Snort3 - How can I configure it?

Hi all

@efahl asked me to add a reply to this post. I recently updated my Mochabin to 23.05 rc2. Previously I was on 22.03.4 and whilst on that I was running snort 3 in IDS mode which I'd configured using the instructions held at Openwrt snort wiki

I think it was running ok, it passed the verification bit at the end and the service started ok. I don't know for sure if it was working because I never found any alerts in the log, and hadn't got around to testing it. The service was showing as running, using about 5% CPU, so I assumed it must be doing something.

Anyways, I then updated to 23.05 rc2 and tried setting up snort 3 using the same wiki page. In short it didn't work, and even though I ran it in IDS mode it still killed my internet connection. I put a post here in the 23.05 rc2 forum which includes a bit more detail.

For info, the Mochabin spec is here , I have the 8GB RAM version, with the Qualcomm wireless chip which I think matches this spec

If it would help for me to run any tests from my end, feel free to tell me what you need doing, but use short sentences and simple words cos I'm nowhere near as tech savvy as some of you guys. I may not reply quick but that's just cos I've got a few dramas occurring at the moment, but will assist when I can.

Thanks all. Happy

1 Like