overflow exploit +

    +
    • +
  • +

    +128:2 (ssh) SSH1 CRC32 exploit +

    +
    • +
  • +

    +128:3 (ssh) Server version string overflow +

    +
    • +
  • +

    +128:5 (ssh) Bad message direction +

    +
    • +
  • +

    +128:6 (ssh) Payload size incorrect for the given payload +

    +
    • +
  • +

    +128:7 (ssh) Failed to detect SSH version string +

    +
    • +
  • +

    129:1 (stream_tcp) SYN on established session

    • @@ -16517,6 +16613,21 @@ string wizard.spells[].to_server[].spell: sequence of data with

  • +131:1 (dns) Obsolete DNS RR Types +

    +
    • +
  • +

    +131:2 (dns) Experimental DNS RR Types +

    +
    • +
  • +

    +131:3 (dns) DNS Client rdata txt Overflow +

    +
    • +
  • +

    134:1 (ppm) rule options disabled by rule latency

    • @@ -16838,7 +16949,7 @@ string wizard.spells[].to_server[].spell: sequence of data with
    -

    Signals

    +

    Signals

    @@ -16958,6 +17069,7 @@ change -> detection: 'max-pattern-len' ==> 'max_pattern_len' change -> detection: 'search-method' ==> 'search_method' change -> detection: 'search-optimize' ==> 'search_optimize' change -> detection: 'split-any-any' ==> 'split_any_any' +change -> dns: 'ports' ==> 'bindings' change -> event_filter: 'gen_id' ==> 'gid' change -> event_filter: 'sig_id' ==> 'sid' change -> event_filter: 'threshold' ==> 'event_filter' @@ -17010,7 +17122,6 @@ change -> perfmonitor: 'pktcnt' ==> 'packets' change -> perfmonitor: 'snortfile' ==> 'file = true' change -> perfmonitor: 'time' ==> 'seconds' change -> policy_mode: 'inline_test' ==> 'inline-test' -change -> ppm: 'debug-pkts' ==> 'debug_pkts' change -> ppm: 'max-pkt-time' ==> 'max_pkt_time' change -> ppm: 'max-rule-time' ==> 'max_rule_time' change -> ppm: 'pkt-log' ==> 'pkt_log' @@ -17026,6 +17137,7 @@ change -> rule_state: 'disabled' ==> 'enable' change -> rule_state: 'enabled' ==> 'enable' change -> sfportscan: 'proto' ==> 'protos' change -> sfportscan: 'scan_type' ==> 'scan_types' +change -> ssh: 'server_ports' ==> 'bindings' change -> stream5_global: 'max_active_responses' ==> 'max_responses' change -> stream5_global: 'max_icmp' ==> 'max_sessions' change -> stream5_global: 'max_ip' ==> 'max_sessions' @@ -17042,8 +17154,7 @@ change -> stream5_tcp: 'bind_to' ==> 'bindings' change -> stream5_tcp: 'dont_reassemble_async' ==> 'reassemble_async' change -> stream5_tcp: 'max_queued_bytes' ==> 'queue_limit.max_bytes' change -> stream5_tcp: 'max_queued_segs' ==> 'queue_limit.max_segments' -change -> stream5_tcp: 'policy hpux11' ==> 'stream_tcp.policy = hpux' -change -> stream5_tcp: 'policy win2k3' ==> 'stream_tcp.policy = win-2003' +change -> stream5_tcp: 'policy hpux' ==> 'stream_tcp.policy = hpux11' change -> stream5_tcp: 'timeout' ==> 'session_timeout' change -> stream5_tcp: 'use_static_footprint_sizes' ==> 'footprint' change -> stream5_udp: 'timeout' ==> 'session_timeout' @@ -17122,6 +17233,9 @@ deleted -> csv: '<filename> can no longer be specific' deleted -> csv: 'default' deleted -> csv: 'trheader' deleted -> detection: 'mwm' +deleted -> dns: 'enable_experimental_types' +deleted -> dns: 'enable_obsolete_types' +deleted -> dns: 'enable_rdata_overflow' deleted -> fast: '<filename> can no longer be specific' deleted -> frag3_engine: 'detect_anomalies' deleted -> frag3_global: 'disabled' @@ -17134,6 +17248,7 @@ deleted -> perfmonitor: 'atexitonly: base-stats' deleted -> perfmonitor: 'atexitonly: events-stats' deleted -> perfmonitor: 'atexitonly: flow-ip-stats' deleted -> perfmonitor: 'atexitonly: flow-stats' +deleted -> ppm: 'debug-pkts' deleted -> react: 'block' deleted -> react: 'warn' deleted -> rpc_decode: 'alert_fragments' @@ -17144,6 +17259,14 @@ deleted -> rule_state: 'action' deleted -> sfportscan: 'detect_ack_scans' deleted -> sfportscan: 'disabled' deleted -> sfportscan: 'logfile' +deleted -> ssh: 'autodetect' +deleted -> ssh: 'enable_badmsgdir' +deleted -> ssh: 'enable_paysize' +deleted -> ssh: 'enable_protomismatch' +deleted -> ssh: 'enable_recognition' +deleted -> ssh: 'enable_respoverflow' +deleted -> ssh: 'enable_srvoverflow' +deleted -> ssh: 'enable_ssh1crc32' deleted -> stream5_global: 'disabled' deleted -> stream5_global: 'flush_on_alert' deleted -> stream5_global: 'no_midstream_drop_alerts' @@ -17308,6 +17431,11 @@ deleted -> unified2: 'filename'

