1. Installing Snort
2. Configuring Snort to Run as a NIDS
3. Writing and Testing a Single Rule With Snort
4. Installing Barnyard2
5. Installing PulledPork
6. Creating Upstart Scripts for Snort on Ubuntu 14
7. Creating systemD Scripts for Snort on Ubuntu 16
8. Installing BASE
9. Conclusion

Configure Snort to Run as a NIDS

This is the second in a set of articles will guide you through the steps of installing and configuring Snort as a Network Intrusion Detection System (NIDS). In the previous article we installed the Snort binary and verified that it correctly executed. In this section, we will configure Snort to run as a NIDS by creating the files and folders that Snort expects when running as a NIDS, and we will learn about the Snort configuration file: snort.conf.

Basic Configuration

First off, for security reasons we want Snort to run as an unprivileged user. We create a snort user and group for this purpose:

sudo groupadd snort
sudo useradd snort -r -s /sbin/nologin -c SNORT_IDS -g snort

Next, we need to create a number of files and folders that Snort expects when running in NIDS mode.  We will then change the ownership of those files to our new snort user. Snort stores configuration files in /etc/snort, rules in /etc/snort/rules, /usr/local/lib/snort_dynamicrules, and stores its logs in /var/log/snort:

# Create the Snort directories:
sudo mkdir /etc/snort
sudo mkdir /etc/snort/rules
sudo mkdir /etc/snort/rules/iplists
sudo mkdir /etc/snort/preproc_rules
sudo mkdir /usr/local/lib/snort_dynamicrules
sudo mkdir /etc/snort/so_rules

# Create some files that stores rules and ip lists
sudo touch /etc/snort/rules/iplists/black_list.rules
sudo touch /etc/snort/rules/iplists/white_list.rules
sudo touch /etc/snort/rules/local.rules
sudo touch /etc/snort/sid-msg.map

# Create our logging directories:
sudo mkdir /var/log/snort
sudo mkdir /var/log/snort/archived_logs

# Adjust permissions:
sudo chmod -R 5775 /etc/snort
sudo chmod -R 5775 /var/log/snort
sudo chmod -R 5775 /var/log/snort/archived_logs
sudo chmod -R 5775 /etc/snort/so_rules
sudo chmod -R 5775 /usr/local/lib/snort_dynamicrules

# Change Ownership on folders:
sudo chown -R snort:snort /etc/snort
sudo chown -R snort:snort /var/log/snort
sudo chown -R snort:snort /usr/local/lib/snort_dynamicrules

We now need to move the following files from the extracted Snort tarball to the snort configuration folder:

• classification.config describes the types of attack classifications that Snort understands (grouping rules into these types of classifications), such as trojan-activity or system-call-detect. The list of classifications can be found in section 3.4.6 of the Snort Manual
• file_magic.conf describes rules for identifying file types.
• reference.config contains urls that are referenced in the rules that provide more information about alerts.
• snort.conf is the configuration file for Snort, it tells Snort where resources are located, and how to output alerts, among other things.
• threshold.conf allows you to control the number of events that are required to generate an alert, which can help suppress noisy alerts. More information here.
• attribute table.dtd lets Snort use outside information to determine protocols and policies. More information here.
• gen-msg.map tells Snort which pre-processor is used by which rule. More information here.
• unicode.map provides a mapping between Unicode languages and the identifier. This file is required by Snort in order to start.

Run the commands below to move the files listed above to the /etc/snort folder:

cd ~/snort_src/snort-2.9.9.0/etc/
sudo cp *.conf* /etc/snort
sudo cp *.map /etc/snort
sudo cp *.dtd /etc/snort

cd ~/snort_src/snort-2.9.9.0/src/dynamic-preprocessors/build/usr/local/lib/snort_dynamicpreprocessor/
sudo cp * /usr/local/lib/snort_dynamicpreprocessor/

The Snort configuration folder and file structure should now look like the following:

	user@snortserver:~$ tree /etc/snort
	/etc/snort
	├── attribute_table.dtd
	├── classification.config
	├── file_magic.conf
	├── gen-msg.map
	├── preproc_rules
	├── reference.config
	├── rules
	│.. ├── local.rules
	│.. ├── iplists
	│    .. ├── black_list.rules
	│    .. ├── white_list.rules
	├── sid-msg.map
	├── snort.conf
	├── so_rules
	├── threshold.conf
	└── unicode.map

Editing the Snort Configuration File

The Snort configuration file is stored at /etc/snort/snort.conf, and contains all the settings that Snort will use when it is run in NIDS mode. This is a large file (well over 500 lines), and contains a number of options for the configuration of Snort. We are interested in only a few settings at this time.

