If you want to run Snort as a daemon, you can the add -D switch to any combination described in the previous sections. Please notice that if you want to be able to restart Snort by sending a SIGHUP signal to the daemon, you must specify the full path to the Snort binary when you start it, for example:
/usr/local/bin/snort -d -h 192.168.1.0/24 \
-l /var/log/snortlogs -c /usr/local/etc/snort.conf -s -D
Relative paths are not supported due to security concerns.
When Snort is run as a daemon , the daemon creates a PID file in the log directory. In Snort 2.6, the -pid-path command line switch causes Snort to write the PID file in the directory specified.
Additionally, the -create-pidfile switch can be used to force creation of a PID file even when not running in daemon mode.
The PID file will be locked so that other snort processes cannot start. Use the -nolock-pidfile switch to not lock the PID file.
If you need to dump the shared object rules stub to a directory, you might need to use the -dump-dynamic-rules option. These rule stub files are used in conjunction with the shared object rules. The path can be relative or absolute.
/usr/local/bin/snort -c /usr/local/etc/snort.conf \
--dump-dynamic-rules=/tmp
This path can also be configured in the snort.conf using the config option dump-dynamic-rules-path as follows:
config dump-dynamic-rules-path: /tmp/sorules
The path configured by command line has precedence over the one configured using dump-dynamic-rules-path.
/usr/local/bin/snort -c /usr/local/etc/snort.conf \
--dump-dynamic-rules
snort.conf:
config dump-dynamic-rules-path: /tmp/sorules
In the above mentioned scenario the dump path is set to /tmp/sorules.
If you need to post packet logs to public mailing lists, you might want to use the -O switch. This switch obfuscates your IP addresses in packet printouts. This is handy if you don't want people on the mailing list to know the IP addresses involved. You can also combine the -O switch with the -h switch to only obfuscate the IP addresses of hosts on the home network. This is useful if you don't care who sees the address of the attacking host. For example, you could use the following command to read the packets from a log file and dump them to the screen, obfuscating only the addresses from the 192.168.1.0/24 class C network:
./snort -d -v -r snort.log -O -h 192.168.1.0/24
In Snort v2.4, the -G command line option was added that specifies an instance identifier for the event logs. This option can be used when running multiple instances of snort, either on different CPUs, or on the same CPU but a different interface. Each Snort instance will use the value specified to generate unique event IDs. Users can specify either a decimal value (-G 1) or hex value preceded by 0x (-G 0x11). This is also supported via a long option -logid.