SNORT2PF(8)

NAME
snort2pf - turns snort(8) into an Intrusion Detection and Prevention System

SYNOPSIS
snort2pf [-b blockcmd] [-d dumpfile] [-f alertfile] [-h] [-P] [-p pidfile] [-s seconds] [-t] [-u unblockcmd] [-v] [-w whitelist]

DESCRIPTION
The snort2pf daemon parses snort(8)'s alertfile (full or fast) and blocks the naughty hosts for a specific amount of time using pfctl.

On startup, snort2pf will seek to the end of alertfile and won't replay past alerts. It detects alertfile rotation automatically.

By default it inserts rules in subanchors below the "snort2pf" anchor. This is the historical behaviour but can be changed to using a table "snort2pf" by using the -t option. With anchor, you need this rule in your pf.conf(5):
    anchor "snort2pf"
With table, you need this kind of rule instead:
    block in from <snort2pf>

snort2pf is able to recover previously blocked host when starting. It will assign them the default amnesty time.

Everything is logged to syslog(3), using the LOG_DAEMON facility.

Upon reception of SIGUSR1, snort2pf will dump information about blocked hosts to syslog(3) using LOG_DEBUG or into dumpfile if it has been defined.

OPTIONS

-b blockcmd
    Execute this command each time an IP address is blocked. The IP address is appended to the command as the last argument.

-d dumpfile
    The file where state informations will be dumped instead of syslog(3) when SIGUSR1 is received.

-f alertfile
    The location of snort(8)'s alertfile. It may be either alert full or alert fast format. (/var/log/snort/alert)

-h  Show usage and exit

-P  Do not manipulate pf(4) (neither anchors nor table). This option is especially useful with the -b and -u flags.

-p pidfile
    The location of snort2pf's pidfile. (/var/run/snort2pf.pid)

-s seconds
    How long the naughty hosts should be blocked. (3600 seconds)

-t  Make snort2pf use a table called "snort2pf". This is more flexible since you can write your own rule and probably faster than using anchors.

    You need to use a rule like this in pf.conf(5):
        block in quick from <snort2pf>

-u unblockcmd
    Execute this command each time an IP address is unblocked. The IP address is appended to the command as the last argument.

-v  Show version.

-w whitelist
    The location of whitelist file, with one entry per line. It can contain CIDR subnets only if Net::Patricia module is installed, otherwise only single IP are accepted. It is reloaded immediately if its modification time changes.

EXAMPLES

# /usr/local/sbin/snort2pf -s 180 &

Blocks naughty hosts for 3 minutes (180 seconds).

BUGS AND KNOWN PROBLEMS
Snort2PF will only work with IPv4, not IPv6.

"Reactive IDS systems can be quite controversal, and require careful configuration or you can wind up a victim of your own cleverness. Caveats aside, budding BOFH's should give this a try." -- Dengue, OpenBSD Journal

SEE ALSO
pf.conf(5), pfctl(8), snort(8), snort2pfmon(8)

AUTHOR
Jeremie Le Hen <jeremie@le-hen.org> rewrote version 4.0.

Stephan Schmieder <ssc@unix-geek.info> wrote the original snort2pf up to version 3.4.