configuring-snort-ids-for-intrusion-detection

Installs, configures, and tunes Snort 3 intrusion detection system to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins on authorized network segments.

Jump to install

Repository: AgentFlocks/flocks
Last source activity: May 5, 2026 at 05:45
Detected SKILL.md language: English
Stars: 445
Forks: 83

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

Back to search Back to installation

name	configuring-snort-ids-for-intrusion-detection
description	Installs, configures, and tunes Snort 3 intrusion detection system to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins on authorized network segments.
domain	cybersecurity
subdomain	network-security
tags	["network-security","snort","ids","intrusion-detection","rule-writing"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"]

Configuring Snort IDS for Intrusion Detection

When to Use

Deploying a network-based intrusion detection system to monitor traffic at key network boundaries
Writing custom Snort rules to detect organization-specific threats, attack patterns, or policy violations
Tuning existing rulesets to reduce false positives while maintaining detection coverage
Integrating Snort alerts with SIEM platforms for centralized security monitoring
Validating network security controls by generating test traffic and confirming detection

Do not use as a replacement for endpoint detection, for monitoring encrypted traffic without TLS inspection, or as the sole security control without complementary defenses.

Prerequisites

Snort 3.x installed from source or package manager (snort --version to verify)
Network interface configured for promiscuous mode on a span port or network tap
DAQ (Data Acquisition Library) installed for packet capture integration
Registered Snort account for downloading Snort Subscriber (paid) or Community rulesets from snort.org
PulledPork 3 or similar rule management tool for automated ruleset updates
Sufficient CPU and memory for inline traffic inspection at line rate

Workflow

Step 1: Install and Verify Snort 3

# Install dependencies (Ubuntu/Debian)
sudo apt install -y build-essential libpcap-dev libpcre3-dev libnet1-dev \
  zlib1g-dev luajit hwloc libdumbnet-dev bison flex libcmocka-dev \
  libnetfilter-queue-dev libmnl-dev autotools-dev libluajit-5.1-dev \
  pkg-config cmake libhwloc-dev liblzma-dev openssl libssl-dev cpputest \
  libsqlite3-dev uuid-dev

# Install DAQ from source
git clone https://github.com/snort3/libdaq.git
cd libdaq && ./bootstrap && ./configure && make && sudo make install

# Install Snort 3
git clone https://github.com/snort3/snort3.git
cd snort3 && ./configure_cmake.sh --prefix=/usr/local
cd build && make -j$(nproc) && sudo make install
sudo ldconfig

# Verify installation
snort -V

Step 2: Configure Network Interfaces

# Disable offloading features that interfere with packet inspection
sudo ethtool -K eth1 gro off lro off tso off gso off rx off tx off

# Enable promiscuous mode
sudo ip link set eth1 promisc on

# Create systemd service for persistent interface configuration
sudo tee /etc/systemd/system/snort-iface.service << 'EOF'
[Unit]
Description=Configure Snort capture interface
Before=snort.service

[Service]
Type=oneshot
ExecStart=/sbin/ethtool -K eth1 gro off lro off tso off gso off rx off tx off
ExecStart=/sbin/ip link set eth1 promisc on
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable snort-iface.service

# Create Snort directory structure
sudo mkdir -p /usr/local/etc/snort/{rules,builtin_rules,lists,appid}
sudo mkdir -p /var/log/snort

# Edit the main Snort configuration
sudo tee /usr/local/etc/snort/snort.lua << 'LUAEOF'
-- Snort 3 Configuration

-- Network variables
HOME_NET = '10.10.0.0/16'
EXTERNAL_NET = '!$HOME_NET'

-- Path variables
RULE_PATH = '/usr/local/etc/snort/rules'
BUILTIN_RULE_PATH = '/usr/local/etc/snort/builtin_rules'

-- Configure DAQ
daq = {
    module_dirs = { '/usr/local/lib/daq' },
    modules = { { name = 'afpacket', variables = { 'buffer_size_mb=256' } } }
}

