On Wed, 5 Aug 2009 14:28:49 +0530 RAMAKISHOREBABU KOPPULA <rkbabu.koppula(a)gmail.com&gt; wrote: These are notes I made to myself when I saw the same thing, and researched the answer. Cryptic, but they should give you enough direction to get snort working. If the licensing allows, this might be a great thing to put in rpmfusion-free or rpmfusion-nonfree. It probably doesn't. In order to set up snort to monitor the system network traffic, it is necessary to install the snort package. But this is not enough, because the rules that snort uses are not packaged due to licensing issues. It is necessary to go to http://www.snort.org, sign up, log in, and download the latest snort_rules package. There are free(older) and pay(current) versions. Create a directory named snort_rules and put the package in that directory as it does not create its own directory. Unpack it using tar -zxvf and move the rules/*.rules files to /etc/snort/rules/. Cp the so_rules/precompiled/FC-9/x86_64/2.8.3.2/*.so to /usr/local/lib64/snort_dynamicrule/. The instructions to create the stubs and tell snort about them are in the README in the so_rules/src directory. They work. Because the package is already installed, only the dynamic detection directory has to be changed in /etc/snort/snort.conf to the /usr/local/lib64/snort_dynamicrule location. Everything else uses the main hierarchy. So the stub dump command becomes snort -c /etc/snort/snort.conf --dump-dynamic-rules=/etc/snort/so_rules Note that snort will not create these directories and will fail if they don't already exist.

On Wed, 2009-08-05 at 14:28 +0530, RAMAKISHOREBABU KOPPULA wrote: Try Google for instant answers. Snort :: Home Page A free lightweight network intrusion detection system for UNIX and Windows. www.snort.org/ You'll need to be root to do the following, so enter the command line I've shown inside the quotes, "su -", hit enter, and type in the root password. Try starting the service from the command line, and see if you get more information than the "failed" showing while booting up. e.g. service snort start Look at logs to try and find out more error messages than just "failed". First place to look is usually /var/log/messages. Some programs have their own log files, or directories, inside /var/log, so list the directory and have a look. See if there's a man file, info file, or other documentation for the service installed on your computer. man snort info snort ls /usr/share/doc/snort*/ This is general advice, I don't have specific information about snort. -- [tim@localhost ~]$ uname -r 2.6.27.25-78.2.56.fc9.i686 Don't send private replies to my address, the mailbox is ignored. I read messages from the public lists.