Question on Snort Extra plugin
Gustaf Florén via Snort-users <[email protected]> Mon, 1 Jan 2024 18:17:15 +0100
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <CADkpq3vq8HwRgM2bLLL6v_Ww=OZSZjcWcsoh6hbNW-fGsot1Rw@mail.gmail.com> |
Hello! Happy New Year everybody ! :) I have question on the Snort Extra plugin. I have installed it(in ubuntu) as following: wget https://www.snort.org/downloads/snortplus/snort3_extra-3.1.77.0.tar.gz tar zxvf snort3_extra-3.1.77.0.tar.gz cd cd snort3_extra-3.1.77.0 export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./configure_cmake.sh cd build make make install And run snort with: sudo /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua \ --daq-dir /usr/local/lib/daq --daq afpacket --daq-var buffer_size_mb=4000 \ -s 65535 -k none -l /var/log/snort -Q -i eth0:eth1 -u snort -g snort -D \ --plugin-path /usr/local/snort/lib/snort/plugins/extra/ Now When I run snort I don´t see any output that shows that snort is using Snort Extra plugin...Is that normal or am I suppose to see any output that Snort Extra is activated?? Here are the output from the terminal after installation: -- Install configuration: "" -- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_eapol.so -- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_linux_sll.so -- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_null.so -- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_pflog.so -- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_pbb.so -- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_ppp.so -- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_slip.so -- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_token_ring.so -- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_wlan.so -- Installing: /usr/local/lib/snort/daq/extra/daq_socket.so -- Installing: /usr/local/lib/snort/plugins/extra/inspectors/appid_listener.so -- Installing: /usr/local/lib/snort/plugins/extra/inspectors/data_log.so -- Installing: /usr/local/lib/snort/plugins/extra/inspectors/domain_filter.so -- Installing: /usr/local/lib/snort/plugins/extra/inspectors/dpx.so -- Installing: /usr/local/lib/snort/plugins/extra/inspectors/mem_test.so -- Installing: /usr/local/lib/snort/plugins/extra/inspectors/cpeos_test.so -- Installing: /usr/local/lib/snort/plugins/extra/inspectors/null_trace_logger.so -- Installing: /usr/local/lib/snort/plugins/extra/ips_options/ips_pkt_num.so -- Installing: /usr/local/lib/snort/plugins/extra/ips_options/ips_mss.so -- Installing: /usr/local/lib/snort/plugins/extra/ips_options/ips_urg.so -- Installing: /usr/local/lib/snort/plugins/extra/ips_options/ips_wscale.so -- Installing: /usr/local/lib/snort/plugins/extra/ips_options/find.lua -- Installing: /usr/local/lib/snort/plugins/extra/loggers/alert_ex.so -- Installing: /usr/local/lib/snort/plugins/extra/loggers/alert.lua -- Installing: /usr/local/lib/snort/plugins/extra/loggers/log_null.so -- Installing: /usr/local/lib/snort/plugins/extra/search_engines/lowmem.so -- Installing: /usr/local/lib/snort/plugins/extra/so_rules/sid_18758.so -- Installing: /usr/local/lib/snort/misc/extra/tp_appid_example.so /Gustaf _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette