SNORT3
Snort is an open source network intrusion detection system capable of performing real-time traffic analysis and packet logging on IP networks.
1.Advance preparation
1.1 Install required libraries
1.openssl-devel Install
# zypper -n install openssl-devel
2.cmake Install
# zypper -n install cmake
Version Confirmation
# cmake --version
cmake version 4.2.3
CMake suite maintained and supported by Kitware (kitware.com/cmake).
1.2 Installing Other Required Packages
# zypper install libpcap-devel pcre2-devel hwloc-devel zlib-devel luajit-devel pkgconf libmnl-devel libunwind-devel
# zypper install libnfnetlink-devel gcc-c++ make
1.3 LibDAQ Install
# zypper install git
# git clone https://github.com/snort3/libdaq.git
Cloning into 'libdaq'...
remote: Enumerating objects: 2691, done.
remote: Counting objects: 100% (313/313), done.
remote: Compressing objects: 100% (125/125), done.
remote: Total 2691 (delta 240), reused 212 (delta 188), pack-reused 2378 (from 2)
Receiving objects: 100% (2691/2691), 1.26 MiB | 15.34 MiB/s, done.
Resolving deltas: 100% (1932/1932), done.
# cd libdaq/
# zypper install autoconf
# zypper install automake
# zypper install libtool
# ./bootstrap
# ./configure -disable-dependency-tracking
# make && make install
# ln -s /usr/local/lib/libdaq.so.3 /lib/
Adding a Shared Library
# ldconfig
Check the library
# ldconfig -p|grep daq
libdaq.so.3 (libc6,x86-64) => /usr/local/lib/libdaq.so.3
libdaq.so.3 (libc6,x86-64) => /lib/libdaq.so.3
libdaq.so (libc6,x86-64) => /usr/local/lib/libdaq.so
1.4 Installing Optional Packages
1.Installation of LZMA and UUID
# zypper install xz-devel libuuid-devel
2.Installing Tcmalloc
# zypper install gperftools-devel
2. Installing Snort3
# wget https://www.rpmfind.net/linux/opensuse/tumbleweed/repo/oss/x86_64/libdnet-devel-1.18.2-1.1.x86_64.rpm
# zypper install libdnet-devel-1.18.2-1.1.x86_64.rpm
# cd
# git clone https://github.com/snort3/snort3.git
# cd snort3/
# export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:$PKG_CONFIG_PATH
# export PKG_CONFIG_PATH=/usr/local/lib64/pkgconfig:$PKG_CONFIG_PATH
# export CFLAGS="-O3"
# export CXXFLAGS="-O3 -fno-rtti"
# zypper install flex
# ./configure_cmake.sh --prefix=/usr/local/snort --enable-tcmalloc
-------------------------------------------------------
-- Configuring done
-- Generating done
-- Build files have been written to: /root/snort3/build
# cd build/
# pwd
/root/snort3/build
# make -j$(nproc)
# make -j$(nproc) install
Version Confirmation
# /usr/local/snort/bin/snort -V
,,_ -*> Snort++ <*-
o" )~ Version 3.12.2.0
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2026 Cisco and/or its affiliates. All rights reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using DAQ version 3.0.27
Using libpcap version 1.10.6 (64-bit time_t, with TPACKET_V3)
Using LuaJIT version 2.1.1756211046
Using LZMA version 5.8.3
Using OpenSSL 3.5.3 16 Sep 2025
Using PCRE2 version 10.47 2025-10-21
Using ZLIB version 1.3.1
test run
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua
--------------------------------------------------
search engine (ac_bnfa)
instances: 2
patterns: 438
pattern chars: 2602
num states: 1832
num match states: 392
memory scale: KB
total memory: 71.2812
pattern memory: 19.6484
match list memory: 28.4375
transition memory: 22.9453
appid: MaxRss diff: 3584
appid: patterns loaded: 300
--------------------------------------------------
pcap DAQ configured to passive.