First, we need to comment out the lines that causes Snort to import the default set of rule files. We do this because we will be using PulledPork to manage our rulesets, which saves all the rules into a single file. The easy way to comment out all these lines is to use sed to append the “#” (hash) character to those lines.  This is accomplished by running the following command:

sudo sed -i 's/include \$RULE\_PATH/#include \$RULE\_PATH/' /etc/snort/snort.conf

The result of this command is that lines 547 to 651 in snort.conf will now be commented out, which will prevent Snort from loading those rule files on start-up. These rule files do not exist, and will cause Snort to generate an error if it tries to load a file that doesn’t exist. If you were to manually download the rule files from the snort website and extract them to the /etc/snort/rules folder, then you would want those rules to be un-commented out. We will use PulledPork (configured later) to manage all our rules and save them into a single file, which is why we need all those rule files to be commented out.

Next, we need to manually edit a few lines in the snort.conf file. Use vi (or your favorite editor) to edit /etc/snort/snort.conf:

sudo vi /etc/snort/snort.conf

First, we need to let Snort know the network range of your home network (the assets you are trying to protect) and all other external networks.  We do this by editing lines 45 and 48 of snort.conf to tell it the IP ranges of these two networks. In the example below, our home network is 10.0.0.0 with a 24 bit subnet mask (255.255.255.0), and our external networks are all other networks.

ipvar HOME_NET 10.0.0.0/24 	# (line 45) make this match your internal (friendly) network

Note: it is not recommended to set EXTERNAL_NET to !$HOME NET as recommended in some guides, since it can cause Snort to miss alerts.

Next we need to tell Snort about the locations of all the folders we created earlier.  These settings are also part of the snort.conf file.  I have included the line numbers after the hash so you can more easily find the setting (do not write the line number, just change the path to match what is below):

var RULE_PATH /etc/snort/rules						# line 104
var SO_RULE_PATH /etc/snort/so_rules				# line 105
var PREPROC_RULE_PATH /etc/snort/preproc_rules		# line 106

var WHITE_LIST_PATH /etc/snort/rules/iplists		# line 113
var BLACK_LIST_PATH /etc/snort/rules/iplists		# line 114

Finally, we want to enable one included rule file: /etc/snort/rules/local.rules.  We will use this file to store our own rules, including one rule that we will write in the next article in this series that will allow us to easily check that Snort is correctly generating alerts.  Un-comment the following line (line 545) by deleting the hash from the beginning of the line:

include $RULE_PATH/local.rules

Testing Snort with our Configuration File

Snort has the ability to validate the configuration file, and you should do this whenever you make modifications to snort.conf. Run the following command to have Snort test the configuration file:

sudo snort -T -c /etc/snort/snort.conf -i eth0

The -T tells snort to test, and -c tells snort the path to the configuration file, and you are required to specify an interface you want to listen to with -i (this is a new requirement as of 2.9.8.x version of snort). Make sure to use the correct interface. You should see some output, with the following lines at the end:

    ...
	Snort successfully validated the configuration!
	Snort exiting

Congratulations, if you have output similar to the above then you have successfully Configured Snort to run as a NIDS. Continue to the next section: Writing and Testing a Single Rule With Snort.

