[HaBo]

hero init.d # snort -V 

   ,,_     -*> Snort! <*- 
  o"  )~   Version 2.4.3 (Build 26) 
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/team.html 
           (C) Copyright 1998-2005 Sourcefire Inc., et al. 
 NOTE: Snort's default output has changed in version 2.4.1! 
       The default logging mode is now PCAP, use "-K ascii" to activate 
       the old default logging mode. 

hero init.d # 
hero init.d # ./snort start 
 * Starting snort ...                                                     [ ok ] 
hero init.d # 
hero init.d # ps xa 
< cut > 
24122 ?        Ss     0:01 /usr/bin/snort -D -u snort -i eth1 -l /var/log/snort 
24131 pts/0    R+     0:00 ps xa 
hero init.d # 

#/etc/conf.d/snort 

# Config file for /etc/init.d/snort 

# This tell snort which interface to listen on (any for every interface) 
IFACE=eth1 

# Make sure this matches your IFACE 
PIDFILE=/var/run/snort_$IFACE.pid 

# You probably don't want to change this, but in case you do 
LOGDIR="/var/log/snort" 

# Probably not this either 
CONF=/etc/snort/snort.conf 

# This pulls in the options above 
SNORT_OPTS="-D -u snort -i $IFACE -l $LOGDIR -c $CONF" 

#/etc/init.d/snort 

#!/sbin/runscript 
# Copyright 1999-2004 Gentoo Foundation 
# Distributed under the terms of the GNU General Public License v2 
# $Header: /var/cvsroot/gentoo-x86/net-analyzer/snort/files/snort.rc6,v 1.6 200$ 

depend() { 
        need net 
} 

checkconfig() { 
        if [ ! -e $CONF ] ; then 
                eerror "You need a configuration file to run snort" 
                eerror "There is an example config in /etc/snort/snort.conf.dis$ 
                return 1 
        fi 
} 

start() { 
        checkconfig || return 1 
        ebegin "Starting snort" 
        start-stop-daemon --start --quiet --exec /usr/bin/snort \ 
                -- ${SNORT_OPTS} >/dev/null 2>&1 
        eend $? 
} 

stop() { 
        ebegin "Stopping snort" 
        start-stop-daemon --stop --quiet --pidfile ${PIDFILE} 
        eend $? 
}