An updated Sguil Installation Guide shows how to replace the Snort stream4 keepstats-based session data collection system with John Curry’s SANCP code. SANCP is a better option than stream4, as SANCP tracks not only TCP like stream4 but also UDP and ICMP. I’ve been experimenting with the best way to use Oinkmaster with my preferred directory layouts. I replaced these files in /usr/local/etc/snort with symlinks to the real files.”]
Source: https://taosecurity.blogspot.com/2004/08/hints-on-using-oinkmaster-and-sguil-i.html