# Snort configuration
# This file is manipulated on PacketFence's startup before being given to snort
var INTERNAL_IPS [%%internal-ips%%]
var HOME_NET [%%internal-nets%%]
var EXTERNAL_NET !$HOME_NET
var GATEWAYS [%%gateways%%]

var DHCP_SERVERS [%%dhcp_servers%%]
var DNS_SERVERS [%%dns_servers%%]
var HTTP_PORTS 80
var SSH_PORTS 22
var ORACLE_PORTS 1521
var SHELLCODE_PORTS any
var HTTP_SERVERS $HOME_NET
var SQL_SERVERS $HOME_NET
var SMTP_SERVERS $HOME_NET
var TELNET_SERVERS $HOME_NET

var VALIDDHCP [$DHCP_SERVERS,$GATEWAYS,$INTERNAL_IPS]

var RULE_PATH %%install_dir%%/conf/snort

output alert_fast: %%install_dir%%/var/alert

# updated several preprocessor for snort 2.8.5 (values taken from /etc/snort/snort.conf)
preprocessor stream5_global: max_tcp 8192, track_tcp yes, \
                              track_udp no
preprocessor stream5_tcp: policy first, use_static_footprint_sizes

preprocessor http_inspect: global \
    iis_unicode_map /etc/snort/unicode.map 1252

preprocessor http_inspect_server: server default \
    profile all ports { 80 8080 8180 } oversize_dir_length 500

#preprocessor conversation: timeout 120, max_conversations 65335
#preprocessor portscan2: scanners_max 10000, targets_max 10000, target_limit 400, port_limit 400, timeout 60, log /dev/null
#preprocessor portscan2-ignorehosts: $EXTERNAL_NET

preprocessor perfmonitor: time 600 flow max file %%install_dir%%/logs/snortstat pktcnt 90000 
output alert_syslog: LOG_AUTH LOG_ALERT

config flowbits_size: 256
config disable_decode_alerts
config disable_tcpopt_experimental_alerts
config disable_tcpopt_obsolete_alerts
config disable_tcpopt_ttcp_alerts
config disable_ttcp_alerts
config disable_tcpopt_alerts
config disable_ipopt_alerts

include $RULE_PATH/classification.config
include $RULE_PATH/reference.config
%%snort_rules%%
