gkoyuncu · September 16, 2015 19:39
diff --git a/ipfw config b/ipfw config
 00100     52     3439 allow ip from any to any via lo0
 00200  56240 35833050 divert 9080 ip from any to any
 65535 102055 60910771 allow ip from any to any
diff --git a/sample rule b/sample rule
 drop tcp any any -> any any (msg:"Ubuntu!"; content:"ubuntu"; react:msg; sid:1000001;)
diff --git a/snort command line b/snort command line
 snort --daq ipfw --daq-mode inline --daq-var port=9080 -c /path/to/snort.conf -x -Q -k none
	00100 52 3439 allow ip from any to any via lo0
	00200 56240 35833050 divert 9080 ip from any to any
	65535 102055 60910771 allow ip from any to any