-- Decoder configuration
normalizer = { tcp = { ips = true } }

-- Stream inspection
stream = { }
stream_tcp = { policy = 'linux', session_timeout = 180 }
stream_udp = { session_timeout = 30 }
stream_icmp = { }

-- HTTP inspection
http_inspect = { }

-- DNS inspection
dns = { }

-- SSL/TLS inspection
ssl = { }

-- SMB inspection
dce_smb = { }

-- File identification and processing
file_id = { rules_file = '/usr/local/etc/snort/file_magic.rules' }

-- Port scan detection
port_scan = {
    protos = 'all',
    scan_types = 'all',
    memcap = 10000000
}

-- Reputation-based filtering
-- reputation = {
--     blacklist = RULE_PATH .. '/blocklist.rules'
-- }

-- IPS rules
ips = {
    enable_builtin_rules = true,
    include = RULE_PATH .. '/snort3-community.rules',
    variables = {
        nets = { HOME_NET = HOME_NET, EXTERNAL_NET = EXTERNAL_NET },
        ports = {
            HTTP_PORTS = '80 8080 8443',
            SSH_PORTS = '22',
            DNS_PORTS = '53'
        }
    }
}

-- Alert output
alert_fast = {
    file = true,
    packet = false,
    limit = 100
}

-- Unified2 output for Barnyard2/SIEM integration
-- alert_unified2 = { limit = 128 }

-- JSON alert output
alert_json = {
    file = true,
    limit = 100,
    fields = 'timestamp pkt_num proto pkt_gen pkt_len dir src_addr src_port dst_addr dst_port service rule action'
}

-- Syslog output
-- alert_syslog = { level = 'info', facility = 'local1' }

LUAEOF

# Download Snort 3 Community Rules
wget https://www.snort.org/downloads/community/snort3-community-rules.tar.gz
tar xzf snort3-community-rules.tar.gz
sudo cp snort3-community-rules/snort3-community.rules /usr/local/etc/snort/rules/

# Install PulledPork 3 for automated rule management
git clone https://github.com/shirkdog/pulledpork3.git
cd pulledpork3
sudo python3 setup.py install

# Configure PulledPork
sudo tee /usr/local/etc/pulledpork3/pulledpork.conf << 'EOF'
registered_ruleset = true
oinkcode = <YOUR_OINK_CODE>
snort_path = /usr/local/bin/snort
local_rules = /usr/local/etc/snort/rules/local.rules
sorule_path = /usr/local/etc/snort/so_rules/
snort_version = 3.0.0.0
blocklist_path = /usr/local/etc/snort/lists/
pid_path = /var/run/snort.pid
ips_policy = balanced
EOF

# Run PulledPork to fetch and process rules
sudo pulledpork3 -c /usr/local/etc/pulledpork3/pulledpork.conf

# Create local rules file
sudo tee /usr/local/etc/snort/rules/local.rules << 'EOF'
# Detect reverse shell on common ports
alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (
    msg:"LOCAL Possible Reverse Shell on port 4444";
    flow:established,to_server;
    content:"/bin/sh"; nocase;
    sid:1000001; rev:1;
    classtype:trojan-activity;
    priority:1;
)

# Detect Mimikatz execution indicators over SMB
alert tcp any any -> $HOME_NET 445 (
    msg:"LOCAL Mimikatz Lateral Movement via SMB";
    flow:established,to_server;
    content:"|FF|SMB";
    content:"mimikatz"; nocase; distance:0;
    sid:1000002; rev:1;
    classtype:trojan-activity;
    priority:1;
)

# Detect DNS tunneling (high-entropy long subdomain queries)
alert udp $HOME_NET any -> any 53 (
    msg:"LOCAL Possible DNS Tunneling - Long Query Name";
    content:"|01 00|"; offset:2; depth:2;
    byte_test:1,>,50,12;
    sid:1000003; rev:1;
    classtype:policy-violation;
    priority:2;
)

