Re: Question on Snort Extra plugin

Unsubscribe

Regards

Alan Haines | Director IT Operations
Service Inspired Restaurants
5360 South Service Rd., Suite 200, Burlington, ON  L7L 5L1
O.  905.681.2997 x454  I C. 905.299.9764
[email protected]<mailto:[email protected]>

"Bringing something different to the table"...check us out at www.sircorp.com<https://www.sircorp.com/>

[cid:[email protected]]

From: Snort-users <[email protected]> On Behalf Of Andrii Serbeniuk -X (aserbeni - SOFTSERVE INC at Cisco) via Snort-users
Sent: Thursday, January 11, 2024 8:04 AM
To: Gustaf Florén <[email protected]>; [email protected]
Subject: Re: [Snort-users] Question on Snort Extra plugin

Hi Gustaf,

There is no immediate indication that plugins are used, snort just treats them as modules the same way as static ones.

You can list them with `--list-plugins` flag. Also, when they are configured, you will see them on snort startup, something like this:

...
Loading snort.lua:

                search_engine

                ...

                alert_ex                <-- module from a plugin loaded from an .so in my case

                ...



Hope this helps,

Andrii



From: Snort-users <[email protected]<mailto:[email protected]>> on behalf of Gustaf Florén via Snort-users <[email protected]<mailto:[email protected]>>
Date: Tuesday, 2 January 2024 at 15:13
To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Subject: [Snort-users] Question on Snort Extra plugin
Hello! Happy New Year everybody ! :)

I have  question on the Snort Extra plugin. I have installed it(in ubuntu) as following:

wget https://www.snort.org/downloads/snortplus/snort3_extra-3.1.77.0.tar.gz<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fwww.snort.org%2fdownloads%2fsnortplus%2fsnort3_extra-3.1.77.0.tar.gz&c=E,1,VlBoRS8FJgDz83-uf-5o5bsPN1JyinMxvTKnkSAWqcdSMIoM1UwdRXmjoMEZhO-i3pM2gLhX_S_j0xVoozRQ011NsD_Sb9L_EKzEsmpkFf3Whf11&typo=1>
 tar zxvf snort3_extra-3.1.77.0.tar.gz
 cd cd snort3_extra-3.1.77.0
 export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig

 ./configure_cmake.sh<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fconfigure_cmake.sh&c=E,1,MPjuYqdM8_5HdJTWzzmfceOdIY3PONqVtEVfhRhJoR9TRHKqxJzzcSD0abM_8KK451gg6fxcA0wYmOQUm8ZPaJ0JUji3rku9vLT6ThgGng,,&typo=1&ancr_add=1>
 cd build
 make
 make install

And run snort with:

 sudo /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua \
--daq-dir /usr/local/lib/daq --daq afpacket --daq-var buffer_size_mb=4000 \
-s 65535 -k none -l /var/log/snort -Q -i eth0:eth1 -u snort -g snort -D \
--plugin-path /usr/local/snort/lib/snort/plugins/extra/

Now When I run snort I don´t see any output that shows that snort is using Snort Extra plugin...Is that normal or am I suppose to see any output that Snort Extra is activated??

Here are the output from the terminal after installation:

