# # HenWen (Snort for Mac OS X)
APLawrence.com -  Resources for Unix and Linux Systems, Bloggers and the self-employed

2005/05/30 HenWen (Snort for Mac OS X)

I've removed advertising from most of this site and will eventually clean up the few pages where it remains.

While not terribly expensive to maintain, this does cost me something. If I don't get enough donations to cover that expense, I will be shutting the site down in early 2020.

If you found something useful today, please consider a small donation.



Some material is very old and may be incorrect today

© May 2005 Tony Lawrence

There's no reason that you can't just download and install Snort on Mac OS X. But if you don't want to install the development system, or never seem to have luck compiling from source, HenWen is a Mac GUI front end. As HenWen also includes a snort binary, you could also install HenWen just to get that and throw the rest of it away.

view of HenWen rules configuration

The GUI interface does have it's attractions, though. It's much easier to turn rules on and off with a click than to hunt them down in the /etc/snort/rules directory. It actually just presents the rules in the sections as they actually are in /HenWen.app/Contents/Resources/rules, and doesn't give you access to individual lines.. You can add new rules easily enough, although you don't really write them here: you point HenWen at a text file you have created by some other means. Writing Snort rules is not the easiest task, and requires detailed knowledge of the protocols you are trying to watch, as well as knowledge of Snort's rule keywords and arguments. For most of us, that means we probably downloaded a rule someone else wrote. We'd then point HenWen at it.

For real-time alerts, HenWen includes an application called LetterStick, which normally runs as a daemon and appears as a small icon in your menu bar. If Snort triggers an alert, and HenWen is configured to log to LetterStick, an alert box will pop up on your console. It helpfully includes a "What's This?" button which will take you to a Snort page that explains what the alert may mean.

If you just want to use snort directly, copy the binary from /Applications/HenWen.app/Contents and use it directly. Snort isn't particularly difficult to use - HenWen doesn't install a man page but there are plenty of on-line resources at http://www.snort.org if you prefer more direct control.


If you found something useful today, please consider a small donation.



Got something to add? Send me email.





(OLDER)    <- More Stuff -> (NEWER)    (NEWEST)   

Printer Friendly Version

->
-> HenWen (Snort for Mac OS X)


Inexpensive and informative Apple related e-books:

Take Control of Preview

El Capitan: A Take Control Crash Course

Take control of Apple TV, Second Edition

Take Control of iCloud

Sierra: A Take Control Crash Course





More Articles by © Tony Lawrence





Printer Friendly Version

Have you tried Searching this site?

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more.

Contact us


Printer Friendly Version





[This] reminds me of a quotation from somebody that, whenever he tried to explain the logical structure of a programming language to a programmer, it was like a cat trying to explain to a fish what it feels like to be wet. (Saul Gorn)




Linux posts

Troubleshooting posts


This post tagged:

Security



Unix/Linux Consultants

Skills Tests

Unix/Linux Book Reviews

My Unix/Linux Troubleshooting Book

This site runs on Linode