  • +dns (inspector): dns inspection +

    +
    • +
  • +

    dsize (ips_option): rule option to test payload size

    • @@ -17773,6 +17901,11 @@ deleted -> unified2: 'filename'

  • +ssh (inspector): ssh inspection +

    +
    • +
  • +

    stream (inspector): common flow tracking

    • @@ -18123,6 +18256,11 @@ deleted -> unified2: 'filename'

  • +inspector::dns: dns inspection +

    +
    • +
  • +

    inspector::ftp_data: FTP data channel handler

    • @@ -18163,6 +18301,11 @@ deleted -> unified2: 'filename'

  • +inspector::ssh: ssh inspection +

    +
    • +
  • +

    inspector::stream: common flow tracking

    • @@ -18622,7 +18765,7 @@ deleted -> unified2: 'filename'

    Extending Snort++

    -

    Plugins

    +

    Plugins

    Snort++ uses a variety of plugins to accomplish much of its processing objectives, including:

      @@ -19273,7 +19416,7 @@ Put conditional code on the line following the if so it is easy to break

    • Don’t hesitate to create a new header if it is needed. Don’t lump - unrelated stuff into a header because it is convenient. + unrelated stuff into an header because it is convenient.

    • @@ -19293,7 +19436,7 @@ Write header guards like this (leading underscores are reserved for

      Includes from a different directory should specify parent directory. This makes it clear exactly what is included and avoids the primordial - soup that results from using -I this -I that -I the-other-thing … . + soup that results from using -I this -I that -I the_other_thing … .

      @@ -19389,7 +19532,7 @@ Prefer and over && and or over || for new source files

      Currently using uncrustify from at https://github.com/bengardner/uncrustify to reformat legacy code and anything that happens to need a makeover at some point.

      -

      The working config is crusty.cfg in the top level directory. It does well, +

      The working config is crusty.cfg in the top level directory. It does well but will munge some things. Specially formatted INDENT-OFF comments were added in 2 places to avoid a real mess.

      @@ -19401,7 +19544,7 @@ added in 2 places to avoid a real mess.

      diff --git a/doc/default_snort_manual.pdf b/doc/default_snort_manual.pdf index af1fb18af..3deb6a52a 100644 Binary files a/doc/default_snort_manual.pdf and b/doc/default_snort_manual.pdf differ diff --git a/src/framework/Makefile.am b/src/framework/Makefile.am index 0752fcf77..fe97db0d6 100644 --- a/src/framework/Makefile.am +++ b/src/framework/Makefile.am @@ -5,6 +5,7 @@ x_includedir = $(pkgincludedir)/framework noinst_LIBRARIES = libframework.a x_include_HEADERS = \ +api_options.h \ base_api.h \ bits.h \ codec.h \ @@ -36,10 +37,3 @@ value.cc AM_CXXFLAGS = @AM_CXXFLAGS@ -# install this to enable plugin build compatibility check -install-data-hook: $(top_builddir)/config.h - grep "API_OPTIONS" $< > $(x_includedir)/api_options.h - -uninstall-hook: - rm -f $(x_includedir)/api_options.h - diff --git a/src/framework/api_options.h.in b/src/framework/api_options.h.in new file mode 100644 index 000000000..ab4688930 --- /dev/null +++ b/src/framework/api_options.h.in @@ -0,0 +1,46 @@ +// this file defines API_OPTIONS. + +// API_OPTIONS is also defined in config.h for building Snort++ but that +// file is not installed. api_options.h will be included automatically by +// base_api.h when building external plugins from the installed headers. + +// the purpose of this define is to detect incompatibility between Snort +// and dynamic plugins that may have been built with different features. + +// this applies to conditionally defined member data in shared structs. it +// does not apply to conditionally defined functions since those prevent +// loading (that should be true for virtuals as well). + +// for example, suppose we had this: +// +// struct SnortConfig +// { +// // some member data +// #ifdef FOO +// // optional member data +// #endif +// // more member data +// }; + +// and then we did this: +// +// 1. build and install snort with build option set A. +// 2. build and install external plugins. These use A and are compatible. +// 3. build and install snort with build option set B (changing FOO). +// 4. run snort with B options and load external plugins with A options. + +// these are incompatible and will be caught upon loading instead of trying +// to run with mismatched structs and crashing in possibly mysterious ways. +// note that the api version of snort and plugins must match exactly. api +// version is orthogonal to build. + +// features like FOO require special handling in configure.ac and +// config.cmake.h.in to make this work. see those files for details. + +// finally, features like FOO should be avoided and have so far been +// eliminated from Snort++. however, they have plagued Snort 2.X so this +// facility is provided just in case. + +/* plugin api related build options */ +#undef API_OPTIONS + diff --git a/src/main/build.h b/src/main/build.h index 7376f98aa..d4c04bbf1 100644 --- a/src/main/build.h +++ b/src/main/build.h @@ -7,5 +7,5 @@ // // //-----------------------------------------------// -#define BUILD "143" +#define BUILD "144"