{"id":15474944,"url":"https://github.com/linuxbozo/snort3-merlin","last_synced_at":"2025-03-28T13:25:14.638Z","repository":{"id":140515461,"uuid":"612441839","full_name":"LinuxBozo/snort3-merlin","owner":"LinuxBozo","description":"snort3 for Asus-merlin","archived":false,"fork":false,"pushed_at":"2023-03-23T03:13:45.000Z","size":92,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2024-10-19T02:15:22.595Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/LinuxBozo.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-03-11T00:46:35.000Z","updated_at":"2023-03-18T02:09:30.000Z","dependencies_parsed_at":null,"dependency_job_id":"a52294b2-b7b0-4114-a6c7-633f4b23a9ee","html_url":"https://github.com/LinuxBozo/snort3-merlin","commit_stats":{"total_commits":5,"total_committers":2,"mean_commits":2.5,"dds":"0.19999999999999996","last_synced_commit":"04002fc9e0ca961cab2a3faaab56c1822af04180"},"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LinuxBozo%2Fsnort3-merlin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LinuxBozo%2Fsnort3-merlin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LinuxBozo%2Fsnort3-merlin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LinuxBozo%2Fsnort3-merlin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/LinuxBozo","download_url":"https://codeload.github.com/LinuxBozo/snort3-merlin/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246035730,"owners_count":20713144,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-02T03:05:54.339Z","updated_at":"2025-03-28T13:25:14.620Z","avatar_url":"https://github.com/LinuxBozo.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# snort3 build for ASUS-Merlin firmware and Entware\n\n## Background\nInspired by the work done by [faux123](https://github.com/faux123/snort3), I decided\nto update to the latest that is included in the updated main branch of Entware.\nThere are many reasons why this isn't built as part of the current Entware repository,\nbut mainly, if you want `afpacket` for packet monitoring, you have to compile against\na kernel version of 3.14+. The current version of Entware for the ASUS architecture\n(aarch64) is based around kernel 3.10.x. Why do you care about `afpacket`? `afpacket` tends to have better\nperformance and less issues with packets dropping up until you get to\naround 10G connections, and then, it becomes a dead heat with `pcap`. For most of us,\nWe are rocking 1G fiber at the top end, so `afpacket` works great for us, and we need that\nlittle extra performance on these more resource constrained embedded devices.\n\nKnowing that we can [cross compile](https://github.com/crosstool-ng/crosstool-ng) for 4.1.49,\nand that at least on my AX11000 we have a 4.1.51 kernel running, I did some modifications to\nconfigure Entware for just this type of setup.\n\n---\n\n**BEWARE!** This only works on a device with a newer 4.1+ kernel on the proper architecture. Please double check to make sure your device is compatible.\nTo check your device for your kernel version and architecture:\n- ssh or telnet into your router\n- issue the command: `uname -rm`\n  - you should see something like this: `4.1.51 aarch64`\n\n---\n\n## How to install it?\n\n- Download all the packages to your router from the current Release\n    - The one exception here may be libopenssl_3 packages. If you can, update from the official\n    Entware repository before trying this one.\n- You'll need to modify your `/opt/etc/opkf.conf` to add `aarch64-4.1` as a valid architecture to be able to install these packages\n    - Add the following line at the end of your opkg.conf: `arch aarch64-4.1 200` and save\n- Install using opkg in this order:\n    - libopenssl_3* (skip these if you already upgraded from the Entware repo)\n    - libpciaccess\n    - libhwloc\n    - libtirpc\n    - libdaq3\n    - snort3\n- Follow the rest of the [directions from faux123](https://www.snbforums.com/threads/experimental-snort3-ids-ips-on-asusmerlin-ac86-ax88-routers-only.66123/) on SmallNetBuilder\n\n---\n**UNTESTED**\nYou can try to use the `snort_manager.sh` script to do the install\n\n```\nmkdir -p /jffs/addons/snort 2\u003e/dev/null\ncurl --retry 3 \"https://raw.githubusercontent.com/linuxbozo/snort3-merlin/main/snort_manager.sh\" -o \"/jffs/addons/snort/snort_manager.sh\" \u0026\u0026 chmod 755 \"/jffs/addons/snort/snort_manager.sh\" \u0026\u0026 /jffs/addons/snort/snort_manager.sh install\n```\n---\n\n## How did you build these?\nThe step by step is laid out in the GitHub Action workflow, which you can view as part of this repo in case you want to replicate how I'm doing this. The basics:\n- Have a linux machine\n- Checking out this repo\n- Checking out the [Entware/Entware](https://github.com/Entware/Entware) repo\n- Making sure I have all the necessary build tools installed to build the cross compiler (`build-essential`, etc)\n- Modify the Entware source to enable `aarch64-4.1` as a valid architecture by copying in the contents of this repos `aarch64-4.1` directory\n- Run `make package/symlinks` to get Entware to download all the packages source from various GitHub repos, like [entware-packages](https://github.com/Entware/entware-packages)\n- Make sure Entware is configured to use the `aarch64-4.1` .config\n- Build the cross compiler tools and toolchain (gcc, etc)\n- Modify some of the packages source code to use the hard coded `/opt` path that Entware uses instead of `/` or `/usr`\n- Build all the various packages using their specific package/compile target\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flinuxbozo%2Fsnort3-merlin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flinuxbozo%2Fsnort3-merlin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flinuxbozo%2Fsnort3-merlin/lists"}