E2xB patch for Snort 2.0.0
A patch that applies E2xB algorithm to Snort version 2.0.0 is now available
for download.
In order to apply the patch you should have a clean version of Snort
2.0.0. You can download one from http://www.snort.org/dl
Steps for applying the patch
- After you have unzipped and extracted the tarball containg Snort go to the src/ directory. It is located inside the directory where snort was extracted
- patch -p 1 < ourpatch
- If everything goes normal you should see the following output:
patching file exb.c
patching file exb.h
patching file fpcreate.c
patching file Makefile.am
patching file Makefile.in
patching file mpse.c
patching file mpse.h
- Go back one directory (the one containing configure)
- ./configure
- make
- make install
How to apply E2xB
After patch was successfully applied you can use the E2xB algorithm
for the detection engine through the configuration file. Inside the
configuration file add the line (or change it if already exists):
config detection : search-method exb
For any comments, bugs or fixes contact antonat@ics.forth.gr
