Control socket

Snort can be configured to provide a Unix socket that can be used to issue commands to the running process. You must build snort with the -enable-control-socket option. The control socket functionality is supported on Linux only.

Snort can be configured to use control socket using the command line argument -cs-dir <path> and snort config option cs_dir as follows:

    snort --cs-dir <path>
    config cs_dir:<path>

<path> specifies the directory for snort to creat the socket. If relative path is used, the path is relative to pid path specified. If there is no pid path specified, it is relative to current working directory.

A command snort_control is made and installed along with snort in the same bin directory when configured with the -enable-control-socket option.