1. Installing Snort
2. Configuring Snort to Run as a NIDS
3. Writing and Testing a Single Rule With Snort
4. Installing Barnyard2
5. Installing PulledPork
6. Creating Upstart Scripts for Snort on Ubuntu 14
7. Creating systemD Scripts for Snort on Ubuntu 16
8. Installing BASE
9. Conclusion

Overview

This detailed set of articles will guide you through the steps of installing and configuring Snort as a Network Intrusion Detection System (NIDS), along with additional software that extends the functionality of your Snort system.  These articles are based on the Snort Installation guide I wrote, and which was posted in the documents section of the Snort website. If you are instead looking for a quick install guide for Snort on Ubuntu, please see my other standalone article: Snort 2.9.9.x on Ubuntu (quick install guide). If you want to test the new alpha version of Snort, please see my articles: Installing Snort++ (Version 3.0 Alpha 4) in Ubuntu.

These articles are designed to take you step-by-step through the installation, configuration, and testing of each component of a Snort system.  I will explain the design decisions and the purpose of specific commands throughout this guide, which will will help you understand how Snort is installed, configured, tested, executed, and how it interfaces with its supporting software.   You can follow the steps in this guide, but choose to skim the detailed explanations if you would like, and you will still end up with a working Snort system. However, if you take the effort to understand every step you will have a much deeper understanding of Snort, be better able to troubleshoot issues, and fully customize your Snort installation.

Supported Software Versions

This guide has been tested with Snort 2.9.9.0 on both the x86 and x64 architectures of Ubuntu 14, and 16. This guide will probably work on other Ubuntu-derived distributions, and I have been told that it works fairly well (with some modifications) for Debian systems including the Raspberry Pi. This guide will note VMware specific configuration options, if you want to run Snort as a virtual machine.  At the time of this writing, the latest version of Snort is 2.9.9.0, and the instructions below are tailored for that version.  If you want to use more recent versions of any of the software installed below (updated versions released after the publication of this guide), it should work without significant changes, but obviously you may encounter issues I can’t foresee.

On its own, Snort runs in standalone mode as a packet sniffer and logger.  With a few additional applications and some configuration, a Snort system becomes much more useful as a NIDS.  The supporting software components we will install in this set of articles are:

• Barnyard2 is a dedicated spooler for Snort’s unified2 binary output format. Packet processing is very resource intensive, so to reduce the load on the Snort process: we have Snort save suspicious packets to a directory in a native binary format without processing the packets. Barnyard2 then asynchronously processes those packets and saves them in a MySQL database.
• PulledPork is a Perl script that automatically downloads the latest Snort rulesets. Since the threat landscape is constantly evolving, new rulesets are required by Snort to identify the latest types of suspicious traffic (rulesets are similar to antivirus signatures).
• BASE provides a web front-end to query and analyze the alerts coming from a Snort system.

Alternatives to This Guide

If you just want a Snort system installed and running without having to compile and install all the individual components, there are some alternatives:

• Autosnort: a script that will install Snort and supporting software on your system.
• Install Snort from the Ubuntu repository: This version of Snort tends to be out of date, and doesn’t give you the flexibility provided by compiling your own version of Snort.
• Security Onion: A live CD based on Ubuntu with Snort already installed.

Recommendations for Running Snort in a Virtual Machine

If you are running Snort as a VMware ESXi virtual machine, it is recommended that you use the vmxnet 3 network adapter.

Onwards

So let’s get started. First, we need to ensure that the network card does not truncate over-sized packets.  From The Snort Manual:

Some network cards have features named “Large Receive Offload” (lro) and “Generic Receive Offload” (gro). With these features enabled, the network card performs packet reassembly before they’re processed by the kernel. By default, Snort will truncate packets larger than the default snaplen of 1518 bytes. In addition, LRO and GRO may cause issues with Stream5 target-based reassembly. We recommend that you turn off LRO and GRO.

Edit /etc/network/interfaces as an admin:

sudo vi /etc/network/interfaces

Append the following two lines for each network interface you will have Snort listen on, making sure to change eth0 to match your interface name (See note below for Ubuntu 16):

post-up ethtool -K eth0 gro off
post-up ethtool -K eth0 lro off

Important note for people running Ubuntu 16: Begining with Ubuntu 15.10, network interfaces no longer follow the ethX standard (eth0, eth1, …). Instead, interfaces names are assigned as Predictable Network Interface Names. This means you need to check the names of your interfaces using ifconfig -a. In my case, what was originally eth0 is now ens160. If you are running Ubuntu 15.10, anywhere in this guide you see eth0, you will need to replace with your new interface name.

