title: How to Start Snort on OpenWRT?
body: <p>Recently I replace my router OS with OpenWRT, and I've install snort(2.9) on it with :</p>
  <pre><code>opkg install snort
  </code></pre>
  <p>My One and Only rule in <code>/etc/snort/rules/local.rules</code> :</p>
  <pre><code>alert icmp any any -&gt; [My Router Private IP like : 192.168.0.1] any (msg: &quot;NMAP ping sweep Scan&quot;; dsize:0;sid:10000004; rev: 1;)
  </code></pre>
  <p>The problem is when i run :</p>
  <pre><code>snort -A console -q -c /etc/snort/snort.conf -i br-lan --daq-dir /usr/lib/daq
  </code></pre>
  <p>On the command line, it is <strong>Okay</strong> and it detects some Nmap scan attacks and wrote the alerts in console :</p>
  <pre><code>04/12-08:19:50.152690  [**] [1:10000005:2] NMAP TCP Scan [**] [Priority: 0] {TCP} 192.168.0.10:46287 -&gt; 192.168.0.1:22
  </code></pre>
  <p>and log file, But when I start the service by :</p>
  <pre><code>/etc/init.d/snort start
  </code></pre>
  <p>Nothing happens and no log file created when I use same Nmap command (<code>nmap -sX -p22 192.168.0.1</code>).</p>
  <p>My Questions are :</p>
  <ol>
  <li><p>Why the server is not running ?
  There is no way detecting if every thing okay with service without Systemctl.</p>
  </li>
  <li><p>Why the log created when i run snort command is nonsense?
  When I type for example <code>cat /var/log/snort/snort.log.1523473976</code>  I get :</p>
  <p>�����Z�^8Mvv�n6(爈���Ehu�@@A3��&lt;���</p>
  </li>
  </ol>
  <p>in the console.</p>
  <p><strong>PS</strong> :
  1 -<code>cat /etc/init.d/snort</code> :</p>
  <pre><code>#!/bin/sh /etc/rc.common
  # Copyright (C) 2015 OpenWrt.org
  
  START=90
  STOP=10
  
  USE_PROCD=1
  PROG=/usr/bin/snort
  
  validate_snort_section() {
      uci_validate_section snort snort &quot;${1}&quot; \
          'config_file:string' \
          'interface:string'
  }
  
  start_service() {
      local config_file interface
  
      validate_snort_section snort || {
          echo &quot;validation failed&quot;
          return 1
      }
  
      procd_open_instance
      procd_set_param command $PROG &quot;-c&quot; &quot;$config_file&quot; &quot;-q&quot; &quot;--daq-dir&quot; &quot;/usr/lib/daq/&quot; &quot;-i&quot; &quot;$interface&quot; &quot;-s&quot; &quot;-N&quot;
      procd_set_param file $CONFIGFILE
      procd_set_param respawn
      procd_close_instance
  }
  
  stop_service()
  {
      service_stop ${PROG}
  }
  
  service_triggers()
  {
      procd_add_reload_trigger &quot;snort&quot;
      procd_add_validation validate_snort_section
  }
  </code></pre>
  <p>2- I actually followed <a href="https://wiki.openwrt.org/doc/howto/snort" rel="nofollow noreferrer">This link</a> to configure. but I uncomment and set <code>config logdir</code>: to <code>/var/log/snort/</code> .</p>
  <p>(Any help would be greatly appreciated)</p>