WEBVTT 00:00:00.990 --> 00:00:03.330 [Autogenerated] It's time to go back into the lab and get 00:00:03.330 --> 00:00:05.780 started with installing the extras package. 00:00:06.120 --> 00:00:08.890 We're going to use this one to build and install it. 00:00:09.160 --> 00:00:10.120 So let's hop in. 00:00:11.760 --> 00:00:12.580 Alright. 00:00:12.590 --> 00:00:17.090 And here we are back in the lab ready to start configuring 00:00:17.090 --> 00:00:19.410 some of these Snort Plus plus extras. 00:00:20.090 --> 00:00:23.410 Now, as we've talked about in this module already, 00:00:23.420 --> 00:00:27.160 a lot of these extras are essentially plugins that we 00:00:27.160 --> 00:00:29.870 can use to expand snorts capabilities. 00:00:29.990 --> 00:00:34.580 They might be logging plugins they could be extra processors, 00:00:34.590 --> 00:00:37.810 it could be any number of things that add to the snort system. 00:00:37.820 --> 00:00:43.420 So let's go ahead and install the snort Plus Plus extras pack that 00:00:43.420 --> 00:00:47.220 snore offers for users to download and experiment with and it comes 00:00:47.220 --> 00:00:49.880 with some examples of ones we can use. 00:00:50.400 --> 00:00:53.100 We're gonna highlight one in this module that has to do with the 00:00:53.100 --> 00:00:56.130 application i D s and statistics around them. 00:00:56.140 --> 00:01:00.270 But we'll also take a look at some of the other ones that are available to us. 00:01:00.910 --> 00:01:04.140 So to install the Snort Plus Plus extras, 00:01:04.150 --> 00:01:08.050 we have to first get into our Snort source folder. 00:01:08.910 --> 00:01:11.410 This is where I built my snore installation on the box. 00:01:12.030 --> 00:01:16.880 We're gonna use some of the materials in here to build the extras as well. 00:01:16.890 --> 00:01:18.810 Now, while we're here, 00:01:18.820 --> 00:01:22.430 we're gonna use w get to pull down the tar dot GZ 00:01:22.430 --> 00:01:24.620 file for the snort three extras. 00:01:24.630 --> 00:01:28.880 You can find it on GitHub in the snort three repository. 00:01:30.200 --> 00:01:30.790 Alright. 00:01:30.790 --> 00:01:35.160 And we're gonna pull this down, wait for it to pull and safe. 00:01:35.640 --> 00:01:39.930 If we look here we have the snort three extra Tar dot GZ that we just created. 00:01:40.900 --> 00:01:44.070 Now let's UNt target and then hop into it. 00:01:44.920 --> 00:01:47.890 You may see a different version number if you just clone the Git 00:01:47.890 --> 00:01:52.110 hub repository or pull the most current version. 00:01:52.120 --> 00:01:55.210 This is a version that is a known good version for the 00:01:55.210 --> 00:01:57.650 snort installation that I currently have. 00:01:57.660 --> 00:02:01.660 So feel free to experiment with the different versions for the extras. 00:02:01.660 --> 00:02:03.910 If you run into certain issues, that way, 00:02:03.910 --> 00:02:06.580 you can make sure you have the maximum compatibility between 00:02:06.590 --> 00:02:08.970 this package and your snort three installation. 00:02:09.650 --> 00:02:11.310 Alright, now that we're in here, 00:02:11.330 --> 00:02:15.650 one other thing that we have to do is define our package Config path. 00:02:15.660 --> 00:02:20.760 So we're gonna just type in export package Config path equals. 00:02:20.760 --> 00:02:21.590 And then the path. 00:02:22.230 --> 00:02:25.320 Now in this installation it's gonna be under this directory right here. 00:02:25.320 --> 00:02:29.550 The USr local lib package Config So we're gonna leave this 00:02:29.550 --> 00:02:35.780 here and then now it's time to get ready to make and build 00:02:35.790 --> 00:02:37.190 the installation for this. 00:02:38.320 --> 00:02:41.640 Alright, now that we have the export done, 00:02:41.650 --> 00:02:45.050 we're gonna make it, let's go ahead and hit configure. 00:02:45.170 --> 00:02:47.080 See, make dot show. 00:02:48.160 --> 00:02:53.280 And then we'll define our prefix as that and then we'll 00:02:53.280 --> 00:02:55.760 hit enter and let it run through it. 00:02:55.760 --> 00:02:56.930 See make shell script. 00:02:57.870 --> 00:02:58.580 Right? 00:02:58.730 --> 00:03:00.000 The build files are done. 00:03:00.010 --> 00:03:03.810 So let's go ahead and get into their and we're gonna issue the 00:03:03.810 --> 00:03:07.570 command make And so this took a couple of minutes. 00:03:07.580 --> 00:03:09.610 But I fast forwarded the video for you. 00:03:09.610 --> 00:03:12.060 So it was almost instantaneous. 00:03:12.070 --> 00:03:13.860 and now we're done with the make. 00:03:13.870 --> 00:03:19.510 So the next step is to do Sudo make install and there we go. 00:03:20.250 --> 00:03:26.300 It is installed in this user local lib snort plugins directory. 00:03:26.310 --> 00:03:30.470 Keep an eye on this as you're doing your installations because 00:03:30.470 --> 00:03:33.840 understanding your snort path and where everything is installed is 00:03:33.840 --> 00:03:37.340 necessary for when you're actually trying to run snort and use these plug 00:03:37.340 --> 00:03:40.950 ins and extras in this particular installation. 00:03:40.960 --> 00:03:42.520 This is where it is, 00:03:42.520 --> 00:03:45.720 and this is going to have to be part of the snort command when 00:03:45.720 --> 00:03:47.560 we're going to run snort for this purpose. 00:03:47.570 --> 00:03:49.470 Now in the next demo, 00:03:49.700 --> 00:03:54.120 we're going to take this a step further and actually see some of 00:03:54.120 --> 00:03:58.460 the app IDE traffic in there and on top of that we'll go ahead 00:03:58.460 --> 00:04:01.930 and collect some statistics and then view the other plugins that 00:04:01.930 --> 00:04:02.870 have to do with this. 00:04:02.880 --> 00:04:04.470 So stay with me. 00:04:04.480 --> 00:04:06.010 We're gonna hop right into it.