SNORT3
Snortは、IPネットワーク上でリアルタイムのトラフィック分析とパケットロギングを実行できるオープンソースのネットワーク侵入検知システムです。
「プロトコル分析」「コンテンツ検索」「マッチング」を実行でき、「バッファオーバーフロー」「ステルスポートスキャン」「CGI攻撃」「SMBプローブ」「OSフィンガープリント試行」「セマンティックURL攻撃」「サーバメッセージブロック探査」など、さまざまな攻撃検出に使用できます。
1.事前準備
1.1 必須パッケージのインストール
1.openssl-develのインストール
# zypper -n install openssl-devel
2.cmakeのインストール
# zypper -n install cmake
バージョン確認
# cmake --version
cmake version 4.2.3
CMake suite maintained and supported by Kitware (kitware.com/cmake).
1.2 その他必要なパッケージのインストール
# zypper install libpcap-devel pcre2-devel hwloc-devel zlib-devel luajit-devel pkgconf libmnl-devel libunwind-devel
# zypper install libnfnetlink-devel gcc-c++ make
1.3 LibDAQのインストール
# zypper install git
# git clone https://github.com/snort3/libdaq.git
Cloning into 'libdaq'...
remote: Enumerating objects: 2691, done.
remote: Counting objects: 100% (313/313), done.
remote: Compressing objects: 100% (125/125), done.
remote: Total 2691 (delta 240), reused 212 (delta 188), pack-reused 2378 (from 2)
Receiving objects: 100% (2691/2691), 1.26 MiB | 15.34 MiB/s, done.
Resolving deltas: 100% (1932/1932), done.
# cd libdaq/
# zypper install autoconf
# zypper install automake
# zypper install libtool
# ./bootstrap
# ./configure -disable-dependency-tracking
# make && make install
# ln -s /usr/local/lib/libdaq.so.3 /lib/
共有ライブラリの追加
# ldconfig
ライブラリの確認
# ldconfig -p|grep daq
libdaq.so.3 (libc6,x86-64) => /usr/local/lib/libdaq.so.3
libdaq.so.3 (libc6,x86-64) => /lib/libdaq.so.3
libdaq.so (libc6,x86-64) => /usr/local/lib/libdaq.so
1.4 オプションパッケージのインストール
1.LZMAとUUIDのインストール
# zypper install xz-devel libuuid-devel
2.Tcmallocのインストール
# zypper install gperftools-devel
2. Snort3のインストール
# wget https://www.rpmfind.net/linux/opensuse/tumbleweed/repo/oss/x86_64/libdnet-devel-1.18.2-1.1.x86_64.rpm
# zypper install libdnet-devel-1.18.2-1.1.x86_64.rpm
# cd
# git clone https://github.com/snort3/snort3.git
# cd snort3/
# export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:$PKG_CONFIG_PATH
# export PKG_CONFIG_PATH=/usr/local/lib64/pkgconfig:$PKG_CONFIG_PATH
# export CFLAGS="-O3"
# export CXXFLAGS="-O3 -fno-rtti"
# zypper install flex
# ./configure_cmake.sh --prefix=/usr/local/snort --enable-tcmalloc
-------------------------------------------------------
-- Configuring done
-- Generating done
-- Build files have been written to: /root/snort3/build
# cd build/
# pwd
/root/snort3/build
# make -j$(nproc)
# make -j$(nproc) install
バージョン確認
# /usr/local/snort/bin/snort -V
,,_ -*> Snort++ <*-
o" )~ Version 3.12.2.0
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2026 Cisco and/or its affiliates. All rights reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using DAQ version 3.0.27
Using libpcap version 1.10.6 (64-bit time_t, with TPACKET_V3)
Using LuaJIT version 2.1.1756211046
Using LZMA version 5.8.3
Using OpenSSL 3.5.3 16 Sep 2025
Using PCRE2 version 10.47 2025-10-21
Using ZLIB version 1.3.1
テスト実行
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua
--------------------------------------------------
search engine (ac_bnfa)
instances: 2
patterns: 438
pattern chars: 2602
num states: 1832
num match states: 392
memory scale: KB
total memory: 71.2812
pattern memory: 19.6484
match list memory: 28.4375
transition memory: 22.9453
appid: MaxRss diff: 3584
appid: patterns loaded: 300
--------------------------------------------------
pcap DAQ configured to passive.
Snort successfully validated the configuration (with 0 warnings).
o")~ Snort exiting
3. ネットワークインターフェースの設定
ネットワーク インタフェースを確認
# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:2e:42:73 brd ff:ff:ff:ff:ff:ff
altname enp2s1
altname enx000c292e4273
inet 192.168.11.83/24 brd 192.168.11.255 scope global noprefixroute ens33
valid_lft forever preferred_lft forever
ネットワーク・インターフェース名はens33である
ネットワークインターフェイスをプロミスキャスモードに設定する。こうすることで、ネットワークデバイスはすべてのネットワークパケットをキャプチャし、検査できるようになる。
# ip link set dev ens33 promisc on
設定を確認
# ip a | grep ens33 | grep mtu
2: ens33: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
ネットワーク・インタフェースのオフロード・ステータスを確認。インタフェースのネッ トワーク・トラフィックを監視する必要がある場合は、オフロードを無効にする必要がある
現在の状況を確認
# ethtool -k ens33 | grep receive-offload
generic-receive-offload: on
large-receive-offload: off [fixed]
generic-receive-offload: onになっているのでoffにする
# ethtool -K ens33 gro off
現在の状況を再度確認
# ethtool -k ens33 | grep receive-offload
generic-receive-offload: off
large-receive-offload: off [fixed]
LROとGROのオフロードステータスはオフ状態になっている
Snortネットワークインターフェース用のsystemdサービスを新規作成する
# vi /etc/systemd/system/snort3-nic.service
下記内容を記述
[Unit]
Description=Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot
After=network.target
[Service]
Type=oneshot
ExecStart=/usr/sbin/ip link set dev ens33 promisc on
ExecStart=/usr/sbin/ethtool -K ens33 gro off lro off
TimeoutStartSec=0
RemainAfterExit=yes
[Install]
WantedBy=default.target
変更を適用する
# systemctl daemon-reload
# systemctl enable snort3-nic.service
Created symlink /etc/systemd/system/default.target.wants/snort3-nic.service → /etc/systemd/system/snort3-nic.service.
# systemctl start snort3-nic.service
4. Snortコミュニティ・ルールセットを追加
1.Snortルール用のフォルダを作成し、SnortのWebサイトからコミュニティルールセットをダウンロードし、所定のルールディレクトリーに配置
# mkdir /usr/local/snort/etc/snort/rules
# wget -qO- https://www.snort.org/downloads/community/snort3-community-rules.tar.gz | tar xz -C /usr/local/snort/etc/snort/rules/
2.Snortメイン設定ファイルを編集
# vi /usr/local/snort/etc/snort/snort.lua
24行目変更
HOME_NET = '192.168.11.0/24'
28行目変更
EXTERNAL_NET = '!$HOME_NET'
188行目当たりのips項目の最後に追加
ips =
{
-- use this to enable decoder and inspector alerts
-- enable_builtin_rules = true,
-- use include for rules files; be sure to set your path
-- note that rules files can include other rules files
-- (see also related path vars at the top of snort_defaults.lua)
variables = default_variables,
rules = [[
include /usr/local/snort/etc/snort/rules/snort3-community-rules/snort3-community.rules
]]
}
3.Snortのメインコンフィグレーションの変更をテスト
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua
--------------------------------------------------
pcap DAQ configured to passive.
Snort successfully validated the configuration (with 0 warnings).
o")~ Snort exiting
5. カスタムルールの追加
5.1 Snort rulesディレクトリにファイルを作成する
# touch /usr/local/snort/etc/snort/rules/local.rules
# vi /usr/local/snort/etc/snort/rules/local.rules
下記内容を記述
alert icmp any any -> $HOME_NET any (msg:"Incoming ICMP"; sid:1000001; rev:1;)
5.2.Snortメイン設定ファイルを編集
カスタム ルール ファイル ディレクトリをメイン構成に含めるためSnortメイン設定ファイルを編集
# vi /usr/local/snort/etc/snort/snort.lua
199行目当たりに追加
ips =
{
-- use this to enable decoder and inspector alerts
--enable_builtin_rules = true,
-- use include for rules files; be sure to set your path
-- note that rules files can include other rules files
-- (see also related path vars at the top of snort_defaults.lua)
variables = default_variables,
rules = [[
include /usr/local/snort/etc/snort/rules/local.rules
include /usr/local/snort/etc/snort/rules/snort3-community-rules/snort3-community.rules
]]
}
5.3. Snortのメインコンフィグレーションの変更をテスト
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua
--------------------------------------------------
pcap DAQ configured to passive.
Snort successfully validated the configuration (with 0 warnings).
o")~ Snort exiting
6. OpenAppIDエクステンションをインストール
OpenAppIDエクステンションをインストールすると、Snortはアプリケーションレイヤーレベルでネットワーク脅威を検出できるようになります
6.1. OpenAppIDエクステンションダウンロードと展開
# wget https://www.snort.org/downloads/openappid/33380 -O OpenAppId-33380.tgz
# tar -xzvf OpenAppId-33380.tgz
6.2. 解凍したフォルダ(odp)を以下のディレクトリにコピー
# cp -R odp /usr/local/lib/
6.3. Snortメイン設定ファイルを編集し、OpenAppIDフォルダの場所を定義
# vi /usr/local/snort/etc/snort/snort.lua
100行目当たりのappidセクションに追加
appid =
{
-- appid requires this to use appids in rules
--app_detector_dir = 'directory to load appid detectors from'
app_detector_dir = '/usr/local/lib',
log_stats = true,
}
appid_listener =
{
json_logging = true,
file = "/var/log/snort/appid-output.log",
}
--[[
reputation =
6.4. Snortのメインコンフィグレーションの変更をテスト
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua
--------------------------------------------------
pcap DAQ configured to passive.
Snort successfully validated the configuration (with 0 warnings).
o")~ Snort exiting
すべてのコンフィギュレーションが正しくセットアップされていることを確認する
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -R /usr/local/snort/etc/snort/rules/local.rules -i ens33 -A alert_fast -s 65535 -k none
リモートコンピュータからサーバのIPアドレスにpingコマンドを送信します。これにより、ホストサーバーのコンソールウィンドウにアラートログが表示されます
pcap DAQ configured to passive.
Commencing packet processing
Retry queue interval is: 200 ms
++ [0] ens33
06/24-12:27:37.209896 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:37.209896 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:37.209944 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:37.210017 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:38.212117 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:38.212117 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:38.212151 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:38.212214 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:39.219320 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:39.219320 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:39.219355 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:39.219417 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:40.230373 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:40.230373 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:40.230408 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:40.230475 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
7. Snort systemdサービスの設定
7.1. Snortサービス用のユーザの作成
# useradd -r -s /usr/sbin/nologin -M snort
7.2. ログフォルダの作成とパーミッションの設定
Snortログ用のディレクトリフォルダを作成し、フォルダパーミッションを設定
# mkdir /var/log/snort
# chmod -R 5775 /var/log/snort
# chown -R snort:snort /var/log/snort
7.3. Systemdサービスファイルの作成
# touch /etc/systemd/system/snort3.service
# vi /etc/systemd/system/snort3.service
下記内容を記述
[Unit]
Description=Snort3 IDS Daemon Service
After=syslog.target network.target
[Service]
Type=simple
ExecStart=/usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort -D -i ens33 -m 0x1b -u snort -g snort
ExecStop=/bin/kill -9 $MAINPID
[Install]
WantedBy=multi-user.target
Snortサービスをリロードして有効にする
# systemctl daemon-reload
# systemctl enable --now snort3
Created symlink '/etc/systemd/system/multi-user.target.wants/snort3.service' → '/etc/systemd/system/snort3.service'.
Snortサービスを開始
# systemctl start snort3
ステータスを確認
# systemctl status snort3
● snort3.service - Snort3 IDS Daemon Service
Loaded: loaded (/etc/systemd/system/snort3.service; enabled; preset: disabled)
Active: active (running) since Wed 2026-06-24 12:33:05 JST; 1min 33s ago
Invocation: 50ac8606b9c442d7aa275c00b793a0bf
Main PID: 56019 (snort3)
Tasks: 2 (limit: 4541)
CPU: 1.765s
CGroup: /system.slice/snort3.service
mq56019 /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort -D -i ens33 -m 0x1b -u snort -g snort
Jun 24 12:33:05 Lepard snort[56019]: any: 8
Jun 24 12:33:05 Lepard snort[56019]: to_server: 69
Jun 24 12:33:05 Lepard snort[56019]: to_client: 48
Jun 24 12:33:05 Lepard snort[56019]: --------------------------------------------------
Jun 24 12:33:05 Lepard snort[56019]: search engine (ac_bnfa)
Jun 24 12:33:05 Lepard snort[56019]: instances: 334
Jun 24 12:33:05 Lepard snort[56019]: patterns: 10779
Jun 24 12:33:05 Lepard snort[56019]: pattern chars: 175202
Jun 24 12:33:05 Lepard snort[56019]: num states: 123205
Jun 24 12:33:05 Lepard snort[56019]: num match states: 10502
8. Snort IDS ロギング
8.1. Snort JSONロギングの設定
# vi /usr/local/snort/etc/snort/snort.lua
261行目当たりの-- 7. configure outputsセクションの最後にalert_jsonを追加
---------------------------------------------------------------------------
-- 7. configure outputs
---------------------------------------------------------------------------
-- event logging
-- you can enable with defaults from the command line with -A <alert_type>
-- uncomment below to set non-default configs
--alert_csv = { }
--alert_fast = { }
--alert_full = { }
--alert_sfsocket = { }
--alert_syslog = { }
--unified2 = { }
-- packet logging
-- you can enable with defaults from the command line with -L <log_type>
--log_codecs = { }
--log_hext = { }
--log_pcap = { }
-- additional logs
--packet_capture = { }
--file_log = { }
alert_json =
{
file = true,
limit = 50,
fields = 'timestamp msg pkt_num proto pkt_gen pkt_len dir src_addr src_port dst_addr dst_port service rule priority class action b64_data'
}
8.2. Snortを再起動
# systemctl restart snort3
8.3. ログファイルを確認
リモートコンピュータからサーバにpingコマンドを実行する。Snort alert_json.txtファイルに保存されます。
# tail -f /var/log/snort/alert_json.txt
{ "timestamp" : "06/24-12:39:36.015799", "msg" : "Incoming ICMP", "pkt_num" : 2373, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:36.015860", "msg" : "Incoming ICMP", "pkt_num" : 2374, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:37.018717", "msg" : "Incoming ICMP", "pkt_num" : 2382, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:37.018717", "msg" : "Incoming ICMP", "pkt_num" : 2383, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:37.018765", "msg" : "Incoming ICMP", "pkt_num" : 2384, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:37.018830", "msg" : "Incoming ICMP", "pkt_num" : 2385, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:38.025393", "msg" : "Incoming ICMP", "pkt_num" : 2387, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:38.025394", "msg" : "Incoming ICMP", "pkt_num" : 2388, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:38.025551", "msg" : "Incoming ICMP", "pkt_num" : 2389, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:38.025761", "msg" : "Incoming ICMP", "pkt_num" : 2390, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
以上でSnort 3のインストールと設定が完了