[{"_1":2,"_170":-5,"_171":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_145":146},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_88":-5,"_89":90,"_134":-5,"_135":11,"_136":21,"_137":11,"_138":-5,"_139":11,"_140":-5,"_141":142,"_143":91,"_144":-7},"canonicalUrl","https://hub.docker.com/r/jgru/snort3/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","jgru","reponame","snort3","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":74,"_79":11,"_80":81,"_85":33,"_86":87},"categories",[],"content_types",[44],"image","date_registered","2022-08-31T15:32:25.154278Z","description","","is_private","last_updated","2022-08-31T15:32:25.755926Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[56],"application/vnd.docker.container.image.v1+json","name","pull_count",903,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","\n# Table of Contents\n\n1. [Motivation](#orgf3701f6)\n2. [Usage](#orgc41ac55)\n 1. [Simple Usage via Shell Function](#orgdc09e51)\n 2. [Elaborated Usage Via `docker-compose`](#org3534650)\n3. [Acknowledgements](#org07e053b)\n\nThis is a dockerized setup of `snort3`. It is geared toward checking a\ndirectory of .pcap-files but can be used for \"online-mode\" as well.\n\n\n\n\n# Motivation\n\nThere is a [docker container with snort3](https://hub.docker.com/r/ciscotalos/snort3) provided by \"Cisco Talos\",\nwhich is intended for interactive use. However, the source Dockerfile\nis not available; therefore, I decided to craft my own version, which\nis geared and configured toward my personal use cases.\n\n\n\n\n# Usage\n\n\n\n\n## Simple Usage via Shell Function\n\nIt is rather convenient to declare a shell function inside your\nfavorite shell (`.bashrc` or `.zshrc`) to run the dockerized `snort3`.\n\n function snort () {\n docker run -it --rm --net=host -v $(pwd):/tmp \\\n snort3 snort -c /etc/snort/snort.lua -k none -l /tmp/ $@;\n sudo chmod 644 alert*.txt\n }\n\nHere, we bind-mount the current working directory into the container\nand define some rudimentary configuration for snort. The\n`chmod`-command in the function definition ensures that the resulting\nlogs files are readable for an unpriviledged user.\n\nNote that this approach necessitates that the rules (an eventually the\n.pcap-files to analyze) are present in the current working\ndirectory's.\n\nTo run it, just call it like so\n\n snort -R /tmp/snort.rules -r /tmp/test.pcap\n\nIf you want to run it in online-mode just use the following command:\n\n # Retrieve NIC to capture on\n NIC=$(ip -j a show \\\n | jq '.[] | .addr_info | .[] | select(.scope == \"global\") | .label ' \\\n | grep \"wlp\" | sed 's/\"//g')\n \n # Run snort\n snort -R /tmp/snort.rules -i $NIC\n\n\n\n\n## Elaborated Usage Via `docker-compose`\n\nIf you prefer a more static setup and just want to check .pcap-files,\nplaced in the sub-directory `./pcaps` using some Snort-rules placed in\n`./etc/rules/snort.rules`, then run:\n\n docker-compose up\n\nThis will append the arguments in the `command`-field of the\n`docker-compose.yml` to the `entrypoint` specified in there.\n\nAlternatively, you could use, the `docker-compose run`-command naming\nthe service to pass custom options to the entrypoint to achieve the\nsame:\n\n docker-compose run snort3 -r test.pcap\n\nNote that the .pcap-files are expected to live in the a/m\nsub-directory.\n\nTo run `snort3` in continuos online mode, run the following command.\n\n NIC=\"eth0\" # or another NIC available on the host machine\n docker-compose run snort3 -i ${NIC}\n\n\n\n\n# Acknowledgements\n\nThe Dockerfile is inspired by .\n\n","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":21,"_83":11,"_84":11},"read","write","admin","user","storage_size",700264664,"orgData","recentTags",[91,128],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":100,"_101":102,"_50":117,"_118":94,"_119":33,"_120":56,"_57":121,"_122":123,"_124":108,"_125":117,"_126":66,"_127":21},"content_type","creator",15648011,"digest","sha256:a318b42b7aed27a909d78fcc6cf51c7c4123682651898883c4364b8503bcaf9f","full_size",700256901,"id",281690038,"images",[103],{"_104":105,"_95":96,"_106":48,"_107":108,"_109":110,"_111":112,"_113":48,"_114":-5,"_115":98,"_63":66,"_116":-5},"architecture","amd64","features","last_pulled","2026-09-28T06:21:22.147592791Z","last_pushed","2022-08-31T15:32:26Z","os","linux","os_features","os_version","size","variant","2022-08-31T15:32:25.74893Z","last_updater","last_updater_username","media_type","latest","repository",17954890,"tag_last_pulled","tag_last_pushed","tag_status","v2",{"_92":44,"_93":94,"_95":96,"_97":98,"_99":129,"_101":130,"_50":132,"_118":94,"_119":33,"_120":56,"_57":133,"_122":123,"_124":108,"_125":132,"_126":66,"_127":21},281690034,[131],{"_104":105,"_95":96,"_106":48,"_107":108,"_109":110,"_111":112,"_113":48,"_114":-5,"_115":98,"_63":66,"_116":-5},"2022-08-31T15:32:25.240663Z","v0.0.0.1-alpha","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":147,"_154":155,"_141":168,"_169":11},{"_40":148,"_42":149,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":150,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":151,"_79":11,"_80":153,"_85":33,"_86":87},[],[44],[56],{"_75":11,"_76":152},[78],{"_82":21,"_83":11,"_84":11},"tags",{"_156":157,"_158":-5,"_159":-5,"_160":161},"count",2,"next","previous","results",[162,165],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":100,"_101":163,"_50":117,"_118":94,"_119":33,"_120":56,"_57":121,"_122":123,"_124":108,"_125":117,"_126":66,"_127":21},[164],{"_104":105,"_95":96,"_106":48,"_107":108,"_109":110,"_111":112,"_113":48,"_114":-5,"_115":98,"_63":66,"_116":-5},{"_92":44,"_93":94,"_95":96,"_97":98,"_99":129,"_101":166,"_50":132,"_118":94,"_119":33,"_120":56,"_57":133,"_122":123,"_124":108,"_125":132,"_126":66,"_127":21},[167],{"_104":105,"_95":96,"_106":48,"_107":108,"_109":110,"_111":112,"_113":48,"_114":-5,"_115":98,"_63":66,"_116":-5},[],"canDeleteTags","actionData","errors"]

jgru/snort3

Tags for jgru/snort3