an example of how the /etc/network/interfaces file should look for a single interface:

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
source /etc/network/interfaces.d/*
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
auto eth0
iface eth0 inet dhcp
post-up ethtool -K eth0 gro off
post-up ethtool -K eth0 lro off

Next we will create a directory to save the downloaded tarball files:

mkdir ~/snort_src
cd ~/snort_src

Next we need to install all the prerequisites from the Ubuntu repositories:

sudo apt-get install -y build-essential libpcap-dev libpcre3-dev libdumbnet-dev bison flex zlib1g-dev liblzma-dev openssl libssl-dev

Breakdown of the packages you are installing:

• build-essential: provides the build tools (GCC and the like) to compile software.
• bison, flex: parsers required by DAQ (DAQ is installed later below).
• libpcap-dev: Library for network traffic capture required by Snort.
• libpcre3-dev: Library of functions to support regular expressions required by Snort.
• libdumbnet-dev: the libdnet library provides a simplified, portable interface to several low-level networking routines. Many guides for installing Snort install this library from source, although that is not necessary.
• zlib1g-dev: A compression library required by Snort.
• liblzma-dev: Provides decompression of swf files (adobe flash)
• openssl and libssl-dev: Provides SHA and MD5 file signatures

The final library that Snort requires is the development library for Nghttp2: a HTTP/2 C Library which implements the HPAC header compression algorithm.

In Ubuntu 16 the install is easy:

# Ubuntu 16 only:
sudo apt-get install -y libnghttp2-dev

for Ubuntu 14, we need to compile from source:

# Ubuntu 14 only (not Ubuntu 16)
sudo apt-get install -y autoconf libtool pkg-config
cd ~/snort_src
wget https://github.com/nghttp2/nghttp2/releases/download/v1.17.0/nghttp2-1.17.0.tar.gz
tar -xzvf nghttp2-1.17.0.tar.gz
cd nghttp2-1.17.0
autoreconf -i --force
automake
autoconf
./configure --enable-lib-only
make
sudo make install

Snort uses the Data Acquisition library (DAQ) to abstract calls to packet capture libraries. DAQ is downloaded and installed from the Snort website:

cd ~/snort_src
wget https://snort.org/downloads/snort/daq-2.0.6.tar.gz
tar -xvzf daq-2.0.6.tar.gz
cd daq-2.0.6
./configure
make
sudo make install

Now we are ready to install Snort from source. When we configure the build of Snort, we use the --enable-sourcefire flag, which enables Packet Performance Monitoring (PPM), and matches the way the sourcefire team builds Snort.

cd ~/snort_src
wget https://snort.org/downloads/snort/snort-2.9.9.0.tar.gz
tar -xvzf snort-2.9.9.0.tar.gz
cd snort-2.9.9.0
./configure --enable-sourcefire
make
sudo make install

Run the following command to update shared libraries:

sudo ldconfig

Since the Snort installation places the Snort binary at /usr/local/bin/snort, it is a good policy to create a symlink to /usr/sbin/snort:

sudo ln -s /usr/local/bin/snort /usr/sbin/snort

The last step of our Snort installation is to test that the Snort Binary runs. Execute Snort with the -V flag, which causes Snort to show the version number:

/usr/sbin/snort -V

and you should see output similar to the following:

user@snortserver:~$ snort -V

      Version 2.9.9.0 GRE (Build 56)
      By Martin Roesch & The Snort Team: http://www.snort.org/contact#team
      Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
      Copyright (C) 1998-2013 Sourcefire, Inc., et al.
      Using libpcap version 1.7.4
      Using PCRE version: 8.38 2015-11-23
      Using ZLIB version: 1.2.8

Congratulations, if you have output similar to the above then you have successful installed Snort. Continue to the next section to Configure Snort to Run as a NIDS.

The instructions below show how to install Snort 2.9.9.x on both the x86 and x64 architectures for Ubuntu 14 and 16. If you want a more in-depth explanation of the install steps, as well as instructions on how to configure and enhance Snort’s functionality, see my in-depth series for installing Snort on Ubuntu.

