require("snort_config")
HOME_NET = "any"
EXTERNAL_NET = "any"
dofile("/var/lib/snort/snort_defaults.lua")
dofile("/var/lib/snort/file_magic.lua")
references = default_references
classifications = default_classifications
output = { logdir="/var/log/snort/", show_year=true}
process = { daemon=true, chroot="/" }
snort = { ["-e"] = true, ["-M"] = true, ["--create-pidfile"] = true,
	["-z"] = 1, ["--id-zero"] = true, ["--pid-dir"] = "/var/run/snortpid/" }
ips = { mode = "tap", enable_builtin_rules = false }
perf_monitor = { base = false, format = "text", max_file_size=100999999999 }
alerts = { order ="pass reset block drop alert log" }
wizard = default_wizard
alert_fast = {file=true}
stream={}
stream_tcp={}
stream_udp={}
http_inspect={}
ssl={}
appid = { app_stats_rollover_size=0, app_detector_dir = "/var/cache/snort/openappid/" }
appid.log_stats=true
appid.log_app_names=true
appid.list_odp_detectors=true
appid.log_all_sessions=true
binder[#binder+1]={ when = { service = "ssl" }, use = { type = "ssl" } }
binder[#binder+1]={ when = { service = "http" }, use = { type = "http_inspect" } }
binder[#binder+1]={ use = { type = "wizard" } }
ips.rules = [[
	include /var/cache/snort/rules/snort3-malware-other.rules
	include /var/cache/snort/my_rules/m.rules
]]
ips.mode="tap"
daq = { module_dirs = { "/usr/lib/daq" } }
daq.inputs = {'1'}
daq.modules = { { name = 'nfq', mode='passive' } }
daq.modules[1].variables = { 'debug'}