Snort successfully validated the configuration (with 0 warnings).
o")~ Snort exiting
3. Network interface settings
Check network interface
# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:2e:42:73 brd ff:ff:ff:ff:ff:ff
altname enp2s1
altname enx000c292e4273
inet 192.168.11.83/24 brd 192.168.11.255 scope global noprefixroute ens33
valid_lft forever preferred_lft forever
The network interface name is ens33
Set the network interface to promiscuous mode. This way, the network device can capture and inspect all network packets.
# ip link set dev ens33 promisc on
Check settings
# ip a | grep ens33 | grep mtu
2: ens33: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
Check the offload status of the network interface. If you need to monitor network traffic on an interface, you must disable offloading
Check the current status
# ethtool -k ens33 | grep receive-offload
generic-receive-offload: on
large-receive-offload: off [fixed]
generic-receive-offload: It's set to "on," so turn it off.
# ethtool -K ens33 gro off
Review the current situation again
# ethtool -k ens33 | grep receive-offload
generic-receive-offload: off
large-receive-offload: off [fixed]
The LRO and GRO off-road statuses are set to "off."
Create systemd service for Snort network interface
# vi /etc/systemd/system/snort3-nic.service
Describe the following
[Unit]
Description=Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot
After=network.target
[Service]
Type=oneshot
ExecStart=/usr/sbin/ip link set dev ens33 promisc on
ExecStart=/usr/sbin/ethtool -K ens33 gro off lro off
TimeoutStartSec=0
RemainAfterExit=yes
[Install]
WantedBy=default.target
Apply Changes
# systemctl daemon-reload
# systemctl enable snort3-nic.service
Created symlink /etc/systemd/system/default.target.wants/snort3-nic.service → /etc/systemd/system/snort3-nic.service.
# systemctl start snort3-nic.service
4. Added Snort Community Ruleset
1.Create a folder for Snort rules, download the community ruleset from the Snort website, and place it in the designated rules directory
# mkdir /usr/local/snort/etc/snort/rules
# wget -qO- https://www.snort.org/downloads/community/snort3-community-rules.tar.gz | tar xz -C /usr/local/snort/etc/snort/rules/
2.Edit Snort main configuration file
# vi /usr/local/snort/etc/snort/snort.lua
Line 24 : Change
HOME_NET = '192.168.11.0/24'
Line 28 : Change
EXTERNAL_NET = '!$HOME_NET'
Add to the end of the ips item per line 188
ips =
{
-- use this to enable decoder and inspector alerts
-- enable_builtin_rules = true,
-- use include for rules files; be sure to set your path
-- note that rules files can include other rules files
-- (see also related path vars at the top of snort_defaults.lua)
variables = default_variables,
rules = [[
include /usr/local/snort/etc/snort/rules/snort3-community-rules/snort3-community.rules
]]
}
3.Test Snort's main configuration changes
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua
--------------------------------------------------
pcap DAQ configured to passive.
Snort successfully validated the configuration (with 0 warnings).
o")~ Snort exiting
5. Adding custom rules
5.1 Create a file in the Snort rules directory
# touch /usr/local/snort/etc/snort/rules/local.rules
# vi /usr/local/snort/etc/snort/rules/local.rules
Describe the following
alert icmp any any -> $HOME_NET any (msg:"Incoming ICMP"; sid:1000001; rev:1;)
5.2.Edit Snort main configuration file
Edit Snort main configuration file to include custom rules file directory in main configuration
# vi /usr/local/snort/etc/snort/snort.lua
Add per line 199
ips =
{
-- use this to enable decoder and inspector alerts
--enable_builtin_rules = true,
-- use include for rules files; be sure to set your path
-- note that rules files can include other rules files
-- (see also related path vars at the top of snort_defaults.lua)
variables = default_variables,
rules = [[
include /usr/local/snort/etc/snort/rules/local.rules
include /usr/local/snort/etc/snort/rules/snort3-community-rules/snort3-community.rules
]]
}
5.3. Test Snort's main configuration changes
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua
--------------------------------------------------
pcap DAQ configured to passive.
