BSD Portssecurity/snort 2.9.20_5 FreeBSD
Lightweight network intrusion detection system
- System
- FreeBSD
- Repository
- FreeBSD ports
- Maintainer
- [email protected]
- Last update
- Commit
cf24ceafc1- License
- GPLv2
- Categories
- security
- Package size
- 3199.2 KiB, 8302.0 KiB installed
Description
Snort is a libpcap-based packet sniffer/logger which can be used as a lightweight network intrusion detection system. It features rules based logging and can perform content searching/matching in addition to being used to detect a variety of other attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, and much more. Snort has a real-time alerting capability, with alerts being sent to syslog, a separate "alert" file, or even to a Windows computer via Samba.
Packets are logged in their decoded form to directories which are generated based upon the IP address of the remote peer. This allows Snort to be used as a sort of "poor man's intrusion detection system" if you specify what traffic you want to record and what to let through.
For instance, I use it to record traffic of interest to the six computers in my office at work while I'm away on travel or gone for the weekend. It's also nice for debugging network code since it shows you most of the Important Stuff(TM) about your packets (as I see it anyway). The code is pretty easy to modify to provide more complete packet decoding, so feel free to make suggestions.
In the other systems
| System | Port | Version |
|---|---|---|
| FreeBSD | security/snort | 2.9.20_5 |
| OpenBSD | net/snort | 2.9.20p7 |
| NetBSD | net/snort | 2.9.16.1nb12 |
| MidnightBSD | security/snort | 2.9.20 |
Install
Binary package:
pkg install snortFrom the ports tree:
cd /usr/ports/security/snort/ && make install cleanTo depend on this port in another port's Makefile:
RUN_DEPENDS= snort>0:security/snort
LIB_DEPENDS= libsf_sorules.so:security/snortPackages
The version each package repository carries. “-” means the repository builds no package of it, “n/a” that there is no such repository.
| Repository | aarch64 | amd64 | armv6 | armv7 | i386 |
|---|---|---|---|---|---|
| FreeBSD:14:latest | 2.9.20_5 | 2.9.20_5 | 2.9.20_1 | 2.9.20_3 | 2.9.20_5 |
| FreeBSD:14:quarterly | 2.9.20_4 | 2.9.20_4 | n/a | 2.9.20_2 | 2.9.20_4 |
| FreeBSD:15:latest | 2.9.20_5 | 2.9.20_5 | n/a | 2.9.20_3 | 2.9.20_3 |
| FreeBSD:15:quarterly | 2.9.20_4 | 2.9.20_4 | n/a | n/a | n/a |
| FreeBSD:16:latest | 2.9.20_4 | 2.9.20_5 | n/a | n/a | n/a |
| FreeBSD:16:quarterly | n/a | n/a | n/a | n/a | n/a |
Dependencies
As this port's Makefile names them.
Build 1
daq>=2.2.2_3: net/daq
Library 3
libpcre.so: devel/pcrelibdnet.so: net/libdnetlibpcap.so.1: net/libpcap
Runtime 1
daq>=2.2.2_3: net/daq
The full lists below include those, and their dependencies in turn.
Build dependencies 10
Run dependencies 34
- converters/p5-Encode-Locale
- converters/p5-MIME-Base32
- converters/p5-MIME-Base64
- devel/p5-Clone
- devel/p5-IO-HTML
- devel/p5-TimeDate
- devel/pcre
- lang/p5-Try-Tiny
- lang/perl5.42
- net/daq
- net/libdnet
- net/libpcap
- net/libpfctl
- net/p5-Net-HTTP
- net/p5-URI
- security/ca_root_nss
- security/p5-Authen-NTLM
- security/p5-Crypt-SSLeay
- security/p5-Digest-HMAC
- security/p5-IO-Socket-SSL
- security/p5-Net-SSLeay
- security/pulledpork
- sysutils/p5-File-Listing
- www/p5-HTML-Parser
- www/p5-HTML-Tagset
- www/p5-HTTP-Cookies
- www/p5-HTTP-Date
- www/p5-HTTP-Message
- www/p5-HTTP-Negotiate
- www/p5-LWP-MediaTypes
- www/p5-LWP-Protocol-https
- www/p5-Mozilla-CA
- www/p5-WWW-RobotRules
- www/p5-libwww
Required by 1
Configuration
Options name: security_snort
| Option | Default | Description |
|---|---|---|
| APPID | off | Build with application id support (EXPERIMENTAL) |
| COREDUMPS | off | Enable core dumps |
| DBGSNORT | off | Enable debugging symbols |
| DOCS | off | Build and/or install documentation |
| FILEINSPECT | off | Build with extended file inspection features (EXPERIMENTAL) |
| GRE | on | GRE support |
| HA | off | Enable high-availability state sharing (EXPERIMENTAL) |
| IPV6 | off | IPv6 in snort.conf |
| LRGPCAP | off | Pcaps larger than 2GB |
| NONETHER | off | Non-Ethernet Decoders |
| NORMALIZER | on | Normalizer |
| PERFPROFILE | on | Performance profiling |
| PULLEDPORK | on | Depend on pulledpork |
| SOURCEFIRE | on | Sourcefire recommended build options |
- USES
- bison cpe libtool pathfix shebangfix ssl
- Service scripts
snort- Conflicts with
- snort3-3.*
Message after installing
Snort uses rcNG startup script and must be enabled via /etc/rc.conf Please see /usr/local/etc/rc.d/snort for list of available variables and their description. Configuration files are located in /usr/local/etc/snort directory. Please note that, by default, snort will truncate packets larger than the default snaplen of 15158 bytes. Additionally, LRO may cause issues with Stream5 target-based reassembly. It is recommended to disable LRO, if your card supports it. This can be done by appending '-lro' to your ifconfig_ line in rc.conf.
Files
Manual pages 1
- snort(8)
pkg-plist 337
- bin/file_server
- bin/appid_detector_builder.sh
- bin/snort
- bin/u2boat
- bin/u2spewfoo
- bin/u2openappid
- bin/u2streamer
- @sample etc/snort/classification.config-sample etc/snort/classification.config
- @sample etc/snort/gen-msg.map-sample etc/snort/gen-msg.map
- @sample etc/snort/preproc_rules/decoder.rules-sample etc/snort/preproc_rules/decoder.rules
- @sample etc/snort/preproc_rules/preprocessor.rules-sample etc/snort/preproc_rules/preprocessor.rules
- @sample etc/snort/preproc_rules/sensitive-data.rules-sample etc/snort/preproc_rules/sensitive-data.rules
- @sample etc/snort/reference.config-sample etc/snort/reference.config
- @sample etc/snort/snort.conf-sample etc/snort/snort.conf
- @sample etc/snort/threshold.conf-sample etc/snort/threshold.conf
- @sample etc/snort/unicode.map-sample etc/snort/unicode.map
- @sample etc/snort/file_magic.conf-sample etc/snort/file_magic.conf
- include/snort/dynamic_output/bitop.h
- include/snort/dynamic_output/ipv6_port.h
- include/snort/dynamic_output/obfuscation.h
- include/snort/dynamic_output/output_api.h
- include/snort/dynamic_output/output_common.h
- include/snort/dynamic_output/output_lib.h
- include/snort/dynamic_output/preprocids.h
- include/snort/dynamic_output/sfPolicy.h
- include/snort/dynamic_output/sf_dynamic_common.h
- include/snort/dynamic_output/sf_ip.h