If you want to test the new alpha version of Snort (Version 3.0 Alpha 4), please see my article: Installing Snort 3 Alpha in Ubuntu

If you want to work with OpenAppID, please see my guide for OpenAppID for Snort 2.9.9.x on Ubuntu.

Let Us Begin:

So let’s get started. First we will create a directory to save the downloaded tarball files:

mkdir ~/snort_src
cd ~/snort_src

Next we need to install all the pre-requisites from the Ubuntu repositories:

sudo apt-get install -y build-essential libpcap-dev libpcre3-dev libdumbnet-dev bison flex zlib1g-dev liblzma-dev openssl libssl-dev

We need the development libraries for Nghttp2. On Ubuntu 16 this is simple:

# Ubuntu 16 only (not Ubuntu 14)
sudo apt-get install -y libnghttp2-dev

On Ubuntu 14, we do this from scratch:

# Ubuntu 14 only (not Ubuntu 16)
sudo apt-get install -y autoconf libtool pkg-config
cd ~/snort_src
wget https://github.com/nghttp2/nghttp2/releases/download/v1.17.0/nghttp2-1.17.0.tar.gz
tar -xzvf nghttp2-1.17.0.tar.gz
cd nghttp2-1.17.0
autoreconf -i --force
automake
autoconf
./configure --enable-lib-only
make
sudo make install

Disable LRO and GRO for all interfaces Snort will listen on under /etc/network/interfaces. using ethtool. An explanation of LRO and GRO are in the The Snort Manual. Use an editor to edit the network interfaces file:

sudo vi /etc/network/interfaces

and for every interface that Snort will listen on (one interface for simple setups, multiple interfaces for more complex setups), add the following two lines, changing eth0 to match the interface:

post-up ethtool -K eth0 gro off
post-up ethtool -K eth0 lro off

for example, my /etc/network/interfaces file looks like this:

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet dhcp
post-up ethtool -K eth0 gro off
post-up ethtool -K eth0 lro off

Reboot the system and verify that LRO and GRO are off:

user@snortserver:~$ ethtool -k eth0 | grep receive-offload
generic-receive-offload: off
large-receive-offload: off

Download and install Data Acquisition library (DAQ) from the Snort website:

cd ~/snort_src
wget https://www.snort.org/downloads/snort/daq-2.0.6.tar.gz
tar -xvzf daq-2.0.6.tar.gz
cd daq-2.0.6
./configure
make
sudo make install

Now we are ready to install Snort from source:

cd ~/snort_src
wget https://snort.org/downloads/snort/snort-2.9.9.0.tar.gz
tar -xvzf snort-2.9.9.0.tar.gz
cd snort-2.9.9.0
./configure --enable-sourcefire
make
sudo make install

Run the following command to update shared libraries:

sudo ldconfig

Since the Snort installation places the Snort binary at /usr/local/bin/snort, it is common to create a symlink to /usr/sbin/snort:

sudo ln -s /usr/local/bin/snort /usr/sbin/snort

The last step of our Snort installation is to test that the Snort Binary runs. Execute Snort with the -V flag, which causes Snort to print the current version. You should see output similar to the following:

user@snortserver:~$ snort -V

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.9.9.0 GRE (Build 56) 
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/contact#team
           Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using libpcap version 1.7.4
           Using PCRE version: 8.38 2015-11-23
           Using ZLIB version: 1.2.8

user@snortserver:~$

If you have output similar to the above, then Snort is installed and works. If you want to learn more about how to run Snort, and how to install additional software to enhance a Snort system, see my in-depth series for installing Snort on Ubuntu.

If you have any questions or recommendations, please contact me. I can’t always answer questions right away, but I will do my best to get back to you. I welcome all recommendations and corrections.

NOTE: this article is out of date and has been replaced with a newer article: Installing Snort++ (Snort 3 Alpha 4 build 239) in Ubuntu.

The instructions below show how to install Snort 3 alpha 4 build 223 on Ubuntu. This install has been tested on Ubuntu 14 and 16, for both the x86 and x64 architectures. For an outdated Ubuntu 12 version of these instructions, please go here. Note that Snort 3 is Alpha software, and therefore has bugs and issues, and should be installed for testing purposes only (not on production systems).

