菜单
Installs, configures, and tunes Snort 3 intrusion detection system to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins on authorized network segments.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/Undermybelt/hermes-skills --skill snort-ids-intrsn-dtctn命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Use when retiring old logic, collapsing duplicate owners, removing fallbacks, or touching schema, persistence, or source-of-truth boundaries while deciding whether to delete old paths, retain compatibility, or stop for confirmation.
Use when defining new features, product behavior, UI/component design, architecture choices, contract changes, or ambiguous medium/high-complexity work before implementation.
Use when the user asks for caveman mode, fewer tokens, brief responses, compressed communication, or otherwise explicitly requests a much shorter answer.
基于 SOC 职业分类
正在显示 SKILL.md
| name | snort-ids-intrsn-dtctn |
| description | Installs, configures, and tunes Snort 3 intrusion detection system to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins on authorized network segments. |
| domain | cybersecurity |
| subdomain | network-security |
| tags | ["network-security","snort","ids","intrusion-detection","rule-writing"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"] |
Do not use as a replacement for endpoint detection, for monitoring encrypted traffic without TLS inspection, or as the sole security control without complementary defenses.
snort --version to verify)# Install dependencies (Ubuntu/Debian)
sudo apt install -y build-essential libpcap-dev libpcre3-dev libnet1-dev \
zlib1g-dev luajit hwloc libdumbnet-dev bison flex libcmocka-dev \
libnetfilter-queue-dev libmnl-dev autotools-dev libluajit-5.1-dev \
pkg-config cmake libhwloc-dev liblzma-dev openssl libssl-dev cpputest \
libsqlite3-dev uuid-dev
# Install DAQ from source
git clone https://github.com/snort3/libdaq.git
cd libdaq && ./bootstrap && ./configure && make && sudo make install
# Install Snort 3
git clone https://github.com/snort3/snort3.git
cd snort3 && ./configure_cmake.sh --prefix=/usr/local
cd build && make -j$(nproc) && sudo make install
sudo ldconfig
# Verify installation
snort -V
# Disable offloading features that interfere with packet inspection
sudo ethtool -K eth1 gro off lro off tso off gso off rx off tx off
# Enable promiscuous mode
sudo ip link set eth1 promisc on
# Create systemd service for persistent interface configuration
sudo tee /etc/systemd/system/snort-iface.service << 'EOF'
[Unit]
Description=Configure Snort capture interface
Before=snort.service
[Service]
Type=oneshot
ExecStart=/sbin/ethtool -K eth1 gro off lro off tso off gso off rx off tx off
ExecStart=/sbin/ip link set eth1 promisc on
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
EOF
sudo systemctl enable snort-iface.service
# Create Snort directory structure
sudo mkdir -p /usr/local/etc/snort/{rules,builtin_rules,lists,appid}
sudo mkdir -p /var/log/snort
# Edit the main Snort configuration
sudo tee /usr/local/etc/snort/snort.lua << 'LUAEOF'
-- Snort 3 Configuration
-- Network variables
HOME_NET = '10.10.0.0/16'
EXTERNAL_NET = '!$HOME_NET'
-- Path variables
RULE_PATH = '/usr/local/etc/snort/rules'
BUILTIN_RULE_PATH = '/usr/local/etc/snort/builtin_rules'
-- Configure DAQ
daq = {
module_dirs = { '/usr/local/lib/daq' },
modules = { { name = 'afpacket', variables = { 'buffer_size_mb=256' } } }
}
-- Decoder configuration
normalizer = { tcp = { ips = true } }
-- Stream inspection
stream = { }
stream_tcp = { policy = 'linux', session_timeout = 180 }
stream_udp = { session_timeout = 30 }
stream_icmp = { }
-- HTTP inspection
http_inspect = { }
-- DNS inspection
dns = { }
-- SSL/TLS inspection
ssl = { }
-- SMB inspection
dce_smb = { }
-- File identification and processing
file_id = { rules_file = '/usr/local/etc/snort/file_magic.rules' }
-- Port scan detection
port_scan = {
protos = 'all',
scan_types = 'all',
memcap = 10000000
}
-- Reputation-based filtering
-- reputation = {
-- blacklist = RULE_PATH .. '/blocklist.rules'
-- }
-- IPS rules
ips = {
enable_builtin_rules = true,
include = RULE_PATH .. '/snort3-community.rules',
variables = {
nets = { HOME_NET = HOME_NET, EXTERNAL_NET = EXTERNAL_NET },
ports = {
HTTP_PORTS = '80 8080 8443',
SSH_PORTS = '22',
DNS_PORTS = '53'
}
}
}
-- Alert output
alert_fast = {
file = true,
packet = false,
limit = 100
}
-- Unified2 output for Barnyard2/SIEM integration
-- alert_unified2 = { limit = 128 }
-- JSON alert output
alert_json = {
file = true,
limit = 100,
fields = 'timestamp pkt_num proto pkt_gen pkt_len dir src_addr src_port dst_addr dst_port service rule action'
}
-- Syslog output
-- alert_syslog = { level = 'info', facility = 'local1' }
LUAEOF
# Download Snort 3 Community Rules
wget https://www.snort.org/downloads/community/snort3-community-rules.tar.gz
tar xzf snort3-community-rules.tar.gz
sudo cp snort3-community-rules/snort3-community.rules /usr/local/etc/snort/rules/
# Install PulledPork 3 for automated rule management
git clone https://github.com/shirkdog/pulledpork3.git
cd pulledpork3
sudo python3 setup.py install
# Configure PulledPork
sudo tee /usr/local/etc/pulledpork3/pulledpork.conf << 'EOF'
registered_ruleset = true
oinkcode = <YOUR_OINK_CODE>
snort_path = /usr/local/bin/snort
local_rules = /usr/local/etc/snort/rules/local.rules
sorule_path = /usr/local/etc/snort/so_rules/
snort_version = 3.0.0.0
blocklist_path = /usr/local/etc/snort/lists/
pid_path = /var/run/snort.pid
ips_policy = balanced
EOF
# Run PulledPork to fetch and process rules
sudo pulledpork3 -c /usr/local/etc/pulledpork3/pulledpork.conf
# Create local rules file
sudo tee /usr/local/etc/snort/rules/local.rules << 'EOF'
# Detect reverse shell on common ports
alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (
msg:"LOCAL Possible Reverse Shell on port 4444";
flow:established,to_server;
content:"/bin/sh"; nocase;
sid:1000001; rev:1;
classtype:trojan-activity;
priority:1;
)
# Detect Mimikatz execution indicators over SMB
alert tcp any any -> $HOME_NET 445 (
msg:"LOCAL Mimikatz Lateral Movement via SMB";
flow:established,to_server;
content:"|FF|SMB";
content:"mimikatz"; nocase; distance:0;
sid:1000002; rev:1;
classtype:trojan-activity;
priority:1;
)
# Detect DNS tunneling (high-entropy long subdomain queries)
alert udp $HOME_NET any -> any 53 (
msg:"LOCAL Possible DNS Tunneling - Long Query Name";
content:"|01 00|"; offset:2; depth:2;
byte_test:1,>,50,12;
sid:1000003; rev:1;
classtype:policy-violation;
priority:2;
)
# Detect cleartext password transmission via FTP
alert tcp $HOME_NET any -> any 21 (
msg:"LOCAL FTP Cleartext Password Detected";
flow:established,to_server;
content:"PASS "; depth:5;
sid:1000004; rev:1;
classtype:policy-violation;
priority:2;
)
# Detect potential port scan (SYN flood pattern)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (
msg:"LOCAL Possible Port Scan SYN Flood";
flow:stateless;
flags:S,12;
threshold:type both, track by_src, count 100, seconds 10;
sid:1000005; rev:1;
classtype:attempted-recon;
priority:2;
)
EOF
# Validate configuration
snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq -T
