2005/05/30 HenWen (Snort for Mac OS X)

There's no reason that you can't just download and install Snort on Mac OS X. But if you don't want to install the development system, or never seem to have luck compiling from source, HenWen is a Mac GUI front end. As HenWen also includes a snort binary, you could also install HenWen just to get that and throw the rest of it away.

view of HenWen rules configuration

The GUI interface does have it's attractions, though. It's much easier to turn rules on and off with a click than to hunt them down in the /etc/snort/rules directory. It actually just presents the rules in the sections as they actually are in /HenWen.app/Contents/Resources/rules, and doesn't give you access to individual lines.. You can add new rules easily enough, although you don't really write them here: you point HenWen at a text file you have created by some other means. Writing Snort rules is not the easiest task, and requires detailed knowledge of the protocols you are trying to watch, as well as knowledge of Snort's rule keywords and arguments. For most of us, that means we probably downloaded a rule someone else wrote. We'd then point HenWen at it.

For real-time alerts, HenWen includes an application called LetterStick, which normally runs as a daemon and appears as a small icon in your menu bar. If Snort triggers an alert, and HenWen is configured to log to LetterStick, an alert box will pop up on your console. It helpfully includes a "What's This?" button which will take you to a Snort page that explains what the alert may mean.

If you just want to use snort directly, copy the binary from /Applications/HenWen.app/Contents and use it directly. Snort isn't particularly difficult to use - HenWen doesn't install a man page but there are plenty of on-line resources at http://www.snort.org if you prefer more direct control.

Got something to add? Send me email.

(OLDER) <- More Stuff -> (NEWER)    (NEWEST)   

Printer Friendly Version

-> -> HenWen (Snort for Mac OS X)

Increase ad revenue 50-250% with Ezoic

More Articles by

Find me on Google+

© Tony Lawrence

Kerio Connect Mailserver

Kerio Samepage

Kerio Control Firewall

Have you tried Searching this site?

Support Rates

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more.

Contact us

Once you eliminate the impossible, whatever remains, no matter how improbable, must be the truth. (Arthur Conan Doyle)

This post tagged: