Question on Snort Extra plugin

Gustaf Florén via Snort-users <[email protected]> Mon, 1 Jan 2024 18:17:15 +0100
Newsgroups gmane.comp.security.ids.snort.general
Message-ID <CADkpq3vq8HwRgM2bLLL6v_Ww=OZSZjcWcsoh6hbNW-fGsot1Rw@mail.gmail.com>
Hello! Happy New Year everybody ! :)

I have  question on the Snort Extra plugin. I have installed it(in ubuntu)
as following:

wget https://www.snort.org/downloads/snortplus/snort3_extra-3.1.77.0.tar.gz
 tar zxvf snort3_extra-3.1.77.0.tar.gz
 cd cd snort3_extra-3.1.77.0
 export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig

 ./configure_cmake.sh
 cd build
 make
 make install

And run snort with:

 sudo /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua \
--daq-dir /usr/local/lib/daq --daq afpacket --daq-var buffer_size_mb=4000 \
-s 65535 -k none -l /var/log/snort -Q -i eth0:eth1 -u snort -g snort -D \
--plugin-path /usr/local/snort/lib/snort/plugins/extra/

Now When I run snort I don´t see any output that shows that snort is using
Snort Extra plugin...Is that normal or am I suppose to see any output that
Snort Extra is activated??

Here are the output from the terminal after installation:

-- Install configuration: ""
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_eapol.so
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_linux_sll.so
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_null.so
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_pflog.so
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_pbb.so
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_ppp.so
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_slip.so
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_token_ring.so
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_wlan.so
-- Installing: /usr/local/lib/snort/daq/extra/daq_socket.so
-- Installing:
/usr/local/lib/snort/plugins/extra/inspectors/appid_listener.so
-- Installing: /usr/local/lib/snort/plugins/extra/inspectors/data_log.so
-- Installing:
/usr/local/lib/snort/plugins/extra/inspectors/domain_filter.so
-- Installing: /usr/local/lib/snort/plugins/extra/inspectors/dpx.so
-- Installing: /usr/local/lib/snort/plugins/extra/inspectors/mem_test.so
-- Installing: /usr/local/lib/snort/plugins/extra/inspectors/cpeos_test.so
-- Installing:
/usr/local/lib/snort/plugins/extra/inspectors/null_trace_logger.so
-- Installing: /usr/local/lib/snort/plugins/extra/ips_options/ips_pkt_num.so
-- Installing: /usr/local/lib/snort/plugins/extra/ips_options/ips_mss.so
-- Installing: /usr/local/lib/snort/plugins/extra/ips_options/ips_urg.so
-- Installing: /usr/local/lib/snort/plugins/extra/ips_options/ips_wscale.so
-- Installing: /usr/local/lib/snort/plugins/extra/ips_options/find.lua
-- Installing: /usr/local/lib/snort/plugins/extra/loggers/alert_ex.so
-- Installing: /usr/local/lib/snort/plugins/extra/loggers/alert.lua
-- Installing: /usr/local/lib/snort/plugins/extra/loggers/log_null.so
-- Installing: /usr/local/lib/snort/plugins/extra/search_engines/lowmem.so
-- Installing: /usr/local/lib/snort/plugins/extra/so_rules/sid_18758.so
-- Installing: /usr/local/lib/snort/misc/extra/tp_appid_example.so



/Gustaf

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette