/configuring-snort-ids-for-intrusion-detection

name: configuring-snort-ids-for-intrusion-detection
description: 'Installs, configures, and tunes Snort 3 to monitor network traffic
  for malicious activity using custom and community rulesets, preprocessors, and
  alert output plugins. Use when deploying network-based intrusion detection at
  key boundaries, writing custom Snort rules, tuning rulesets to reduce false positives,
  or integrating Snort alerts with a SIEM.

  '
domain: cybersecurity
subdomain: network-security
tags:
- network-security
- snort
- ids
- intrusion-detection
- rule-writing
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.IR-01
- DE.CM-01
- ID.AM-03
- PR.DS-02
mitre_attack:
- T1046
- T1071.001
- T1572
- T1210
- T1048

Configuring Snort IDS for Intrusion Detection

When to Use

• Deploying a network-based intrusion detection system to monitor traffic at key network boundaries
• Writing custom Snort rules to detect organization-specific threats, attack patterns, or policy violations
• Tuning existing rulesets to reduce false positives while maintaining detection coverage
• Integrating Snort alerts with SIEM platforms for centralized security monitoring
• Validating network security controls by generating test traffic and confirming detection

**Do not use** as a replacement for endpoint detection, for monitoring encrypted traffic without TLS inspection, or as the sole security control without complementary defenses.

Prerequisites

• Snort 3.x installed from source or package manager (`snort --version` to verify)
• Network interface configured for promiscuous mode on a span port or network tap
• DAQ (Data Acquisition Library) installed for packet capture integration
• Registered Snort account for downloading Snort Subscriber (paid) or Community rulesets from snort.org
• PulledPork 3 or similar rule management tool for automated ruleset updates
• Sufficient CPU and memory for inline traffic inspection at line rate

Workflow

Step 1: Install and Verify Snort 3

# Install dependencies (Ubuntu/Debian)
sudo apt install -y build-essential libpcap-dev libpcre3-dev libnet1-dev \
  zlib1g-dev luajit hwloc libdumbnet-dev bison flex libcmocka-dev \
  libnetfilter-queue-dev libmnl-dev autotools-dev libluajit-5.1-dev \
  pkg-config cmake libhwloc-dev liblzma-dev openssl libssl-dev cpputest \
  libsqlite3-dev uuid-dev

# Install DAQ from source
git clone https://github.com/snort3/libdaq.git
cd libdaq && ./bootstrap && ./configure && make && sudo make install

# Install Snort 3
git clone https://github.com/snort3/snort3.git
cd snort3 && ./configure_cmake.sh --prefix=/usr/local
cd build && make -j$(nproc) && sudo make install
sudo ldconfig

# Verify installation
snort -V

Step 2: Configure Network Interfaces

# Disable offloading features that interfere with packet inspection
sudo ethtool -K eth1 gro off lro off tso off gso off rx off tx off

# Enable promiscuous mode
sudo ip link set eth1 promisc on

# Create systemd service for persistent interface configuration
sudo tee /etc/systemd/system/snort-iface.service << 'EOF'
[Unit]
Description=Configure Snort capture interface
Before=snort.service

[Service]
Type=oneshot
ExecStart=/sbin/ethtool -K eth1 gro off lro off tso off gso off rx off tx off
ExecStart=/sbin/ip link set eth1 promisc on
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable snort-iface.service

Step 3: Configure Snort 3 with Lua Configuration

# Create Snort directory structure
sudo mkdir -p /usr/local/etc/snort/{rules,builtin_rules,lists,appid}
sudo mkdir -p /var/log/snort

# Edit the main Snort configuration
sudo tee /usr/local/etc/snort/snort.lua << 'LUAEOF'
-- Snort 3 Configuration

-- Network variables
HOME_NET = '10.10.0.0/16'
EXTERNAL_NET = '!$HOME_NET'

-- Path variables
RULE_PATH = '/usr/local/etc/snort/rules'
BUILTIN_RULE_PATH = '/usr/local/etc/snort/builtin_rules'

-- Configure DAQ
daq = {
    module_dirs = { '/usr/local/lib/daq' },
    modules = { { name = 'afpacket', variables = { 'buffer_size_mb=256' } } }
}

-- Decoder configuration
normalizer = { tcp = { ips = true } }

-- Stream inspection
stream = { }
stream_tcp = { policy = 'linux', session_timeout = 180 }
stream_udp = { session_timeout = 30 }
stream_icmp = { }

-- HTTP inspection
http_inspect = { }

-- DNS inspection
dns = { }

-- SSL/TLS inspection
ssl = { }

-- SMB inspection
dce_smb = { }

-- File identification and processing
file_id = { rules_file = '/usr/local/etc/snort/file_magic.rules' }

-- Port scan detection
port_scan = {
    protos = 'all',
    scan_types = 'all',
    memcap = 10000000
}

-- Reputation-based filtering
-- reputation = {
--     blacklist = RULE_PATH .. '/blocklist.rules'
-- }

-- IPS rules
ips = {
    enable_builtin_rules = true,
    include = RULE_PATH .. '/snort3-community.rules',
    variables = {
        nets = { HOME_NET = HOME_NET, EXTERNAL_NET = EXTERNAL_NET },
        ports = {
            HTTP_PORTS = '80 8080 8443',
            SSH_PORTS = '22',
            DNS_PORTS = '53'
        }
    }
}

-- Alert output
alert_fast = {
    file = true,
    packet = false,
    limit = 100
}

-- Unified2 output for Barnyard2/SIEM integration
-- alert_unified2 = { limit = 128 }

-- JSON alert output
alert_json = {
    file = true,
    limit = 100,
    fields = 'timestamp pkt_num proto pkt_gen pkt_len dir src_addr src_port dst_addr dst_port service rule action'
}

-- Syslog output
-- alert_syslog = { level = 'info', facility = 'local1' }

LUAEOF

Step 4: Download and Configure Rulesets

# Download Snort 3 Community Rules
wget https://www.snort.org/downloads/community/snort3-community-rules.tar.gz
tar xzf snort3-community-rules.tar.gz
sudo cp snort3-community-rules/snort3-community.rules /usr/local/etc/snort/rules/

# Install PulledPork 3 for automated rule management
git clone https://github.com/shirkdog/pulledpork3.git
cd pulledpork3
sudo python3 setup.py install

# Configure PulledPork
sudo tee /us