- include/snort/dynamic_output/sf_protocols.h
- include/snort/dynamic_output/sf_snort_packet.h
- include/snort/dynamic_output/sfrt.h
- include/snort/dynamic_output/sfrt_dir.h
- include/snort/dynamic_output/sfrt_trie.h
- include/snort/dynamic_output/snort_debug.h
- include/snort/dynamic_output/stream_api.h
- include/snort/dynamic_preproc/appId.h
- include/snort/dynamic_preproc/appIdApi.h
- include/snort/dynamic_preproc/dns_defs.h
- include/snort/dynamic_preproc/thirdparty_appid_api.h
- include/snort/dynamic_preproc/thirdparty_appid_types.h
- include/snort/dynamic_preproc/appdata_adjuster.h
- include/snort/dynamic_preproc/bitop.h
- include/snort/dynamic_preproc/cpuclock.h
- include/snort/dynamic_preproc/file_api.h
- include/snort/dynamic_preproc/idle_processing.h
- include/snort/dynamic_preproc/ipv6_port.h
- include/snort/dynamic_preproc/memory_stats.h
- include/snort/dynamic_preproc/mempool.h
- include/snort/dynamic_preproc/mpse_methods.h
- include/snort/dynamic_preproc/obfuscation.h
- include/snort/dynamic_preproc/packet_time.h
- include/snort/dynamic_preproc/perf_indicators.h
- include/snort/dynamic_preproc/preprocids.h
- include/snort/dynamic_preproc/profiler.h
- include/snort/dynamic_preproc/reg_test.h
- include/snort/dynamic_preproc/reload_api.h
- include/snort/dynamic_preproc/segment_mem.h
- include/snort/dynamic_preproc/session_api.h
- include/snort/dynamic_preproc/sf_decompression_define.h
- include/snort/dynamic_preproc/sfPolicy.h
- include/snort/dynamic_preproc/sfPolicyUserData.h
- include/snort/dynamic_preproc/sf_decompression.h
- include/snort/dynamic_preproc/sf_dynamic_common.h
- include/snort/dynamic_preproc/sf_dynamic_define.h
- include/snort/dynamic_preproc/sf_dynamic_engine.h
- include/snort/dynamic_preproc/sf_dynamic_meta.h
- include/snort/dynamic_preproc/sf_dynamic_preproc_lib.h
- include/snort/dynamic_preproc/sf_dynamic_preprocessor.h
- include/snort/dynamic_preproc/sf_ip.h
- include/snort/dynamic_preproc/sf_preproc_info.h
- include/snort/dynamic_preproc/sf_protocols.h
- include/snort/dynamic_preproc/sf_sdlist_types.h
- include/snort/dynamic_preproc/sf_seqnums.h
- include/snort/dynamic_preproc/sf_snort_packet.h
- include/snort/dynamic_preproc/sf_snort_plugin_api.h
- include/snort/dynamic_preproc/sfcommon.h
- include/snort/dynamic_preproc/sfcontrol.h
- include/snort/dynamic_preproc/sfrt.h
- include/snort/dynamic_preproc/sfrt_dir.h
- include/snort/dynamic_preproc/sfrt_flat.h
- include/snort/dynamic_preproc/sfrt_flat_dir.h
- include/snort/dynamic_preproc/sfrt_trie.h
- include/snort/dynamic_preproc/sidechannel_define.h
- include/snort/dynamic_preproc/smtp_api.h
- include/snort/dynamic_preproc/snort_bounds.h
- include/snort/dynamic_preproc/snort_debug.h
- include/snort/dynamic_preproc/ssl.h
- include/snort/dynamic_preproc/ssl_config.h
- include/snort/dynamic_preproc/ssl_ha.h
- include/snort/dynamic_preproc/ssl_include.h
- include/snort/dynamic_preproc/ssl_inspect.h
- include/snort/dynamic_preproc/ssl_session.h
- include/snort/dynamic_preproc/str_search.h
- include/snort/dynamic_preproc/stream_api.h
- lib/libsf_sorules.a
- lib/libsf_sorules.so
- lib/libsf_sorules.so.0
- lib/libsf_sorules.so.0.0.0
- lib/snort/dynamic_output/libsf_dynamic_output.a
- lib/snort/dynamic_preproc/libsf_dynamic_preproc.a
- lib/snort/dynamic_preproc/libsf_dynamic_utils.a
The first 100 are listed.
distinfo 1
| File | Size | SHA256 |
|---|---|---|
| snort-2.9.20.tar.gz | 7.009894e+06 | 29400e13f53b1831e0b8b10ec1224a1cbaa6dc1533a5322a20dd80bb84b4981c |
Master sites 2
- https://snort.org/downloads/snort/
- https://snort.org/downloads/archive/snort/