After you build the programs you have to configure them:

+ sockserv
----------
  sockserv does not use any configuration file
  normally all you need to do is to say sockserv
  where to find the servsock program:

    sockserv -S address.of.your.server -p port

  sockserv will open a unix socket: /tmp/snort

+ snort
-------
  To tell snort that he should write the alerts to
  the opened unis socket you have to enable the 
  appropiate ouput plugin in snort.conf:

    output alert_unixsock_db: /tmp/snort

+ alert / drop
--------------
  These two programs are very similar and based on 
  the same code. They can use a configuration file
  or command line arguments.

  Values which should be set are well documented
  in the default config files and the manual pages.

  The most important values are the mail server, this
  server should allow relaying, and the list of recipients.
  The later one can be repeated several times to create a
  list of recipients.

+ servsock
----------
  This is the heart of the whole project. the options
  can be set on command line and configuration files.
  The parameter for the database access can only be 
  set in the configuration file. The reason is quite
  easy: Normally you will need a password to connect
  to the database. This password should not be displayed
  in a call to the 'ps' command...

  Important parts are the ServerName and ServerPort.
  The first one should be an IP address where servsock
  should listen for packets from sockserv.

+ fpg
-----
  This program needs root privileges to be run.
  In the easiest case you will simply call it as

    fpg -c snort.conf -s source.address.to.use \
        -d destination.address.to.use

  This will try to build to each rule of snort.conf
  one packet triggering the alert.

NOTE: Most rules will not fire an alert if they use the
      established keyword and you use the stream4 pre-
      processor of snort to be stateful.

NOTE: On fast machines you will experience a socket
      overrun in resulting less packets to reach the
      wire. Therefore fpg has some additional command
      line options to slow his output.

+ getpacket
-----------
  This program can rebuild a pcap file from the alert
  stored in the database. You need to extend the database
  scheme first and enable FullPayload in servsock.conf
  (or command line option -f). See the file README.payload

  ./getpacket -C cid -S sid -c getpacket.conf -w alert.pcap

  Instead of getpacket.conf you can use the file 
  servsock.conf, it is only needed for the database
  access.

  sid is the sensor ID, cid is the counter ID for this sensor
  alert.pcap is the file containing the full alert packet.

For further information read the manual packages
for these programs and configuration files:

sockserv.8 alert.8 alert.conf.5 drop.8 drop.conf.5
servsock.8 servsock.conf.5 fpg.8 geptacket.8
getpacket.conf.5

And finally take a look at the documentation in the
doc/ directory and the varius README files.
