Need some snort information

[MMacD]

When pfsense installs snort,

…where does it put the executable?

...does it use the ports makefile and plist?

...should the executable show up in top/ps as 'snort' or something else?

Thanks!

[bmeeks]

@MMacD:

When pfsense installs snort,

I have an answer for these two of your three questions –

@MMacD:

…where does it put the executable?

The Snort executable is in:

/usr/local/bin

@MMacD:

…should the executable show up in top/ps as 'snort' or something else?

Yes, I see it in both places when running.

[MMacD]

Thanks.  That actually answers the third question:  no, the ports plist isn't used as given, since it says the binary should be in /bin not /usr/local/bin

[bmeeks]

On pfSense, the major pieces of Snort are in:

/usr/local/bin/
/usr/local/lib/snort/
/usr/local/etc/snort/snort_xxxxx  (where xxxxx is a random UUID followed by the physical interface name such as em0 for Intel nics)