Snort 3 Alpha 4 Build 233 was released on December 22, 2016, and this guide has been tested with that version (releases after this specific release may not follow the same steps). Generic build instructions, prerequisites, and detailed notes are available in the manual.

If you want a more in-depth explanation of the install steps, which are very similar to the 2.9.9.x version of Snort, as well as instructions on how to configure and enhance Snort’s functionality, see my series on installing Snort 2.9.9.x on Ubuntu.

So let’s get started. First we need to install all the Snort pre-requisites from the Ubuntu repositories:

sudo apt-get install -y build-essential autotools-dev libdumbnet-dev libluajit-5.1-dev libpcap-dev libpcre3-dev zlib1g-dev pkg-config libhwloc-dev cmake

Install the optional (recommended) software:

sudo apt-get install -y liblzma-dev openssl libssl-dev cpputest cmake

Install tools required for compiling the source from github:

sudo apt-get install -y libtool git autoconf

Install the DAQ pre-requisites:

sudo apt-get install -y bison flex

If you want to build the documentation as well (not really needed, unless you want it, usually about 700 MB of libraries):

sudo apt-get install -y asciidoc dblatex source-highlight

Next we will create a directory to save the downloaded tarball files:

mkdir ~/snort_src
cd ~/snort_src

First and install safec for runtime bounds checks on certain legacy C-library calls (this is optional but recommended):

cd ~/snort_src
wget http://downloads.sourceforge.net/project/safeclib/libsafec-10052013.tar.gz
tar -xzvf libsafec-10052013.tar.gz
cd libsafec-10052013
./configure
make
sudo make install

One of the Snort recommended prerequisites is Hyperscan 4.2.0. From their webpage: “Hyperscan is a regular expression engine designed to offer high performance, the ability to match multiple expressions simultaneously and flexibility in scanning operation.” Hyperscan needs Ragel 6.9 and the Boost header libraries.

Install Ragel 6.9 from source:

cd ~/snort_src
wget http://www.colm.net/files/ragel/ragel-6.9.tar.gz
tar -xzvf ragel-6.9.tar.gz
cd ragel-6.9
./configure
make
sudo make install

Download the Boost 1.63 libraries, but do not install:

cd ~/snort_src
wget http://downloads.sourceforge.net/project/boost/boost/1.63.0/boost_1_63_0.tar.gz
tar -xvzf boost_1_63_0.tar.gz

Install Hyperscan 4.2.0 from source, referencing the location of the Boost source directory:

cd ~/snort_src
wget https://github.com/01org/hyperscan/archive/v4.2.0.tar.gz
tar -xvzf v4.2.0.tar.gz
mkdir ~/snort_src/hyperscan-4.2.0-build
cd hyperscan-4.2.0-build/

cmake -DCMAKE_INSTALL_PREFIX=/usr/local -DBOOST_ROOT=~/snort_src/boost_1_63_0/ ../hyperscan-4.2.0

make
sudo make install

If you want to test that Hyperscan works, from the build directory, run:

cd ~/snort_src/hyperscan-4.2.0-build/
./bin/unit-hyperscan

The unit tests will run (this takes a few minutes).

Download and install Data AcQuisition library (DAQ) from the Snort website (note that DAQ for Snort 3 is a different DAQ than for the 2.9.9.x series of Snort):

cd ~/snort_src
wget https://www.snort.org/downloads/snortplus/daq-2.2.1.tar.gz
tar -xvzf daq-2.2.1.tar.gz
cd daq-2.2.1
./configure
make
sudo make install

Run the following command to update shared libraries:

sudo ldconfig

Now we are ready to install Snort from source. This command downloads and installs the latest version of Snort 3 (currently 3.0.0 Alpha 4, build 223). If you want to install all the snort directories under a single directory, see the section at the bottom of this document titled Changing the install location of Snort. Here we choose to install the entire Snort directory structure to a single folder under /opt/:

cd ~/snort_src
wget https://github.com/snortadmin/snort3/archive/master.tar.gz
tar -xvzf master.tar.gz
cd snort3-master/
autoreconf -isvf

