How to Start Snort on OpenWRT? - linux

Question

Recently I replace my router OS with OpenWRT, and I've install snort(2.9) on it with :
opkg install snort
My One and Only rule in /etc/snort/rules/local.rules :
alert icmp any any -> [My Router Private IP like : 192.168.0.1] any (msg: "NMAP ping sweep Scan"; dsize:0;sid:10000004; rev: 1;)
The problem is when i run :
snort -A console -q -c /etc/snort/snort.conf -i br-lan --daq-dir /usr/lib/daq
On the command line, it is Okay and it detects some Nmap scan attacks and wrote the alerts in console :
04/12-08:19:50.152690 [**] [1:10000005:2] NMAP TCP Scan [**] [Priority: 0] {TCP} 192.168.0.10:46287 -> 192.168.0.1:22
and log file, But when I start the service by :
/etc/init.d/snort start
Nothing happens and no log file created when I use same Nmap command (nmap -sX -p22 192.168.0.1).
My Questions are :
Why the server is not running ?
There is no way detecting if every thing okay with service without Systemctl.
Why the log created when i run snort command is nonsense?
When I type for example cat /var/log/snort/snort.log.1523473976 I get :
�����Z�^8Mvv�n6(爈���Ehu�##A3��<���
in the console.
PS :
1 -cat /etc/init.d/snort :
#!/bin/sh /etc/rc.common
# Copyright (C) 2015 OpenWrt.org
START=90
STOP=10
USE_PROCD=1
PROG=/usr/bin/snort
validate_snort_section() {
uci_validate_section snort snort "${1}" \
'config_file:string' \
'interface:string'
}
start_service() {
local config_file interface
validate_snort_section snort || {
echo "validation failed"
return 1
}
procd_open_instance
procd_set_param command $PROG "-c" "$config_file" "-q" "--daq-dir" "/usr/lib/daq/" "-i" "$interface" "-s" "-N"
procd_set_param file $CONFIGFILE
procd_set_param respawn
procd_close_instance
}
stop_service()
{
service_stop ${PROG}
}
service_triggers()
{
procd_add_reload_trigger "snort"
procd_add_validation validate_snort_section
}
2- I actually followed This link to configure. but I uncomment and set config logdir: to /var/log/snort/ .
(Any help would be greatly appreciated)

Answer 1

It's set to localhost by default - lo
Check the output of uci show snort.snort.interface
You can change it with uci set snort.snort.interface=br-lan
Restart snort to confirm it has actually taken the new parameters - /etc/init.d/snort restart
You can view the whole command line in top/htop
If all is good, save the changes to UCI: uci commit
And your logs are binary with that config, not text, I have mine log to syslog and send them to a remote rsyslog server, in snort.conf - output alert_syslog: LOG_AUTH LOG_ALERT