OracleLinux9.8 : SNORT3 Install

Contents

SNORT3

Snort is an open source network intrusion detection system capable of performing real-time traffic analysis and packet logging on IP networks。

It can perform “protocol analysis,” “content search,” and “matching,” and can be used to detect various attacks such as “buffer overflows,” “stealth port scans,” “CGI attacks,” “SMB probes,” “OS fingerprinting attempts,” “semantic URL attacks,” and “server message block probes. The system can be used to detect a variety of attacks, such as

1.advance preparation

1.1 Installing Required Packages

1.Installing openssl-devel

# dnf -y install openssl-devel

2.Installing cmake

# dnf -y install cmake

1.2 Install required packages

# dnf -y install libpcap-devel pcre-devel libdnet-devel hwloc-devel openssl-devel zlib-devel luajit-devel pkgconf libmnl-devel libunwind-devel

# dnf -y install libnfnetlink-devel libnetfilter_queue g++

1.3 Installing LibDAQ

# dnf install git
# git clone https://github.com/snort3/libdaq.git

Cloning into 'libdaq'...
remote: Enumerating objects: 2691, done.
remote: Counting objects: 100% (313/313), done.
remote: Compressing objects: 100% (125/125), done.
remote: Total 2691 (delta 240), reused 212 (delta 188), pack-reused 2378 (from 2)
Receiving objects: 100% (2691/2691), 1.26 MiB | 13.42 MiB/s, done.
Resolving deltas: 100% (1932/1932), done.

# cd libdaq/
# dnf -y install autoconf
# ./bootstrap
# ./configure
# make && make install

# ln -s /usr/local/lib/libdaq.so.3 /lib/

Add Shared Library
# ldconfig

Check the library
# ldconfig -p|grep daq
        libdaq.so.3 (libc6,x86-64) => /lib/libdaq.so.3

1.4 Installing Optional Packages

1.Installation of LZMA and UUID

# dnf -y install xz-devel libuuid-devel

2.Installing Hyperscan

# dnf -y install hyperscan hyperscan-devel

3.Installing Tcmalloc

# dnf -y install gperftools-devel

2. Installing Snort3

Install missing packages

# dnf -y install pcre2-devel
# dnf -y install flex

# git clone https://github.com/snort3/snort3.git
# cd snort3/
# export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:$PKG_CONFIG_PATH
# export PKG_CONFIG_PATH=/usr/local/lib64/pkgconfig:$PKG_CONFIG_PATH
# export CFLAGS="-O3"
# export CXXFLAGS="-O3 -fno-rtti"

# ./configure_cmake.sh --prefix=/usr/local/snort --enable-tcmalloc
# cd build/
# pwd
/root/snort3/build

# make -j$(nproc)
# make -j$(nproc) install

Version Check

# /usr/local/snort/bin/snort -V

   ,,_     -*> Snort++ <*-
  o"  )~   Version 3.12.2.0
   ''''    By Martin Roesch & The Snort Team
           http://snort.org/contact#team
           Copyright (C) 2014-2026 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using DAQ version 3.0.27
           Using Hyperscan version 5.4.1 2023-04-14
           Using libpcap version 1.10.0 (with TPACKET_V3)
           Using LuaJIT version 2.1.0-beta3
           Using LZMA version 5.2.5
           Using OpenSSL 3.5.5 27 Jan 2026
           Using PCRE2 version 10.40 2022-04-14
           Using ZLIB version 1.2.11

test run

# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua

--------------------------------------------------
pcap DAQ configured to passive.

Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting

Network interface settings

Check network interface

# ip a

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:0c:29:ba:7a:22 brd ff:ff:ff:ff:ff:ff
    altname enp3s0
    inet 192.168.11.83/24 brd 192.168.11.255 scope global noprefixroute ens160
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:feba:7a22/64 scope link noprefixroute
       valid_lft forever preferred_lft forever

The network interface name is ens160

Set the network interface to promiscuous mode. This way, the network device can capture and inspect all network packets.

# ip link set dev ens160 promisc on

Check settings

# ip a | grep ens160 | grep mtu

2: ens160: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000

Check the offload status of the network interface.
If you need to monitor network traffic on an interface, you must disable offloading

# ethtool -k ens160 | grep receive-offload
generic-receive-offload: on
large-receive-offload: on

Since it is enabled, disable GRO and LRO using the following command:

# ethtool -K ens160 gro off lro off

Re-evaluate the situation

# ethtool -k ens160 | grep receive-offload
generic-receive-offload: off
large-receive-offload: off

Create systemd service for snort network interface

# vi /etc/systemd/system/snort3-nic.service

[snort3-nic.service] contents

[Unit]
Description=Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/sbin/ip link set dev ens160 promisc on
ExecStart=/usr/sbin/ethtool -K ens160 gro off lro off
TimeoutStartSec=0
RemainAfterExit=yes

[Install]
WantedBy=default.target

systemd daemon applies changes

# systemctl daemon-reload
# systemctl enable snort3-nic.service
Created symlink /etc/systemd/system/default.target.wants/snort3-nic.service → /etc/systemd/system/snort3-nic.service.
# systemctl start snort3-nic.service

Added Snort Community Ruleset

1.Create a folder for Snort rules, download the community ruleset from the Snort website, and place it in the designated rules directory

# mkdir /usr/local/snort/etc/snort/rules
# wget -qO- https://www.snort.org/downloads/community/snort3-community-rules.tar.gz | tar xz -C /usr/local/snort/etc/snort/rules/

2.Edit Snort main configuration file

# vi /usr/local/snort/etc/snort/snort.lua

[snort.lua] Edited Content

●Line 24 : Change
HOME_NET = '192.168.11.0/24'
●Line 28 : Change
EXTERNAL_NET = '!$HOME_NET'
●Per Line 188 : Add at the end of the ips entry
ips =
{
-- use this to enable decoder and inspector alerts
-- enable_builtin_rules = true,

-- use include for rules files; be sure to set your path
-- note that rules files can include other rules files
-- (see also related path vars at the top of snort_defaults.lua)

variables = default_variables,
rules = [[
include /usr/local/snort/etc/snort/rules/snort3-community-rules/snort3-community.rules
]]

}

3.Test Snort's main configuration changes

# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua

--------------------------------------------------
pcap DAQ configured to passive.

Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting

Add custom rule

1.Create a file in the Snort rules directory

# vi /usr/local/snort/etc/snort/rules/local.rules
alert icmp any any -> $HOME_NET any (msg:"Incoming ICMP"; sid:1000001; rev:1;)

2.Edit Snort main configuration file
Edit Snort main configuration file to include custom rules file directory in main configuration

# vi /usr/local/snort/etc/snort/snort.lua

[snort.lua] Edited Content

●Per Line 199 : Add
ips =
{
　　-- use this to enable decoder and inspector alerts
　　--enable_builtin_rules = true,

　　-- use include for rules files; be sure to set your path
　　-- note that rules files can include other rules files
　　-- (see also related path vars at the top of snort_defaults.lua)

　　variables = default_variables,
　　rules = [[
　　　include /usr/local/snort/etc/snort/rules/local.rules
　　　include /usr/local/snort/etc/snort/rules/snort3-community-rules/snort3-community.rules
]]

}

3.Test Snort's main configuration changes

# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua

--------------------------------------------------
pcap DAQ configured to passive.

Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting

Install OpenAppID extension

Once the OpenAppID extension is installed, Snort can detect network threats at the application layer level

1.OpenAppID Extension Download and Deployment

# wget https://www.snort.org/downloads/openappid/33380 -O OpenAppId-33380.tgz
# tar -xzvf  OpenAppId-33380.tgz

2.Copy the extracted folder (odp) to the following directory

# cp -R odp /usr/local/lib/

3.Edit the Snort main configuration file to define the location of the OpenAppID folder

# vi /usr/local/snort/etc/snort/snort.lua

[snort.lua] Edited Content

●Per Line 99 : Add to the appid section
appid =
{
-- appid requires this to use appids in rules
--app_detector_dir = 'directory to load appid detectors from'
app_detector_dir = '/usr/local/lib',
log_stats = true,
}
appid_listener =
{
json_logging = true,
file = "/var/log/snort/appid-output.log",
}

--[[
reputation =

4.Test Snort's main configuration changes

# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua

--------------------------------------------------
pcap DAQ configured to passive.

Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting

Verify that all configurations are set up correctly

# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -R /usr/local/snort/etc/snort/rules/local.rules -i ens160 -A alert_fast -s 65535 -k none

Send a ping command from a remote computer to the IP address of the server. This will cause an alert log to appear in the console window of the host server

--------------------------------------------------
pcap DAQ configured to passive.
Commencing packet processing
Retry queue interval is: 200 ms
++ [0] ens160
08/21-13:41:17.646126 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
08/21-13:41:17.646126 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
08/21-13:41:17.646412 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
08/21-13:41:18.654516 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
08/21-13:41:18.654516 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
08/21-13:41:18.654836 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
08/21-13:41:18.654922 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
08/21-13:41:19.667490 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
08/21-13:41:19.667490 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
08/21-13:41:19.667679 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
08/21-13:41:19.667781 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
08/21-13:41:20.671521 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
08/21-13:41:20.671522 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
08/21-13:41:20.671693 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
08/21-13:41:20.671792 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14

Configure Snort systemd service

1.Creating Users for the Snort Service

# useradd -r -s /usr/sbin/nologin -M snort

2.Create log folder and set permissions
Create directory folder for Snort logs and set folder permissions

# mkdir /var/log/snort
# chmod -R 5775 /var/log/snort
# chown -R snort:snort /var/log/snort

3.Create Systemd service file

# vi /etc/systemd/system/snort3.service

[snort3.service] contents

[Unit]
Description=Snort3 IDS Daemon Service
After=syslog.target network.target

[Service]
Type=simple
ExecStart=/usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort -D -i ens160 -m 0x1b -u snort -g snort
ExecStop=/bin/kill -9 $MAINPID

[Install]
WantedBy=multi-user.target

Reload and activate the Snort service.

# systemctl daemon-reload
# systemctl enable --now snort3.service

Launched Snort service

# systemctl start snort3.service

Snort IDS Logging

1.Configure Snort JSON logging

# vi /usr/local/snort/etc/snort/snort.lua

[snort.lua] Edited Content

●Per Line 262 : Add alert_json at the end of the '--7.configure outputs' section.

-------------------------------------------------------------------------------------
-- 7. configure outputs
-------------------------------------------------------------------------------------

-- event logging
-- you can enable with defaults from the command line with -A <alert_type>
-- uncomment below to set non-default configs
--alert_csv = { }
--alert_fast = { }
--alert_full = { }
--alert_sfsocket = { }
--alert_syslog = { }
--unified2 = { }

-- packet logging
-- you can enable with defaults from the command line with -L <log_type>
--log_codecs = { }
--log_hext = { }
--log_pcap = { }

-- additional logs
--packet_capture = { }
--file_log = { }
alert_json =
{
file = true,
limit = 50,
fields = 'timestamp msg pkt_num proto pkt_gen pkt_len dir src_addr src_port dst_addr dst_port service rule priority class action b64_data'
}

2.Restart Snort

# systemctl restart snort3.service

3.Check log files
Ping command from a remote computer to the server, stored in the Snort alert_json.txt file.

# tail -f /var/log/snort/alert_json.txt

{ "timestamp" : "08/21-13:47:49.487838", "msg" : "Incoming ICMP", "pkt_num" : 868, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "08/21-13:47:49.488344", "msg" : "Incoming ICMP", "pkt_num" : 869, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "08/21-13:47:50.497453", "msg" : "Incoming ICMP", "pkt_num" : 871, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "08/21-13:47:50.497453", "msg" : "Incoming ICMP", "pkt_num" : 872, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "08/21-13:47:50.497698", "msg" : "Incoming ICMP", "pkt_num" : 873, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "08/21-13:47:50.497835", "msg" : "Incoming ICMP", "pkt_num" : 874, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "08/21-13:47:51.509644", "msg" : "Incoming ICMP", "pkt_num" : 952, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "08/21-13:47:51.509644", "msg" : "Incoming ICMP", "pkt_num" : 953, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "08/21-13:47:51.509903", "msg" : "Incoming ICMP", "pkt_num" : 954, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "08/21-13:47:51.510032", "msg" : "Incoming ICMP", "pkt_num" : 955, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }

This completes the installation and configuration of Snort 3.

Automatic Updates to Rule Files

Install oinkmaster, which automatically updates the rule files that Snort uses to detect unauthorized access.

1. Oinkmaster Install

# wget http://prdownloads.sourceforge.net/oinkmaster/oinkmaster-2.0.tar.gz
# tar zxvf oinkmaster-2.0.tar.gz

Copy the following files to the specified directory
# cp oinkmaster-2.0/oinkmaster.pl /usr/local/bin/
# cp oinkmaster-2.0/oinkmaster.conf /etc/
# cp oinkmaster-2.0/oinkmaster.1 /usr/share/man/man1/

Delete the following files and directories

# rm -rf oinkmaster-2.0
# rm -f oinkmaster-2.0.tar.gz

2. Obtaining the Oink Code

Since you need an "Oink Code" to download the Snort rule files (Sourcefire VRT Certified Rules), obtain an "Oink Code."
First, go to the official SNORT website, register for an account, sign in with your registered username and password, then display the "Oinkcode" and copy it.

3. Oinkmaster Settings
Edit the Oinkmaster configuration file
Paste the Oinkcode you obtained

# vi /etc/oinkmaster.conf
Around line 56: Add the following
In the <file_name> section, after signing in to SNORT, paste the latest snortrules-snapshot-xxxxx.tar.gz file that matches the version of SNORT you are using.
Paste the oinkcode you obtained into the <oinkcode> section

url = http://www.snort.org/pub-bin/oinkmaster.cgi/<oinkcode>/<file_name>

4. Download (Run Oinkmaster)

# oinkmaster.pl -o /usr/local/snort/etc/snort/rules/

It is displayed as shown below
Loading /etc/oinkmaster.conf
Downloading file from http://www.snort.org/pub-bin/oinkmaster.cgi/*oinkcode*/snortrules-snapshot-31200.tar.gz... done.
Archive successfully downloaded, unpacking... done.
Setting up rules structures... done.
Processing downloaded rules... disabled 0, enabled 0, modified 0, total=47682
Setting up rules structures... done.
Comparing new files to the old ones... done.
Updating local rules files... done.

[***] Results from Oinkmaster started 20260821 15:06:13 [***]

[*] Rules modifications: [*]
    None.

[*] Non-rule line modifications: [*]
    None.

[+] Added files (consider updating your snort.conf to include them if needed): [+]

    -> includes.rules
    -> snort3-app-detect.rules
    -> snort3-browser-chrome.rules
    -> snort3-browser-firefox.rules
    -> snort3-browser-ie.rules
    -> snort3-browser-other.rules
    -> snort3-browser-plugins.rules
    -> snort3-browser-webkit.rules
    -> snort3-content-replace.rules
    -> snort3-exploit-kit.rules
    -> snort3-file-executable.rules
    -> snort3-file-flash.rules
    -> snort3-file-identify.rules
    -> snort3-file-image.rules
    -> snort3-file-java.rules
    -> snort3-file-multimedia.rules
    -> snort3-file-office.rules
    -> snort3-file-other.rules
    -> snort3-file-pdf.rules
    -> snort3-indicator-compromise.rules
    -> snort3-indicator-obfuscation.rules
    -> snort3-indicator-scan.rules
    -> snort3-indicator-shellcode.rules
    -> snort3-malware-backdoor.rules
    -> snort3-malware-cnc.rules
    -> snort3-malware-other.rules
    -> snort3-malware-tools.rules
    -> snort3-netbios.rules
    -> snort3-os-linux.rules
    -> snort3-os-mobile.rules
    -> snort3-os-other.rules
    -> snort3-os-solaris.rules
    -> snort3-os-windows.rules
    -> snort3-policy-multimedia.rules
    -> snort3-policy-other.rules
    -> snort3-policy-social.rules
    -> snort3-policy-spam.rules
    -> snort3-protocol-dns.rules
    -> snort3-protocol-finger.rules
    -> snort3-protocol-ftp.rules
    -> snort3-protocol-icmp.rules
    -> snort3-protocol-imap.rules
    -> snort3-protocol-nntp.rules
    -> snort3-protocol-other.rules
    -> snort3-protocol-pop.rules
    -> snort3-protocol-rpc.rules
    -> snort3-protocol-scada.rules
    -> snort3-protocol-services.rules
    -> snort3-protocol-snmp.rules
    -> snort3-protocol-telnet.rules
    -> snort3-protocol-tftp.rules
    -> snort3-protocol-voip.rules
    -> snort3-pua-adware.rules
    -> snort3-pua-other.rules
    -> snort3-pua-p2p.rules
    -> snort3-pua-toolbars.rules
    -> snort3-server-apache.rules
    -> snort3-server-iis.rules
    -> snort3-server-mail.rules
    -> snort3-server-mssql.rules
    -> snort3-server-mysql.rules
    -> snort3-server-oracle.rules
    -> snort3-server-other.rules
    -> snort3-server-samba.rules
    -> snort3-server-webapp.rules
    -> snort3-sql.rules
    -> snort3-x11.rules
    -> VRT-License.txt

5. Oinkmaster Scheduled Automatic Execution Settings

Creating an Oinkmaster Scheduled Automated Script

# vi /etc/cron.daily/snort-rule-update

Describe the following
#!/bin/bash
/usr/local/bin/oinkmaster.pl -o   /usr/local/snort/etc/snort/rules/ 2>&1 | logger -t oinkmaster
systemctl restart snort3 > /dev/null

Execution permissions for the script

# chmod +x /etc/cron.daily/snort-rule-update

Go to top