snort
The de facto standard for intrusion detection/prevention
Snort is an open source network intrusion prevention and detection system (IDS/IPS) developed by Sourcefire. Combining the benefits of signature, protocol, and anomaly-based inspection, Snort is the most widely deployed IDS/IPS technology worldwide. With millions of downloads and approximately 300,000 registered users, Snort has become the de facto standard for IPS.
Available in
| Overlay | Newest | Ebuilds | Last activity | |
|---|---|---|---|---|
| gentoo gitweb ↗ | 2.9.20-r1 | 2 | 14 h | details › |
Versions & arches
| Version | Overlay | amd64 | arm64 | x86 | ppc64 | arm | mips | ppc | sparc | Committed | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 2.9.20-r1 | gentoo | amd64 testing | arm64 testing | x86 testing | ppc64 testing | arm testing | mips testing | ppc testing | sparc testing | — | view · download · history ↗ |
| 2.9.20 | gentoo | amd64 testing | arm64 testing | x86 testing | ppc64 testing | arm testing | mips testing | ppc testing | sparc testing | — | view · download · history ↗ |
Use flags of 2.9.20-r1
- +active-response Enables support for automatically sending TCP resets and ICMP unreachable messages to terminate connections. Used with inline deployments.
- control-socket Enables Snort's control socket.
- debug Enable extra debug codepaths, like asserts and extra output. If you want to get meaningful backtraces see https://wiki.gentoo.org/wiki/Project:Quality_Assurance/Backtraces
- file-inspect Enables extended file inspection capabilities.
- +flexresp3 Enables support for new flexable response preprocessor for enabling connection tearing for inline deployments. Replaces flexresp and flexresp2.
- +gre Enable support for inspecting and processing Generic Routing Encapsulation (GRE) packet headers. Only needed if you are monitoring GRE tunnels.
- high-availability Enables high-availability state sharing.
- inline-init-failopen Enables support to allow traffic to pass (fail-open) through inline deployments while snort is starting and not ready to begin inspecting traffic. If this option is not enabled, network traffic will not pass (fail-closed) until snort has fully started and is ready to perform packet inspection.
- large-pcap-64bit Allows Snort to read pcap files that are larger than 2 GB. ONLY VALID FOR 64bit SYSTEMS!
- +libtirpc Build against net-libs/libtirpc for RPC support
- linux-smp-stats Enable accurate statistics reporting through /proc on systems with multiple processors.
- +non-ether-decoders Enable decoding of non-ethernet protocols such as TokenRing, FDDI, IPX, etc.
- open-appid Enable OpenAppID, an open, application-focused detection language and processing module for Snort that enables users to create, share, and implement application detection. Requires dev-lang/luajit.
- +perfprofiling Enables support for preprocessor and rule performance profiling using the perfmonitor preprocessor.
- +ppm Enables support for setting per rule or per packet latency limits. Helps protect against introducing network latency with inline deployments.
- +react Enables support for the react rule keyword. Supports interception, termination, and redirection of HTTP connections.
- reload-error-restart Enables support for completely restarting snort if an error is detected during a reload.
- selinux !!internal use only!! Security Enhanced Linux support, this must be set by the selinux profile or breakage will occur
- shared-rep Enables the use of shared memory for the Reputation Preprocessor (Only available on Linux systems)
- side-channel Enables Snort's side channel.
- sourcefire Enables Sourcefire specific build options, which include --enable-perfprofiling and --enable-ppm.
- +threads Add threads support for various packages. Usually pthreads
1 expansion flags (python targets, ABIs, cpu flags…)
- +lua_single_target_luajit
Runtime dependencies of 2.9.20-r1
show 22 lines
!libtirpc?
(
)
libtirpc?
(
)
open-appid?
(
lua_single_target_luajit?
(
)
)
selinux?
(
)