# cd /usr/ports/security/snort
# make config
[ ] DYNAMIC     Enable dynamic plugin support
[ ] FLEXRESP    Flexible response to events
[ ] FLEXRESP2   Flexible response to events (version 2)
[X] MYSQL       Enable MySQL support
[ ] ODBC        Enable ODBC support
[ ] POSTGRESQL  Enable PostgreSQL support
[ ] PRELUDE     Enable Prelude NIDS integration
[ ] PERPROFILE  Enable Performance Profiling
[ ] SNORTSAM    Enable output plugin to SnortSam
# make install clean

snort_enable="YES"
snort_interface="em0"

mysql> grant all on snort.* to snort@localhost identified by 'snort';

$ mysql -u snort -p snort < /usr/ports/security/snort/work/snort-2.8.2.2/schemas/create_mysql

output database: log, mysql, user=snort password=password dbname=snort host=localhost

-i     Listen on interface 
-p         Disable promiscuous mode sniffing
<h1></h1>
Опции командной строки характерные для режима анализатора пакетов:
<pre lang="cli">-d         Dump the Application Layer
-e         Display the second layer header info
-v         Be verbose
-q         Quiet. Don't show banner and status report
-r     Read and process tcpdump file Пример - чтение траффика с интерфейса:
<pre lang="cli">$ snort -q -i vlan3 -p -d -e -v -n 10 port 80

$ snort -v -r ~/traffic/

-l     Log to directory Пример - запись траффика в файл:
<pre lang="cli">$ snort -i vlan3 -p -l ~/traffic/

-I         Add Interface name to alert output
-A         Set alert mode: fast, full, console, test or none  (alert file alerts only) "unsock" enables UNIX socket logging (experimental).

$ snort -i vlan3 -p -A console

 Use 'make config' to modify these settings
$ make install clean