-- Install configuration: ""
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_eapol.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fcd_eapol.so&c=E,1,ruK_UrHH4__Vv5OmPoWONPSoPuLeJmIckKa6pzwvG2wNehEwIQdJwWRFnqIg_OQAGy27XvaY5MY_nDcloYZf1D_H9rEAW37SjGvDwDvQCtUwIGdyO24pIr8,&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_linux_sll.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fcd_linux_sll.so&c=E,1,p84BSFN-8dM7junaa95TL6OhSdZKWPDA9V-Vb9EL4ls134xJEkW1yIj3CoemJU13b4Z3PjiBlrjUmvmks4Kde1W2Q-5_LH7X2VrNB5Qn3ogUtLbAXo_s984,&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_null.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fcd_null.so&c=E,1,DGNfmKfyZ2Ot_QRVq3WmsqS7M34VbiSw6s676MkZx6AXqLJjn-__1yDVknxw1JQz9FubVHvak8BS1KWjfppHNkuJb3dSm3XQDMK87WuCvL6G2IHkrd3P&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_pflog.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fcd_pflog.so&c=E,1,3PDxMqE21l0Ykel-5dJRpB4KKkQVu1DVlRi4HMeELje7oVYPBVe0xMOSgy3XWW545Puys_BdYG3XPPrsVLAfF0htkiiCYAp7Fe1AZJA6&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_pbb.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fcd_pbb.so&c=E,1,LlPp3PIWf5-15dk9ycZXio9udtXSGUl9aYd7PeCFqV7GxZruEhhdqI8HTtUwRMEaxA89wtmN4pZqvjboguAtRAmZJMhjrNyQZgNqFwvA0CNs&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_ppp.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fcd_ppp.so&c=E,1,4OzcW2xalT2MGmaE976b7nffO2d5oZXHARdio1Dg9Jn5af8fMyzRsn7JeU4krClNgcoISp6-CkUHXoI6xZTCyqTLbWCWBnbc4b3cfq9N34Mb-duuXZg,&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_slip.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fcd_slip.so&c=E,1,Sw6a3ExevOP_a1th-KpDzHzM2jw8UyQgWN4h67zcsMJ8rnbsCGRet4fHVoXNZBFRX99k4Wp1Ngdy3cu1rEfeQaSrSVWQYyvsHybwCgPkF7UwS4fVQtzwApn6ig,,&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_token_ring.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fcd_token_ring.so&c=E,1,p9Pm9Jnt29wg-v6q1eSDQFU4G01eud2aCBFC2mLvdmchDq37dRBXvDEympbolvcDF2SBZDQvDxuc7KJZqyikDq2wMUdMU2tuXim8gzaNAmf7ctgnwjkXfQ,,&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/codecs/cd_wlan.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fcd_wlan.so&c=E,1,2I1P6302gnWcq3De-5ka1f87UcUCHql9veKHp5HgRzUh0ZTrjZgWe2odGMWcuWYdpD1Z7CCFZo8LlWJWsVk5WGerh8LmdlWHJxdV2c9uu_8,&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/daq/extra/daq_socket.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fdaq_socket.so&c=E,1,y80VEo3mw45G8mR67B0wY2NBh9WcRnT_y2DtEV0SrWi7sdLAMQRvHUd3VEoirgxVC8aEOaeCaWhgSd-B3Asz2ybgchipLhmG-65OAn20BvT6p0DDMk4B80Q,&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/inspectors/appid_listener.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fappid_listener.so&c=E,1,STDs-pycu7fld7gLjeAtKlPnAquSkAHpWr4npKPK31U5RezSJcdDczNtD2HzUoDrhr56lwrGSviI9gM-ypL_EA2ucnarUJfCLlhEo9N0Bg,,&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/inspectors/data_log.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fdata_log.so&c=E,1,E0CPagAw1XbUqiUF-uvh05D-R3WLtW2NfDoAlRPuIFHNALHIQeR1lnsX2WMxA0f96kjeZZUWYrKWP7XWUY8BjaQuqSk9kkdSL0TCtCk_1ZOF1Jk,&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/inspectors/domain_filter.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fdomain_filter.so&c=E,1,7XpbnHC1q4ZjxQGWoYkDQLsZiCv_MR8t9cXneWViADCk9LQlN0XmsPooYLU1VwbTLQ6tz8jgSp1ktGVqf8fT6VuycTBWMF8B-MMbay_nmCbjEwU,&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/inspectors/dpx.