security/snort 2.9.20 MidnightBSD

Lightweight network intrusion detection system

System: MidnightBSD
Repository: mports
Maintainer: [email protected]
License: gpl2
Categories: security

Description

Snort is a libpcap-based packet sniffer/logger which can be used as a lightweight network intrusion detection system. It features rules based logging and can perform content searching/matching in addition to being used to detect a variety of other attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, and much more. Snort has a real-time alerting capability, with alerts being sent to syslog, a separate "alert" file, or even to a Windows computer via Samba.

Packets are logged in their decoded form to directories which are generated based upon the IP address of the remote peer. This allows Snort to be used as a sort of "poor man's intrusion detection system" if you specify what traffic you want to record and what to let through.

For instance, I use it to record traffic of interest to the six computers in my office at work while I'm away on travel or gone for the weekend. It's also nice for debugging network code since it shows you most of the Important Stuff(TM) about your packets (as I see it anyway). The code is pretty easy to modify to provide more complete packet decoding, so feel free to make suggestions.

In the other systems

System

Port

Version

MidnightBSD

security/snort

2.9.20

FreeBSD

security/snort

2.9.20_5

OpenBSD

net/snort

2.9.20p7

NetBSD

net/snort

2.9.16.1nb12

HardenedBSD

security/snort

2.9.20_4

GhostBSD

security/snort

2.9.20_3

Install

Binary package:

mport install snort

From mports:

cd /usr/mports/security/snort && make install clean

To depend on this port in another port's Makefile:

RUN_DEPENDS=	snort>0:security/snort
LIB_DEPENDS=	libsf_sorules.so:security/snort

Dependencies

As this port's Makefile names them.

Build 1

daq>=2.0.0 : net/daq

Library 3

libpcre.so : devel/pcre
libdnet.so : net/libdnet
libpcap.so : net/libpcap

Runtime 1

daq>=2.0.0 : net/daq

Build dependencies 4

Run dependencies 4

No port depends on this one.

Configuration

Options name: security_snort

Option

Default

Description

APPID

off

Build with application id support (EXPERIMENTAL)

BARNYARD

Depend on barnyard2 (supports also snortsam)

DBGSNORT

off

Enable debugging symbols+core dumps

DOCS

off

FILEINSPECT

off

Build with extended file inspection features (EXPERIMENTAL)

GRE

GRE support

off

Enable high-availability state sharing (EXPERIMENTAL)

IPV6

off

IPv6 in snort.conf

LRGPCAP

off

Pcaps larger than 2GB

NONETHER

off

Non-Ethernet Decoders

NORMALIZER

Normalizer

PERFPROFILE

Performance profiling

PULLEDPORK

Depend on pulledpork

SOURCEFIRE

Sourcefire recommended build options

USES: bison cpe libtool pathfix shebangfix ssl
Service scripts: snort
Conflicts with: snort3-3.*

Files

Manual pages 1

snort(8)

