Need some snort information



  • When pfsense installs snort,

    …where does it put the executable?

    ...does it use the ports makefile and plist?

    ...should the executable show up in top/ps as 'snort' or something else?

    Thanks!



  • @MMacD:

    When pfsense installs snort,

    I have an answer for these two of your three questions –

    @MMacD:

    …where does it put the executable?

    The Snort executable is in:

    /usr/local/bin

    @MMacD:

    …should the executable show up in top/ps as 'snort' or something else?

    Yes, I see it in both places when running.



  • Thanks.  That actually answers the third question:  no, the ports plist isn't used as given, since it says the binary should be in /bin not /usr/local/bin



  • On pfSense, the major pieces of Snort are in:

    /usr/local/bin/
    /usr/local/lib/snort/
    /usr/local/etc/snort/snort_xxxxx  (where xxxxx is a random UUID followed by the physical interface name such as em0 for Intel nics)


Log in to reply