# python3 /usr/local/bin/pulledpork/pulledpork.py -V
PulledPork v3.0.0.5

    https://github.com/shirkdog/pulledpork3
      _____ ____
     `----,\    )   PulledPork v3.0.0.5
      `--==\\  /    Lowcountry yellow mustard bbq sauce is the best bbq sauce. Fight me.
       `--==\\/
     .-~~~~-.Y|\\_  Copyright (C) 2021 Noah Dietrich, Colin Grady, Michael Shirk
  @_/        /  66\_  and the PulledPork Team!
    |    \   \   _(")
     \   /-| ||'--'   Rules give me wings!
      \_\  \_\\
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# snort -V

   ,,_     -*> Snort++ <*-
  o"  )~   Version 3.8.1.0
   ''''    By Martin Roesch & The Snort Team
           http://snort.org/contact#team
           Copyright (C) 2014-2025 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using DAQ version 3.0.19
           Using Hyperscan version 5.4.2 2025-08-12
           Using libpcap version 1.10.5
           Using LuaJIT version 2.1.1748459687
           Using LZMA version 5.6.3
           Using OpenSSL 1.1.1w-freebsd  11 Sep 2023
           Using PCRE2 version 10.45 2025-02-05
           Using ZLIB version 1.3.1

#!/bin/sh
# Change the interface as necessary
interface="re0"
prog="snort"
pid=`ps ax | awk '{if (match($5, ".*/snort$") || $5 == "snort") print $1}'`
start() {
        if test "$pid" != ""; then
                echo "$prog is already running as pid $pid."
        else
        echo "Starting $prog..."
        # This will run snort as root
        /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq -D \
	 -i ${interface} -l /var/log/snort --lua "alert_csv = { file = true } -M"
        # if you dont want snort to log to /var/log/messages when it starts for example, remove -M from above
        # This will run snort as user 'snort' and group 'snort'
        # /usr/local/bin/snort -c /usr/local/etc/snort.lua -D -u snort -g snort -i ${interface} -l /var/log/snort
        fi
}
stop () {
        if test "$pid" != ""; then
                kill $pid
                echo "$prog stopped."
        else
                echo "$prog is not running. Cannot stop."
        fi
        # This is a killall method, regardless of the variable 'pid'
        # /usr/bin/killall snort && echo "$prog stopped."
}
status() {
        if test "$pid" != ""; then
                echo "$prog is running as pid $pid."
        else
                echo "$prog is not running."
        fi
}
case "$1" in
start)
        start
        ;;
stop)
        stop
        ;;
restart)
        stop
        # It seems that killing of snort requires some time
        sleep 5
        # The pid variable has not been cleared when snort is killed,
        # but we don't know if snort is really killed, so check again
        pid=""
        pid=`ps ax | awk '{if (match($5, ".*/snort$") || $5 == "snort") print $1}'`
        start
        ;;
status)
        status
        ;;
*)
        echo $"Usage: $0 {start|stop|restart|status}"
        ;;
esac
exit 0
# end