pkg-plist 337

bin/file_server
bin/appid_detector_builder.sh
bin/snort
bin/u2boat
bin/u2spewfoo
bin/u2openappid
bin/u2streamer
@sample etc/snort/classification.config-sample etc/snort/classification.config
@sample etc/snort/gen-msg.map-sample etc/snort/gen-msg.map
@sample etc/snort/preproc_rules/decoder.rules-sample etc/snort/preproc_rules/decoder.rules
@sample etc/snort/preproc_rules/preprocessor.rules-sample etc/snort/preproc_rules/preprocessor.rules
@sample etc/snort/preproc_rules/sensitive-data.rules-sample etc/snort/preproc_rules/sensitive-data.rules
@sample etc/snort/reference.config-sample etc/snort/reference.config
@sample etc/snort/snort.conf-sample etc/snort/snort.conf
@sample etc/snort/threshold.conf-sample etc/snort/threshold.conf
@sample etc/snort/unicode.map-sample etc/snort/unicode.map
@sample etc/snort/file_magic.conf-sample etc/snort/file_magic.conf
include/snort/dynamic_output/bitop.h
include/snort/dynamic_output/ipv6_port.h
include/snort/dynamic_output/obfuscation.h
include/snort/dynamic_output/output_api.h
include/snort/dynamic_output/output_common.h
include/snort/dynamic_output/output_lib.h
include/snort/dynamic_output/preprocids.h
include/snort/dynamic_output/sfPolicy.h
include/snort/dynamic_output/sf_dynamic_common.h
include/snort/dynamic_output/sf_ip.h
include/snort/dynamic_output/sf_protocols.h
include/snort/dynamic_output/sf_snort_packet.h
include/snort/dynamic_output/sfrt.h
include/snort/dynamic_output/sfrt_dir.h
include/snort/dynamic_output/sfrt_trie.h
include/snort/dynamic_output/snort_debug.h
include/snort/dynamic_output/stream_api.h
include/snort/dynamic_preproc/appId.h
include/snort/dynamic_preproc/appIdApi.h
include/snort/dynamic_preproc/dns_defs.h
include/snort/dynamic_preproc/thirdparty_appid_api.h
include/snort/dynamic_preproc/thirdparty_appid_types.h
include/snort/dynamic_preproc/appdata_adjuster.h
include/snort/dynamic_preproc/bitop.h
include/snort/dynamic_preproc/cpuclock.h
include/snort/dynamic_preproc/file_api.h
include/snort/dynamic_preproc/idle_processing.h
include/snort/dynamic_preproc/ipv6_port.h
include/snort/dynamic_preproc/memory_stats.h
include/snort/dynamic_preproc/mempool.h
include/snort/dynamic_preproc/mpse_methods.h
include/snort/dynamic_preproc/obfuscation.h
include/snort/dynamic_preproc/packet_time.h
include/snort/dynamic_preproc/perf_indicators.h
include/snort/dynamic_preproc/preprocids.h
include/snort/dynamic_preproc/profiler.h
include/snort/dynamic_preproc/reg_test.h
include/snort/dynamic_preproc/reload_api.h
include/snort/dynamic_preproc/segment_mem.h
include/snort/dynamic_preproc/session_api.h
include/snort/dynamic_preproc/sf_decompression_define.h
include/snort/dynamic_preproc/sfPolicy.h
include/snort/dynamic_preproc/sfPolicyUserData.h
include/snort/dynamic_preproc/sf_decompression.h
include/snort/dynamic_preproc/sf_dynamic_common.h
include/snort/dynamic_preproc/sf_dynamic_define.h
include/snort/dynamic_preproc/sf_dynamic_engine.h
include/snort/dynamic_preproc/sf_dynamic_meta.h
include/snort/dynamic_preproc/sf_dynamic_preproc_lib.h
include/snort/dynamic_preproc/sf_dynamic_preprocessor.h
include/snort/dynamic_preproc/sf_ip.h
include/snort/dynamic_preproc/sf_preproc_info.h
include/snort/dynamic_preproc/sf_protocols.h
include/snort/dynamic_preproc/sf_sdlist_types.h
include/snort/dynamic_preproc/sf_seqnums.h
include/snort/dynamic_preproc/sf_snort_packet.h
include/snort/dynamic_preproc/sf_snort_plugin_api.h
include/snort/dynamic_preproc/sfcommon.h
include/snort/dynamic_preproc/sfcontrol.h
include/snort/dynamic_preproc/sfrt.h
include/snort/dynamic_preproc/sfrt_dir.h
include/snort/dynamic_preproc/sfrt_flat.h
include/snort/dynamic_preproc/sfrt_flat_dir.h
include/snort/dynamic_preproc/sfrt_trie.h
include/snort/dynamic_preproc/sidechannel_define.h
include/snort/dynamic_preproc/smtp_api.h
include/snort/dynamic_preproc/snort_bounds.h
include/snort/dynamic_preproc/snort_debug.h
include/snort/dynamic_preproc/ssl.h
include/snort/dynamic_preproc/ssl_config.h
include/snort/dynamic_preproc/ssl_ha.h
include/snort/dynamic_preproc/ssl_include.h
include/snort/dynamic_preproc/ssl_inspect.h
include/snort/dynamic_preproc/ssl_session.h
include/snort/dynamic_preproc/str_search.h
include/snort/dynamic_preproc/stream_api.h
lib/libsf_sorules.a
lib/libsf_sorules.so
lib/libsf_sorules.so.0
lib/libsf_sorules.so.0.0.0
lib/snort/dynamic_output/libsf_dynamic_output.a
lib/snort/dynamic_preproc/libsf_dynamic_preproc.a
lib/snort/dynamic_preproc/libsf_dynamic_utils.a

The first 100 are listed.

distinfo 1

File

Size

SHA256

snort-2.9.20.tar.gz

7.009894e+06

29400e13f53b1831e0b8b10ec1224a1cbaa6dc1533a5322a20dd80bb84b4981c

Master sites 2

https://snort.org/downloads/snort/
https://snort.org/downloads/archive/snort/