./configure --prefix=/opt/snort
make
sudo make install

Since the Snort installation places the Snort binary at /opt/snort/bin/snort, it is common to create a symlink to /usr/sbin/snort:

sudo ln -s /opt/snort/bin/snort /usr/sbin/snort

Snort 3 requires a few environmental variables, we store them temporarily in the current session so we can continue working, and save them permanently to the ~/.bashrc file (you’ll need to do this for every user profile):

export LUA_PATH=/opt/snort/include/snort/lua/\?.lua\;\;
export SNORT_LUA_PATH=/opt/snort/etc/snort
 
sh -c "echo 'export LUA_PATH=/opt/snort/include/snort/lua/\?.lua\;\;' >> ~/.bashrc"
sh -c "echo 'export SNORT_LUA_PATH=/opt/snort/etc/snort' >> ~/.bashrc"

to ensure that these two environmental variables are available when using sudo, we need to add them to the /etc/sudoers file:

sudo visudo

in the editor, add the following to to the bottom of the file:

Defaults env_keep += "LUA_PATH SNORT_LUA_PATH"

use ctrl-x to exit, save when prompted by pressing y, then press enter to save the file to /etc/sudoers.tmp (which will get copied automatically to /etc/sudoers).

The last step of our Snort installation is to test that the Snort Binary runs. Execute Snort with the -V flag, which causes Snort to print the current version. You should see output similar to the following:

user@snort3:~$ snort -V

   ,,_     -*> Snort++ <*-
  o"  )~   Version 3.0.0-a4 (Build 223) from 2.9.8-383
   ''''    By Martin Roesch & The Snort Team
           http://snort.org/contact#team
           Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using DAQ version 2.2.1
           Using libpcap version 1.5.3
           Using LuaJIT version 2.0.2
           Using PCRE version 8.31 2012-07-06
           Using ZLIB version 1.2.8
           Using LZMA version 5.1.0alpha
           Using OpenSSL 1.0.1f 6 Jan 2014
           Using Hyperscan version 4.2.0 2017-01-07

user@snort3:~$

Now let’s test snort with the default configuration file and ruleset:

user@snort3:~$ /opt/snort/bin/snort -c /opt/snort/etc/snort/snort.lua -R /opt/snort/etc/snort/sample.rules
--------------------------------------------------
o")~   Snort++ 3.0.0-a4-223
--------------------------------------------------
Loading /opt/snort/etc/snort/snort.lua:
	ssh
	rpc_decode
	pop
	stream_user
	stream_tcp
	smtp
	ssl
	gtp_inspect
	stream_ip
	appid
	stream_icmp
	reputation
	stream_udp
	file_id
	back_orifice
	classifications
	port_scan
	dnp3
	ftp_data
	ftp_server
	telnet
	ftp_client
	http_inspect
	stream
	references
	arp_spoof
	sip
	wizard
	dns
	imap
	stream_file
Finished /opt/snort/etc/snort/snort.lua.
Loading rules:
Loading /opt/snort/etc/snort/sample.rules:
Finished /opt/snort/etc/snort/sample.rules.
Finished rules.
--------------------------------------------------
rule counts
       total rules loaded: 3974
               text rules: 3974
            option chains: 3974
            chain headers: 187
--------------------------------------------------
port rule counts
             tcp     udp    icmp      ip
     any     119      31      29      26
     src    1685       4       0       0
     dst    1927     232       0       0
    both       0       1       0       0
   total    3731     268      29      26
--------------------------------------------------
flowbits
                  defined: 124
              not checked: 9
                  not set: 2
--------------------------------------------------
service rule counts - tcp    to-srv  to-cli
                   dcerpc:        3       0
                     drda:        3       0
                      ftp:        8       2
                     http:     1161    1553
                    ident:        1       0
                     imap:       29    1044
                     ircd:        1       1
                     ldap:        5       0
                    mysql:       29       1
               netbios-ns:        4       0
              netbios-ssn:       25       7
                     pop3:       12    1043
                     rtsp:        2       0
                     smtp:      550       3
                      ssl:        5       1
                   sunrpc:        9       0
                   telnet:        5       1
               vnc-server:        1       3
                    total:     1853    3659
--------------------------------------------------
service rule counts - udp    to-srv  to-cli
                   dcerpc:        2       0
                      dns:      170       2
                 kerberos:        4       4
              netbios-dgm:        7       7
               netbios-ns:        1       1
              netbios-ssn:        1       1
                      ntp:        1       0
                     snmp:        1       1
                     ssdp:        8       0
                   sunrpc:        7       3
                     tftp:        1       0
                    total:      203      19
--------------------------------------------------
fast pattern port groups        src     dst     any
                   packet:       27     125       4
                      key:       23     107       1
                   header:       23     107       1
                     body:        0       2       0
                     file:       23     107       1
--------------------------------------------------
fast pattern service groups  to-srv  to-cli
                   packet:       29      17
                      key:        3       0
                   header:        1       3
                     body:        1       0
                     file:        1       4
--------------------------------------------------
search engine
                instances: 566
                 patterns: 24676
            pattern chars: 515657
               num states: 409159
         num match states: 23816
             memory scale: MB
             total memory: 8.27426
           pattern memory: 1.05602
        match list memory: 1.96014
        transition memory: 5.20412
--------------------------------------------------
pcap DAQ configured to passive.

Snort successfully validated the configuration.
o")~   Snort exiting
user@snort3:~$ 

If you have output similar to the above, then Snort 3.0.0 Alpha 4 is installed and works.

A note on install locations:

When you install snort to /opt/snort, you get the following folder structure:

user@snort3x86:/opt/snort$ tree /opt/snort -L 3
/opt/snort
├── bin
│   ├── snort
│   ├── snort2lua
│   ├── u2boat
│   └── u2spewfoo
├── etc
│   └── snort
│       ├── file_magic.lua
│       ├── sample.rules
│       ├── snort_defaults.lua
│       └── snort.lua
├── include
│   └── snort
│       ├── actions
│       ├── codecs
│       ├── daqs
│       ├── decompress
│       ├── detection
│       ├── events
│       ├── file_api
│       ├── filters
│       ├── flow
│       ├── framework
│       ├── hash
│       ├── latency
│       ├── log
│       ├── lua
│       ├── main
│       ├── managers
│       ├── mime
│       ├── profiler
│       ├── protocols
│       ├── search_engines
│       ├── sfip
│       ├── sfrt
│       ├── stream
│       ├── time
│       └── utils
├── lib
│   ├── pkgconfig
│   │   └── snort.pc
│   └── snort
│       └── daqs
└── share
    └── doc
        └── snort

37 directories, 9 files

The /opt/snort/bin folder contains the following Snort binaries:

• snort : The Snort binary.
• snort2lua : Tool to convert a Snort 2.9.8.x configuration file into a 3.x configuration file. More notes here.
• u2boat : U2boat is a tool for converting unified2 files into different formats.
• u2spewfoo: U2SpewFoo is a lightweight tool for dumping the contents of unified2 files to stdout.

Additionally, the following folders are created / used:

• /opt/snort/bin : Binaries for Snort and supporting software.
• /opt/snort/etc/snort : The configuration files for Snort.
• /opt/snort/include/snort : All include files for Snort.
• /opt/snort/lib/pkgconfig : The pkgconfig file for Snort (compilation details for Snort).
• /opt/snort/share/doc/snort : The documentation for the installed version of Snort.

Changing the install location of Snort

If you would rather have all these folders install to a more normal location (/usr/local) , add ‑‑prefix=/usr/local/ to the ./configure command when preparing to build Snort. This will install all these folders under the path you choose. You also need to modify some of the other paths detailed above, so if you decide to install in that manner, you should follow the install instructions detailed in the Snort blog.

Where to go from here

If you want to learn more about how to run the 2.9.9.x version of Snort, and how to install additional software to enhance a Snort system, see my series on installing Snort on Ubuntu. If you want to work with protocol (layer 7) detection, please see my article on OpenAppID.

I would love to get feedback from you about this guide. Recommendations, issues, or ideas, please contact me here.