# Detect cleartext password transmission via FTP
alert tcp $HOME_NET any -> any 21 (
    msg:"LOCAL FTP Cleartext Password Detected";
    flow:established,to_server;
    content:"PASS "; depth:5;
    sid:1000004; rev:1;
    classtype:policy-violation;
    priority:2;
)

# Detect potential port scan (SYN flood pattern)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (
    msg:"LOCAL Possible Port Scan SYN Flood";
    flow:stateless;
    flags:S,12;
    threshold:type both, track by_src, count 100, seconds 10;
    sid:1000005; rev:1;
    classtype:attempted-recon;
    priority:2;
)
EOF

# Validate configuration
snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq -T

# Run Snort in IDS mode on the capture interface
sudo snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq \
  -i eth1 -l /var/log/snort -D

# Test rules against a PCAP file
snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq \
  -r test_traffic.pcap -l /var/log/snort/test/ -A fast

# Create systemd service for production deployment
sudo tee /etc/systemd/system/snort.service << 'EOF'
[Unit]
Description=Snort 3 IDS
After=network.target snort-iface.service

[Service]
Type=simple
ExecStart=/usr/local/bin/snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq -i eth1 -l /var/log/snort -D
ExecReload=/bin/kill -SIGHUP $MAINPID
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable --now snort.service

# View real-time alerts
tail -f /var/log/snort/alert_fast.txt

# Parse JSON alerts for analysis
cat /var/log/snort/alert_json.txt | python3 -m json.tool

# Identify top triggered rules for tuning
grep -oP 'sid:\d+' /var/log/snort/alert_fast.txt | sort | uniq -c | sort -rn | head -20

# Suppress noisy false-positive rules
sudo tee -a /usr/local/etc/snort/rules/suppress.rules << 'EOF'
suppress gen_id 1, sig_id 2100498, track by_src, ip 10.10.1.100
suppress gen_id 1, sig_id 2100366, track by_dst, ip 10.10.5.0/24
EOF

# Verify rule count and performance
snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq -T 2>&1 | grep -i "rules loaded"

Term	Definition
IDS vs IPS	IDS passively monitors traffic and generates alerts; IPS sits inline and can actively block or drop malicious packets in real time
Snort Rule	Detection signature with header (action, protocol, src/dst, ports) and options (content matches, flow direction, metadata) that triggers on matching traffic
Preprocessor	Snort component that normalizes and reassembles protocol-specific traffic before rule inspection, handling fragmentation, stream reassembly, and protocol anomalies
DAQ (Data Acquisition)	Abstraction layer in Snort 3 that interfaces with packet capture mechanisms (AF_PACKET, PCAP, NFQ) for receiving network data
Oink Code	Personal registration code from snort.org required to download Snort Subscriber or Registered rulesets
Threshold/Suppression	Tuning mechanisms that control alert frequency (threshold) or completely silence alerts from specific sources/destinations (suppress)

## Snort IDS Deployment Report

**Sensor**: snort-sensor-01 (10.10.1.250)
**Interface**: eth1 (span port from Core-SW1 gi0/24)
**Configuration**: /usr/local/etc/snort/snort.lua
**Ruleset**: Snort Community 3.0 + Local Rules (1,247 active rules)
**HOME_NET**: 10.10.0.0/16

### Detection Summary (24-hour baseline)

| Category | Alert Count | Top Rule SID |
|----------|-------------|--------------|
| Attempted Recon | 342 | 1:2100498 (ICMP ping) |
| Trojan Activity | 12 | 1:1000001 (Reverse shell) |
| Policy Violation | 87 | 1:1000004 (FTP cleartext) |
| Web Application Attack | 23 | 1:2100654 (SQL injection) |

### Tuning Actions Taken
- Suppressed SID 2100498 for 10.10.1.100 (monitoring server legitimate ICMP)
- Thresholded SID 1000004 to 5 alerts per source per hour
- Added 3 custom rules for PHI exfiltration detection