Re: Question on Snort Extra plugin

Hi Gustaf,

There is no immediate indication that plugins are used, snort just treats them as modules the same way as static ones.

You can list them with `--list-plugins` flag. Also, when they are configured, you will see them on snort startup, something like this:

…
Loading snort.lua:

                search_engine

                …

                alert_ex                <-- module from a plugin loaded from an .so in my case

                …



Hope this helps,

Andrii



From: Snort-users <[email protected]> on behalf of Gustaf Florén via Snort-users <[email protected]>
Date: Tuesday, 2 January 2024 at 15:13
To: [email protected] <[email protected]>
Subject: [Snort-users] Question on Snort Extra plugin
Hello! Happy New Year everybody ! :)

I have  question on the Snort Extra plugin. I have installed it(in ubuntu) as following:

wget https://www.snort.org/downloads/snortplus/snort3_extra-3.1.77.0.tar.gz
 tar zxvf snort3_extra-3.1.77.0.tar.gz
 cd cd snort3_extra-3.1.77.0
 export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig

 ./configure_cmake.sh
 cd build
 make
 make install

And run snort with:

 sudo /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua \
--daq-dir /usr/local/lib/daq --daq afpacket --daq-var buffer_size_mb=4000 \
-s 65535 -k none -l /var/log/snort -Q -i eth0:eth1 -u snort -g snort -D \
--plugin-path /usr/local/snort/lib/snort/plugins/extra/

Now When I run snort I don´t see any output that shows that snort is using Snort Extra plugin...Is that normal or am I suppose to see any output that Snort Extra is activated??

Here are the output from the terminal after installation:

-- Install configuration: ""
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_eapol.so
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_linux_sll.so
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_null.so
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_pflog.so
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_pbb.so
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_ppp.so
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_slip.so
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_token_ring.so
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_wlan.so
-- Installing: /usr/local/lib/snort/daq/extra/daq_socket.so
-- Installing: /usr/local/lib/snort/plugins/extra/inspectors/appid_listener.so
-- Installing: /usr/local/lib/snort/plugins/extra/inspectors/data_log.so
-- Installing: /usr/local/lib/snort/plugins/extra/inspectors/domain_filter.so
-- Installing: /usr/local/lib/snort/plugins/extra/inspectors/dpx.so
-- Installing: /usr/local/lib/snort/plugins/extra/inspectors/mem_test.so
-- Installing: /usr/local/lib/snort/plugins/extra/inspectors/cpeos_test.so
-- Installing: /usr/local/lib/snort/plugins/extra/inspectors/null_trace_logger.so
-- Installing: /usr/local/lib/snort/plugins/extra/ips_options/ips_pkt_num.so
-- Installing: /usr/local/lib/snort/plugins/extra/ips_options/ips_mss.so
-- Installing: /usr/local/lib/snort/plugins/extra/ips_options/ips_urg.so
-- Installing: /usr/local/lib/snort/plugins/extra/ips_options/ips_wscale.so
-- Installing: /usr/local/lib/snort/plugins/extra/ips_options/find.lua
-- Installing: /usr/local/lib/snort/plugins/extra/loggers/alert_ex.so
-- Installing: /usr/local/lib/snort/plugins/extra/loggers/alert.lua
-- Installing: /usr/local/lib/snort/plugins/extra/loggers/log_null.so
-- Installing: /usr/local/lib/snort/plugins/extra/search_engines/lowmem.so
-- Installing: /usr/local/lib/snort/plugins/extra/so_rules/sid_18758.so
-- Installing: /usr/local/lib/snort/misc/extra/tp_appid_example.so



/Gustaf

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette