業務用エアコン関連の技術情報、エラーコード、環境問題対策に関する別サイト「エアコンの安全な修理･適切なフロン回収」

AlmaLinux9.7 : SNORT3

2026.01.02

SNORT3

 Snort is an open source network intrusion detection system capable of performing real-time traffic analysis and packet logging on IP networks。

It can perform “protocol analysis,” “content search,” and “matching,” and can be used to detect various attacks such as “buffer overflows,” “stealth port scans,” “CGI attacks,” “SMB probes,” “OS fingerprinting attempts,” “semantic URL attacks,” and “server message block probes. The system can be used to detect a variety of attacks, such as

1.advance preparation

1.1 advance preparation

1.Installing openssl-devel

2.Installing cmake

1.2 Install required packages
1.3 Installing LibDAQ
1.4 Installing Optional Packages

1.Installation of LZMA and UUID

2.Installing Hyperscan

3.Installing Tcmalloc

2. Installing Snort3

Running configure

Install missing packages

Build, compile, and install

Version Check

test run

Network interface settings

Check network interface

The network interface name is ens160

Set the network interface to promiscuous mode. This way, the network device can capture and inspect all network packets.

Check settings

Check the offload status of the network interface.
If you need to monitor network traffic on an interface, you must disable offloading

Since it is enabled, disable GRO and LRO using the following command:

Re-evaluate the situation

Create systemd service for snort network interface

[snort3-nic.service] contents
[Unit]
Description=Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/sbin/ip link set dev ens160 promisc on
ExecStart=/usr/sbin/ethtool -K ens160 gro off lro off
TimeoutStartSec=0
RemainAfterExit=yes

[Install]
WantedBy=default.target

systemd daemon applies changes

Check Snort NIC Service Status

Added Snort Community Ruleset

1.Create a folder for Snort rules, download the community ruleset from the Snort website, and place it in the designated rules directory

2.Edit Snort main configuration file

[snort.lua] Edited Content

●Line 24 : Change
HOME_NET = '192.168.11.0/24'
●Line 28 : Change
EXTERNAL_NET = '!$HOME_NET'
●Per Line 185 : Add at the end of the ips entry
ips =
{
-- use this to enable decoder and inspector alerts
-- enable_builtin_rules = true,

-- use include for rules files; be sure to set your path
-- note that rules files can include other rules files
-- (see also related path vars at the top of snort_defaults.lua)

variables = default_variables,
rules = [[
include /usr/local/snort/etc/snort/rules/snort3-community-rules/snort3-community.rules
]]

}

3.Test Snort's main configuration changes

Add custom rule

1.Create a file in the Snort rules directory

2.Edit Snort main configuration file
Edit Snort main configuration file to include custom rules file directory in main configuration

[snort.lua] Edited Content

●Per Line 196 : Add
ips =
{
-- use this to enable decoder and inspector alerts
--enable_builtin_rules = true,

-- use include for rules files; be sure to set your path
-- note that rules files can include other rules files
-- (see also related path vars at the top of snort_defaults.lua)

variables = default_variables,
rules = [[
include /usr/local/snort/etc/snort/rules/local.rules
include /usr/local/snort/etc/snort/rules/snort3-community-rules/snort3-community.rules
]]

}

3.Test Snort's main configuration changes

Install OpenAppID extension

Once the OpenAppID extension is installed, Snort can detect network threats at the application layer level

1.OpenAppID Extension Download and Deployment

2.Copy the extracted folder (odp) to the following directory

3.Edit the Snort main configuration file to define the location of the OpenAppID folder

[snort.lua] Edited Content

●Per Line 99 : Add to the appid section
appid =
{
-- appid requires this to use appids in rules
--app_detector_dir = 'directory to load appid detectors from'
app_detector_dir = '/usr/local/lib',
log_stats = true,
}
appid_listener =
{
json_logging = true,
file = "/var/log/snort/appid-output.log",
}

--[[
reputation =

4.Test Snort's main configuration changes

Verify that all configurations are set up correctly

Send a ping command from a remote computer to the IP address of the server. This will cause an alert log to appear in the console window of the host server

Configure Snort systemd service

1.Creating Users for the Snort Service

2.Create log folder and set permissions
Create directory folder for Snort logs and set folder permissions

3.Create Systemd service file

[snort3.service] contents
[Unit]
Description=Snort3 IDS Daemon Service
After=syslog.target network.target

[Service]
Type=simple
ExecStart=/usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort -D -i ens160 -m 0x1b -u snort -g snort
ExecStop=/bin/kill -9 $MAINPID

[Install]
WantedBy=multi-user.target

Reload and activate the Snort service.

Launched Snort service

Check Status

Snort IDS Logging

1.Configure Snort JSON logging

[snort.lua] Edited Content

●Per Line 259 : Add alert_json at the end of the '--7.configure outputs' section.

-------------------------------------------------------------------------------------
-- 7. configure outputs
-------------------------------------------------------------------------------------

-- event logging
-- you can enable with defaults from the command line with -A <alert_type>
-- uncomment below to set non-default configs
--alert_csv = { }
--alert_fast = { }
--alert_full = { }
--alert_sfsocket = { }
--alert_syslog = { }
--unified2 = { }

-- packet logging
-- you can enable with defaults from the command line with -L <log_type>
--log_codecs = { }
--log_hext = { }
--log_pcap = { }

-- additional logs
--packet_capture = { }
--file_log = { }
alert_json =
{
file = true,
limit = 50,
fields = 'timestamp msg pkt_num proto pkt_gen pkt_len dir src_addr src_port dst_addr dst_port service rule priority class action b64_data'
}

2.Restart Snort

3.Check log files
Ping command from a remote computer to the server, stored in the Snort alert_json.txt file.

This completes the installation and configuration of Snort 3.

Go to top
Copied title and URL