# Run Snort in IDS mode on the capture interface
sudo snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq \
-i eth1 -l /var/log/snort -D
# Test rules against a PCAP file
snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq \
-r test_traffic.pcap -l /var/log/snort/test/ -A fast
# Create systemd service for production deployment
sudo tee /etc/systemd/system/snort.service << 'EOF'
[Unit]
Description=Snort 3 IDS
After=network.target snort-iface.service
[Service]
Type=simple
ExecStart=/usr/local/bin/snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq -i eth1 -l /var/log/snort -D
ExecReload=/bin/kill -SIGHUP $MAINPID
Restart=on-failure
[Install]
WantedBy=multi-user.target
EOF
sudo systemctl enable --now snort.service
# View real-time alerts
tail -f /var/log/snort/alert_fast.txt
# Parse JSON alerts for analysis
cat /var/log/snort/alert_json.txt | python3 -m json.tool
# Identify top triggered rules for tuning
grep -oP 'sid:\d+' /var/log/snort/alert_fast.txt | sort | uniq -c | sort -rn | head -20
# Suppress noisy false-positive rules
sudo tee -a /usr/local/etc/snort/rules/suppress.rules << 'EOF'
suppress gen_id 1, sig_id 2100498, track by_src, ip 10.10.1.100
suppress gen_id 1, sig_id 2100366, track by_dst, ip 10.10.5.0/24
EOF
# Verify rule count and performance
snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq -T 2>&1 | grep -i "rules loaded"
| Term | Definition |
|---|---|
| IDS vs IPS | IDS passively monitors traffic and generates alerts; IPS sits inline and can actively block or drop malicious packets in real time |
| Snort Rule | Detection signature with header (action, protocol, src/dst, ports) and options (content matches, flow direction, metadata) that triggers on matching traffic |
| Preprocessor | Snort component that normalizes and reassembles protocol-specific traffic before rule inspection, handling fragmentation, stream reassembly, and protocol anomalies |
| DAQ (Data Acquisition) | Abstraction layer in Snort 3 that interfaces with packet capture mechanisms (AF_PACKET, PCAP, NFQ) for receiving network data |
| Oink Code | Personal registration code from snort.org required to download Snort Subscriber or Registered rulesets |
| Threshold/Suppression | Tuning mechanisms that control alert frequency (threshold) or completely silence alerts from specific sources/destinations (suppress) |
Context: A healthcare organization needs to deploy network IDS to meet HIPAA technical safeguard requirements. The IDS must monitor traffic between the DMZ and internal network, detect common attack patterns, and forward alerts to the existing Splunk SIEM. The network carries approximately 500 Mbps of traffic during peak hours.
Approach:
Pitfalls:
## Snort IDS Deployment Report
**Sensor**: snort-sensor-01 (10.10.1.250)
**Interface**: eth1 (span port from Core-SW1 gi0/24)
**Configuration**: /usr/local/etc/snort/snort.lua
**Ruleset**: Snort Community 3.0 + Local Rules (1,247 active rules)
**HOME_NET**: 10.10.0.0/16
### Detection Summary (24-hour baseline)
| Category | Alert Count | Top Rule SID |
|----------|-------------|--------------|
| Attempted Recon | 342 | 1:2100498 (ICMP ping) |
| Trojan Activity | 12 | 1:1000001 (Reverse shell) |
| Policy Violation | 87 | 1:1000004 (FTP cleartext) |
| Web Application Attack | 23 | 1:2100654 (SQL injection) |
### Tuning Actions Taken
- Suppressed SID 2100498 for 10.10.1.100 (monitoring server legitimate ICMP)
- Thresholded SID 1000004 to 5 alerts per source per hour
- Added 3 custom rules for PHI exfiltration detection