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fdpx.so&c=E,1,tZ6lsTEgVjYelaH9jQqmfs9PaJq8Wfx3znx4LcSvNco5J7_zVqyFi6-hVnEZNCOWzbBPVeM7WjE0nlQalJ6MFDWk8tlrqJyWdaXGdh5VYpoEDWaT7R3ApNU,&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/inspectors/mem_test.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fmem_test.so&c=E,1,2SfQmQmRGtEezHBO8JMxw0kGDwnygqz0Z_tWo54UAMmwkX846g7UbF8nmFYTwXmGGlGxYvRgncGkOY2_xYhlMHXfvrF1rZ_rzeP4DUF_bmjXEg1kCRH4CH-WHA,,&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/inspectors/cpeos_test.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fcpeos_test.so&c=E,1,zEAMdQhl4VlYAg86Fjq5JZC0Po51UhnXSB12s5-1SBML8Nl6H_xPt06Zl9UtPpLckS2E2Uu1-5GGPwep6NFdwO8I9JhPs2XH-glaUKk9jSPdQgZihHi6hT1kFPU,&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/inspectors/null_trace_logger.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fnull_trace_logger.so&c=E,1,VmLP4RySVomnXk75m95qkPRBrliHZhm_-G6ARqBJ1F6eJwrGYI4X-PI3D6K9-_3kpUs0dviLmTuSmJVzTSQ7HfyRMA6AbzABiZZDiKX6fBjY3s_j&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/ips_options/ips_pkt_num.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fips_pkt_num.so&c=E,1,EoDpgjtXV1W7hr4C5PSWf9B9Re7Fdax4XKRApxtB8AMh-gguIsX2Ji9JZIiPpHX65CSNszB_tdbKtOTlmPr6ateafNM_JFQGKohnaUA_jItjpWag1A,,&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/ips_options/ips_mss.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fips_mss.so&c=E,1,iibWatmgcQWjWy8qthfwMDWMyDZXSGT3jll0wSttzWhMiV6l3JxpGoZKzvi_y9hSqKAxfZBIUESQ4X2XcLOtwazISb3hGFtWmOnwNUYztobCzRxIJf1dl11B&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/ips_options/ips_urg.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fips_urg.so&c=E,1,WumA79U3hjwGEvexajACuDl974VCr3IstmiLJvfptoEYdg6suBFAXzy3-2AMmb3siE7pIPd3qXjLVA5LY9NtsV-cQ8Gj31iboDPosE9SdC8NzX0xAO8F&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/ips_options/ips_wscale.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fips_wscale.so&c=E,1,G-0TJV2xg_Mg50upU69VzWyK_3vnQPP4Qe8vgXDudViAqlz5zkqEp-ZOKCXXZQyXhEeBsTNdqKHhq2QPrdUChznMg3oKmz6UysKD6One1kH6t7fp&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/ips_options/find.lua
-- Installing: /usr/local/lib/snort/plugins/extra/loggers/alert_ex.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2falert_ex.so&c=E,1,wemzigaJ6P_z_Rc1wKqHzbyHsxbGEFBsJnmqH_PqPQND9uXTQZ8JwLlwqVBBovJglsjZBvSFWBn7H-L7b3rF67QjoIokZZPfty5OR2xSIFR42i7KoL_rUDzy&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/loggers/alert.lua
-- Installing: /usr/local/lib/snort/plugins/extra/loggers/log_null.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2flog_null.so&c=E,1,QK3byR5lneT1lsi9_h-t_yAHzcPWjtRtmYSyRoCatDdQ5VbwwEJMZrqfjy2eeAzb4_5aExettD28YQkHbuPs4dBbj7Oa7SJUN0m6xJ-_U9yFHGMeXA,,&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/search_engines/lowmem.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2flowmem.so&c=E,1,CRdX32lKZw85TyvZr3as9F3iBTrKOD4YuLHmFPx0AzmB4kaKHtPb-LzyDGVeeBWWjO9BJAYOwhz1IE9UWzMIvH11YLGrhizxpUUiuyUOa_NQ-znhcC2w5bUWLshH&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/plugins/extra/so_rules/sid_18758.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fsid_18758.so&c=E,1,oFesB1V5y7kxlFsHo0l0EwVdAvyJ8oUyKLMaQVpnclrwfMN354UMCtAWVP_vOOyTsQnpSAqfH0IlHUtjRrg3DigPWSmoE12V5DWxaAXXbKKlQhFSww,,&typo=1&ancr_add=1>
-- Installing: /usr/local/lib/snort/misc/extra/tp_appid_example.so<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2ftp_appid_example.so&c=E,1,jyrUQp2Cz-bwHiEkpuD5RIZm6Ze37BhhQaRqLXNWYFl5HchjQ4YjYUuzl3bGE8VVdKlJPup57NcTJQfFP511J58ehv8nFIsRyZ8_OA5m_gf8AArw1cs3Xjc,&typo=1&ancr_add=1>



/Gustaf

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette