業務用エアコン関連の技術情報、エラーコード、環境問題対策に関する別サイト「エアコンの安全な修理･適切なフロン回収」

Debian13.6 : SNORT3 Install

2026.07.24

Snort3

1.Install the required packages

# apt -y install build-essential libpcap-dev libpcre2-dev libnet1-dev zlib1g-dev luajit hwloc libdumbnet-dev bison flex liblzma-dev openssl libssl-dev pkg-config libhwloc-dev cmake cpputest libsqlite3-dev uuid-dev libcmocka-dev libnetfilter-queue-dev libmnl-dev autotools-dev libluajit-5.1-dev libunwind-dev libfl-dev git

2.  Install the DAQ library

Download and install the DAQ library

# git clone https://github.com/snort3/libdaq.git
# cd libdaq/
~/libdaq# ./bootstrap
~/libdaq# ./configure
~/libdaq# make
~/libdaq# make install

3.  Install Gperftools

A profiler tool used to improve the performance of specific applications or services by optimizing memory handling across multiple instances.

# cd
# wget https://github.com/gperftools/gperftools/releases/download/gperftools-2.18.1/gperftools-2.18.1.tar.gz
# tar xzf gperftools-2.18.1.tar.gz
# cd gperftools-2.18.1
~/gperftools-2.18.1# ./configure
~/gperftools-2.18.1# make
~/gperftools-2.18.1# make install

4. Installing SNORT3

①Downloading and Extracting SNORT3

# cd
# wget https://github.com/snort3/snort3/archive/refs/tags/3.12.2.0.tar.gz
# tar zxvf 3.12.2.0.tar.gz
# cd snort3-3.12.2.0
# ./configure_cmake.sh --prefix=/usr/local --enable-tcmalloc
# cd build
# make
# make install

➁Update shared libraries

# ldconfig

➂Check the version

# snort -V

   ,,_     -*> Snort++ <*-
  o"  )~   Version 3.12.2.0
   ''''    By Martin Roesch & The Snort Team
           http://snort.org/contact#team
           Copyright (C) 2014-2026 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using DAQ version 3.0.27
           Using libpcap version 1.10.5 (with TPACKET_V3)
           Using LuaJIT version 2.1.1737090214
           Using LZMA version 5.8.1
           Using OpenSSL 3.5.6 7 Apr 2026
           Using PCRE2 version 10.46 2025-08-27
           Using ZLIB version 1.3.1

⑥Testing Default Settings

# snort -c /usr/local/etc/snort/snort.lua

If normal, it will be displayed as follows:
pcap DAQ configured to passive.

Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting

5.  Identify and configure network interfaces

①Verify the network interface

# ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000  
    link/ether 00:0c:29:8e:7c:10 brd ff:ff:ff:ff:ff:ff
    altname enp2s1
    altname enx000c298e7c10
    inet 192.168.11.83/24 brd 192.168.11.255 scope global ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe8e:7c10/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever

Network interface name: ens33

➁Set the network interface to promiscuous mode

# ip link set dev ens33 promisc on

Confirm settings

# ip addr | grep ens33 | grep mtu
2: ens33: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000

➂Large Receive Offload (LRO) and Generic Receive Offload (GRO) set to off state

Check the current status

# ethtool -k ens33 | grep receive-offload
generic-receive-offload: on
large-receive-offload: off [fixed]

Set the off-road status of LRO and GRO to off.

# ethtool -K ens33 gro off lro off

6. Create a systemd service for the network interface

# vi /etc/systemd/system/snort3-nic.service

Describe the following
[Unit]
Description=Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/sbin/ip link set dev ens33 promisc on
ExecStart=/usr/sbin/ethtool -K ens33 gro off lro off
TimeoutStartSec=0
RemainAfterExit=yes

[Install]
WantedBy=default.target

Reload the systemd daemon to apply changes.

# systemctl daemon-reload

Start and enable the snort3-nic.service.

# systemctl start snort3-nic.service
# systemctl enable snort3-nic.service

Check the status of snort3-nic.service

# systemctl status snort3-nic.service

● snort3-nic.service - Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot
     Loaded: loaded (/etc/systemd/system/snort3-nic.service; enabled; preset: enabled)
     Active: active (exited) since Fri 2026-07-24 13:40:32 JST; 28s ago
 Invocation: 7eeea35fe69c479fa7f96ebaac062724
   Main PID: 42972 (code=exited, status=0/SUCCESS)
   Mem peak: 1.7M
        CPU: 19ms

Jul 24 13:40:31 Lepard systemd[1]: Starting snort3-nic.service - Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot...
Jul 24 13:40:32 Lepard systemd[1]: Finished snort3-nic.service - Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot.

7. Adding Snort Rules

7.1 Add Community Ruleset

①Create a folder for Snort rules and download the community rule set from the Snort website.

# mkdir /usr/local/etc/snort/rules
# wget -qO- https://www.snort.org/downloads/community/snort3-community-rules.tar.gz | tar xz -C /usr/local/etc/snort/rules/

➁ Edit the main configuration file

# vi /usr/local/etc/snort/snort.lua

Line 24 : Change to own network
HOME_NET = '192.168.11.0/24'

Line 28 : Change
EXTERNAL_NET = '!$HOME_NET'

Per Line 197 : Add
ips =
{
    -- use this to enable decoder and inspector alerts
    -- enable_builtin_rules = true,
    

    -- use include for rules files; be sure to set your path
    -- note that rules files can include other rules files
    -- (see also related path vars at the top of snort_defaults.lua)

    variables = default_variables,
    rules = [[
      include /usr/local/etc/snort/rules/snort3-community-rules/snort3-community.rules
    ]]

}

➂ Testing changes to the main configuration

# snort -c /usr/local/etc/snort/snort.lua

--------------------------------------------------
pcap DAQ configured to passive.

Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting

7.2 Add custom rules

① Create a file in the Snort rules directory

# vi  /usr/local/etc/snort/rules/local.rules

Describe the following
alert icmp any any -> $HOME_NET any (msg:"Incoming ICMP"; sid:1000001; rev:1;)

➁SnortEdit Main Configuration

# vi /usr/local/etc/snort/snort.lua

Add around line 199
ips =
{
    -- use this to enable decoder and inspector alerts
    -- enable_builtin_rules = true,
    
    -- use include for rules files; be sure to set your path
    -- note that rules files can include other rules files
    -- (see also related path vars at the top of snort_defaults.lua)

    variables = default_variables,
    rules = [[
      include /usr/local/etc/snort/rules/local.rules
      include /usr/local/etc/snort/rules/snort3-community-rules/snort3-community.rules
    ]]
}

➂ Testing changes to the main configuration

# snort -c /usr/local/etc/snort/snort.lua

--------------------------------------------------
pcap DAQ configured to passive.

Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting

8. OpenAppID Installation

Installing the OpenAppID extension enables Snort to detect network threats at the application layer.

①Download OpenAppID and extract it.

# wget https://www.snort.org/downloads/openappid/33380 -O OpenAppId-33380.tgz
# tar -xzvf  OpenAppId-33380.tgz

➁Copy the extracted folder (odp) to the following directory:

# cp -R odp /usr/local/lib/

➂Edit the main configuration file and define the location of the OpenAppID folder.

# vi /usr/local/etc/snort/snort.lua

Add around line 104
appid =
{
    -- appid requires this to use appids in rules
    --app_detector_dir = 'directory to load appid detectors from'
    app_detector_dir = '/usr/local/lib',
    log_stats = true,

}

appid_listener =
{
    json_logging = true,
    file = "/var/log/snort/appid-output.log",
}
--[[
reputation =

④ Testing changes to the main configuration

# snort -c /usr/local/etc/snort/snort.lua

--------------------------------------------------
pcap DAQ configured to passive.

Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting

9. Create a systemd service for Snort

9.1 Confirmation of all setups

Using local.rules to run Snort on a network interface

# snort -c /usr/local/etc/snort/snort.lua -R /usr/local/etc/snort/rules/local.rules -i ens33 -A alert_fast -s 65535 -k none

Send a ping command to the Debian server's IP address from another PC on the same network.
The following alert log appears in the host server's console window:

++ [0] ens33
07/24-13:56:36.940068 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
07/24-13:56:36.940068 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
07/24-13:56:36.940294 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
07/24-13:56:37.955186 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
07/24-13:56:37.955186 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
07/24-13:56:37.955398 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
07/24-13:56:37.955512 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
07/24-13:56:38.972951 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
07/24-13:56:38.972951 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
07/24-13:56:38.973351 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
07/24-13:56:38.973455 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
07/24-13:56:39.987318 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
07/24-13:56:39.987318 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
07/24-13:56:39.987780 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
07/24-13:56:39.987940 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14

9.2 Create a systemd service for Snort

①Create a user (snort) for the Snort service

# useradd -r -s /usr/sbin/nologin -M snort

➁Creating the Log Folder and Setting Permissions

# mkdir /var/log/snort
# chmod -R 5775 /var/log/snort
# chown -R snort:snort /var/log/snort

➂Create SNORT systemd service file

# vi /etc/systemd/system/snort3.service

Describe the following
[Unit]
Description=Snort3 IDS Daemon Service
After=syslog.target network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/snort -c /usr/local/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort -D -i ens33 -m 0x1b -u snort -g snort
ExecStop=/bin/kill -9 $MAINPID

[Install]
WantedBy=multi-user.target

④Reload and enable the Snort service

# systemctl daemon-reload
# systemctl enable --now snort3

⑤Start the Snort service and check its status.

# systemctl start snort3
# systemctl status snort3
● snort3.service - Snort3 IDS Daemon Service
     Loaded: loaded (/etc/systemd/system/snort3.service; enabled; preset: enabled)
     Active: active (running) since Fri 2026-07-24 14:00:32 JST; 31s ago
 Invocation: f1af56d5f4ff4e72ad0d1274b0532a81
   Main PID: 43312 (snort3)
      Tasks: 2 (limit: 4553)
     Memory: 216.2M (peak: 216.6M)
        CPU: 1.060s
     CGroup: /system.slice/snort3.service
             └─43312 /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort -D -i ens33 -m 0x1b -u snort -g >

Jul 24 14:00:32 Lepard snort[43312]:                 to_server: 69
Jul 24 14:00:32 Lepard snort[43312]:                 to_client: 48
Jul 24 14:00:32 Lepard snort[43312]: --------------------------------------------------
Jul 24 14:00:32 Lepard snort[43312]: search engine (ac_bnfa)
Jul 24 14:00:32 Lepard snort[43312]:                 instances: 334
Jul 24 14:00:32 Lepard snort[43312]:                  patterns: 10779
Jul 24 14:00:32 Lepard snort[43312]:             pattern chars: 175202
Jul 24 14:00:32 Lepard snort[43312]:                num states: 123205
Jul 24 14:00:32 Lepard snort[43312]:          num match states: 10502
Jul 24 14:00:32 Lepard snort[43312]:              memory scale: MB

10. Snort JSON Logging Configuration

①Edit the Snort configuration file

# vi /usr/local/etc/snort/snort.lua

Line 261 :  Add to the end of the 7.configure outputs section

---------------------------------------------------------------------------
-- 7. configure outputs
---------------------------------------------------------------------------

--------------- 

-- additional logs
--packet_capture = { }
--file_log = { }

alert_json =
{
    file = true,
    limit = 50,
    fields = 'timestamp msg pkt_num proto pkt_gen pkt_len dir src_addr src_port dst_addr dst_port service rule priority class action b64_data'
}

➁Restart Snort

# systemctl restart snort3

➂Confirming Settings
Execute the ping command from another PC on the same network to the Debian host server.
The log is recorded and saved in the Snort alert_json.txt file. Check the log file.

# tail -f /var/log/snort/alert_json.txt 

The following log results are displayed:
{ "timestamp" : "07/24-14:04:33.524087", "msg" : "Incoming ICMP", "pkt_num" : 791, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "07/24-14:04:33.524215", "msg" : "Incoming ICMP", "pkt_num" : 792, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "07/24-14:04:34.537199", "msg" : "Incoming ICMP", "pkt_num" : 842, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "07/24-14:04:34.537199", "msg" : "Incoming ICMP", "pkt_num" : 843, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "07/24-14:04:34.537362", "msg" : "Incoming ICMP", "pkt_num" : 844, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "07/24-14:04:34.537485", "msg" : "Incoming ICMP", "pkt_num" : 845, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "07/24-14:04:35.552620", "msg" : "Incoming ICMP", "pkt_num" : 889, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "07/24-14:04:35.552620", "msg" : "Incoming ICMP", "pkt_num" : 890, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "07/24-14:04:35.552867", "msg" : "Incoming ICMP", "pkt_num" : 891, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "07/24-14:04:35.552993", "msg" : "Incoming ICMP", "pkt_num" : 892, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }

11.Automatic Rule File Updates

Install oinkmaster to automatically update the rule files Snort references for detecting unauthorized access.

11.1 Oinkmaster Installation

# wget http://prdownloads.sourceforge.net/oinkmaster/oinkmaster-2.0.tar.gz
# tar zxvf oinkmaster-2.0.tar.gz

Copy the following files to the specified directory.
# cp oinkmaster-2.0/oinkmaster.pl /usr/local/bin/
# cp oinkmaster-2.0/oinkmaster.conf /etc/
# cp oinkmaster-2.0/oinkmaster.1 /usr/share/man/man1/

Delete the following files and directories

# rm -rf oinkmaster-2.0
# rm -f oinkmaster-2.0.tar.gz　

11.2 Obtaining the Oink Code

To download Snort rule files (Sourcefire VRT Certified Rules), you need an "Oink Code," so obtain an "Oink Code."
First, access the SNORT official website and register as a user. After signing in with your registered account and password, display the "Oinkcode" and copy it.

11.3 Oinkmaster Settings
Edit the Oinkmaster configuration file
Paste the acquired Oinkcode

# vi /etc/oinkmaster.conf
Per Line56 : Add the following
Replace <file_name> with the latest snortrules-snapshot-xxxxx.tar.gz file matching your SNORT version after signing in to SNORT.
Paste the obtained oinkcode into the <oinkcode> section.

url = http://www.snort.org/pub-bin/oinkmaster.cgi/<oinkcode>/<file_name>

11.4 Download (Run Oinkmaster)

# oinkmaster.pl -o /usr/local/etc/snort/rules/

It will be displayed as follows:
[***] Results from Oinkmaster started 20260724 14:23:06 [***]

[*] Rules modifications: [*]
    None.

[*] Non-rule line modifications: [*]
    None.

[+] Added files (consider updating your snort.conf to include them if needed): [+]

    -> includes.rules
    -> snort3-app-detect.rules
    -> snort3-browser-chrome.rules
    -> snort3-browser-firefox.rules
    -> snort3-browser-ie.rules
    -> snort3-browser-other.rules
    -> snort3-browser-plugins.rules
    -> snort3-browser-webkit.rules
    -> snort3-content-replace.rules
    -> snort3-exploit-kit.rules
    -> snort3-file-executable.rules
    -> snort3-file-flash.rules
    -> snort3-file-identify.rules
    -> snort3-file-image.rules
    -> snort3-file-java.rules
    -> snort3-file-multimedia.rules
    -> snort3-file-office.rules
    -> snort3-file-other.rules
    -> snort3-file-pdf.rules
    -> snort3-indicator-compromise.rules
    -> snort3-indicator-obfuscation.rules
    -> snort3-indicator-scan.rules
    -> snort3-indicator-shellcode.rules
    -> snort3-malware-backdoor.rules
    -> snort3-malware-cnc.rules
    -> snort3-malware-other.rules
    -> snort3-malware-tools.rules
    -> snort3-netbios.rules
    -> snort3-os-linux.rules
    -> snort3-os-mobile.rules
    -> snort3-os-other.rules
    -> snort3-os-solaris.rules
    -> snort3-os-windows.rules
    -> snort3-policy-multimedia.rules
    -> snort3-policy-other.rules
    -> snort3-policy-social.rules
    -> snort3-policy-spam.rules
    -> snort3-protocol-dns.rules
    -> snort3-protocol-finger.rules
    -> snort3-protocol-ftp.rules
    -> snort3-protocol-icmp.rules
    -> snort3-protocol-imap.rules
    -> snort3-protocol-nntp.rules
    -> snort3-protocol-other.rules
    -> snort3-protocol-pop.rules
    -> snort3-protocol-rpc.rules
    -> snort3-protocol-scada.rules
    -> snort3-protocol-services.rules
    -> snort3-protocol-snmp.rules
    -> snort3-protocol-telnet.rules
    -> snort3-protocol-tftp.rules
    -> snort3-protocol-voip.rules
    -> snort3-pua-adware.rules
    -> snort3-pua-other.rules
    -> snort3-pua-p2p.rules
    -> snort3-pua-toolbars.rules
    -> snort3-server-apache.rules
    -> snort3-server-iis.rules
    -> snort3-server-mail.rules
    -> snort3-server-mssql.rules
    -> snort3-server-mysql.rules
    -> snort3-server-oracle.rules
    -> snort3-server-other.rules
    -> snort3-server-samba.rules
    -> snort3-server-webapp.rules
    -> snort3-sql.rules
    -> snort3-x11.rules
    -> VRT-License.txt

11.5 Oinkmaster Scheduled Automatic Execution Settings

Oinkmaster Scheduled Automated Script Creation

# vi /etc/cron.daily/snort-rule-update

Describe the following
#!/bin/bash
/usr/local/bin/oinkmaster.pl -o  /usr/local/etc/snort/rules/ 2>&1 | logger -t oinkmaster
systemctl restart snort3 > /dev/null

Script execution permissions

# chmod +x /etc/cron.daily/snort-rule-update

Go to top