Snort and Barnyard2 and Base on macOS High Sierra

Snort and Barnyard2 and Base on macOS High Sierra.md

Snort and Barnyard2 and Base on macOS High Sierra

Reference: https://discussions.apple.com/thread/4473229?tstart=0

Dependencies

sudo port install hwloc luajit

DAQ

• https://www.snort.org/downloads#snort-downloads

curl -L -O https://www.snort.org/downloads/snort/daq-2.0.6.tar.gz
curl -O -L https://www.snort.org/downloads/snort/md5s
openssl md5 daq-2.0.6.tar.gz

./configure --with-libpcap-libraries=/opt/local/lib --disable-ipfw-module
make
sudo make install

Snort

Make sure to compile in a directory with no spaces in the path name and use the native gcc compiler, not the Macports compiler.

curl -O -L https://www.snort.org/downloads/snort/snort-2.9.11.tar.gz
openssl md5 snort-2.9.11.tar.gz
cat md5s
cd /tmp  # build in a directory with no spaces in the path name
tar xfp ~/Downloads/snort-2.9.11.tar.gz
cd snort-2.9.11.tar.gz
export PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/opt/local/bin:/opt/local/sbin  # use native gcc
./configure --enable-gre --enable-mpls --enable-targetbased --enable-ppm --enable-perfprofiling --enable-active-response --enable-normalizer --enable-reload --enable-react --enable-flexresp3 --with-daq-libraries=/usr/local/lib --with-daq-includes=/usr/local/include --prefix=/usr/local
make -j 4
sudo make install

Snort Rules

sudo mkdir -p /usr/local/etc/snort
cd /usr/local/etc/snort
sudo tar xfpvz ~username/Downloads/snortrules-snapshot-29110.tar.gz

Edit snort.conf.

Successful call

sudo /usr/local/bin/snort -d -e -i en0 -c /usr/local/etc/snort/snort.conf