The configure options in detail

--prefix=DIR

Gives the prefix to the installed binary, manual pages, documentation files and configuration files. These are stalled in DIR/bin, DIR/man, DIR/doc and DIR/conf.

--with-snort=DIR

This option is required. DIR should point to the configured snort sources. These are required to build the FLoP package. At least we need config.h of the snort sources. Additionally there is a little test to see if the patch is applied.

--with-mysql=DIR

This option activates the support for the MySQL database. DIR should point to the MySQL directory where the header and library files can be found. If first tries to run DIR/bin/mysql_config to get the compiler settings and flags.

--with-postgres=DIR

This option activates the support for the PostgreSQL database. DIR should point to the PostgeSQL directory where the header and library files can be found. The first try is to run DIR/bin/pg_config to get the compiler settings and flags. Note: You can activate both databases. You have to decide within servsock.conf which one should be used.

--with-libbind

This enables the use of libbind during the link process. Since the programs can use the library functions getipnodebyname() and getipnodebyaddr() which are not part of every operating system we can use this library for these functions. If this option is not activated then the functions gethostbyname() and gethostbyaddr() are used instead. So probably you will not activate this configure option.

--enable-drop

This enables the build of the program drop and activates the interfaces in sockserv and servsock. Note: You have still to activate this feature via the command line options or the configuration file. So it is save to enable this feature and therefore it is activated by default.

--enable-alert

This enables the build of the program alert and activates the interfaces in sockserv and servsock. Note: You still have to activate this feature via the command line options or the configuration file. So it is save to enable this feature and therefore it is enabled by default.

--enable-getpacket

This enables the build of the program getpacket which is able to rebuild a file with the network packet in pcap format from the database. Note: You have to extend the database scheme to use this feature and have to advise servsock to store the additional needed information in the database.

If you want to use libpcap to build the pcap file from the database you have to use the option --with-libpcap. But normally this is not necessary, getpacket is able to build the pcap file without the use of libpcap.

--enable-fpg

This enables the build of the program fpg. To compile this program you need the libnet library version 1.1 or newer. Since the API of libnet seems to change quiet frequently it is not unlekely that it will not compile clean. Therefore the option to compile this program is disabled by default.

--enable-prepare

This enables the use of the PREPARE command in conjunction with the PostgreSQL database. The effect is that all SQL statements where prepared, it is no longer necessary to do a type chech and similar operations. This may enhance the performance of the database access.

Note: This is not implemented for the MySQL database.

Note: It seems that at least with the actual snort database scheme this kind of optimization is already done by the client library of PostgreSQL.

--enable-cache

This enables the use of a cache for the sig_ids. If an alert is to be inserted the first thing is to ask for the sig_id of the signature. This is used for all further INSERTs. Since this is the only read statement it slows down the database access. The idea is to store all used sig_ids in a cache to avoid further SELECTs for them. This cache is implemented as a red-black binary tree.

--with-maxclients=clients

This option is specifies how many sensors can connect to servsock simultaneously. The default are 25 sensors or alternatively sockserv processes.