Need some snort information
-
When pfsense installs snort,
…where does it put the executable?
...does it use the ports makefile and plist?
...should the executable show up in top/ps as 'snort' or something else?
Thanks!
-
When pfsense installs snort,
I have an answer for these two of your three questions –
…where does it put the executable?
The Snort executable is in:
/usr/local/bin
…should the executable show up in top/ps as 'snort' or something else?
Yes, I see it in both places when running.
-
Thanks. That actually answers the third question: no, the ports plist isn't used as given, since it says the binary should be in /bin not /usr/local/bin
-
On pfSense, the major pieces of Snort are in:
/usr/local/bin/
/usr/local/lib/snort/
/usr/local/etc/snort/snort_xxxxx (where xxxxx is a random UUID followed by the physical interface name such as em0 for Intel nics)