Snort successfully validated the configuration (with 0 warnings).
o")~ Snort exiting
6. Install OpenAppID extension
Once the OpenAppID extension is installed, Snort can detect network threats at the application layer level
6.1. OpenAppID Extension Download and Deployment
# wget https://www.snort.org/downloads/openappid/33380 -O OpenAppId-33380.tgz
# tar -xzvf OpenAppId-33380.tgz
6.2. Copy the extracted folder (odp) to the following directory
# cp -R odp /usr/local/lib/
6.3.Edit the Snort main configuration file to define the location of the OpenAppID folder
# vi /usr/local/snort/etc/snort/snort.lua
Add to the `appid` section around line 100
appid =
{
-- appid requires this to use appids in rules
--app_detector_dir = 'directory to load appid detectors from'
app_detector_dir = '/usr/local/lib',
log_stats = true,
}
appid_listener =
{
json_logging = true,
file = "/var/log/snort/appid-output.log",
}
--[[
reputation =
6.4. Test Snort's main configuration changes
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua
--------------------------------------------------
pcap DAQ configured to passive.
Snort successfully validated the configuration (with 0 warnings).
o")~ Snort exiting
Verify that all configurations are set up correctly
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -R /usr/local/snort/etc/snort/rules/local.rules -i ens33 -A alert_fast -s 65535 -k none
Send a ping command from a remote computer to the IP address of the server. This will cause an alert log to appear in the console window of the host server
pcap DAQ configured to passive.
Commencing packet processing
Retry queue interval is: 200 ms
++ [0] ens33
06/24-12:27:37.209896 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:37.209896 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:37.209944 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:37.210017 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:38.212117 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:38.212117 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:38.212151 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:38.212214 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:39.219320 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:39.219320 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:39.219355 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:39.219417 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:40.230373 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:40.230373 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:40.230408 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:40.230475 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
7. Configure Snort systemd service
7.1. Creating Users for the Snort Service
# useradd -r -s /usr/sbin/nologin -M snort
7.2. Create log folder and set permissions
Create directory folder for Snort logs and set folder permissions
# mkdir /var/log/snort
# chmod -R 5775 /var/log/snort
# chown -R snort:snort /var/log/snort
7.3. Create Systemd service file
# touch /etc/systemd/system/snort3.service
# vi /etc/systemd/system/snort3.service
Describe the following
[Unit]
Description=Snort3 IDS Daemon Service
After=syslog.target network.target
[Service]
Type=simple
ExecStart=/usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort -D -i ens33 -m 0x1b -u snort -g snort
ExecStop=/bin/kill -9 $MAINPID
[Install]
WantedBy=multi-user.target
Reload and activate the Snort service.
# systemctl daemon-reload
# systemctl enable --now snort3
Created symlink '/etc/systemd/system/multi-user.target.wants/snort3.service' → '/etc/systemd/system/snort3.service'.
Launched Snort service
# systemctl start snort3
Check Status
# systemctl status snort3
● snort3.service - Snort3 IDS Daemon Service
Loaded: loaded (/etc/systemd/system/snort3.service; enabled; preset: disabled)
Active: active (running) since Wed 2026-06-24 12:33:05 JST; 1min 33s ago
Invocation: 50ac8606b9c442d7aa275c00b793a0bf
Main PID: 56019 (snort3)
Tasks: 2 (limit: 4541)
CPU: 1.765s
CGroup: /system.slice/snort3.service
mq56019 /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort -D -i ens33 -m 0x1b -u snort -g snort
Jun 24 12:33:05 Lepard snort[56019]: any: 8
Jun 24 12:33:05 Lepard snort[56019]: to_server: 69
Jun 24 12:33:05 Lepard snort[56019]: to_client: 48
Jun 24 12:33:05 Lepard snort[56019]: --------------------------------------------------
Jun 24 12:33:05 Lepard snort[56019]: search engine (ac_bnfa)
Jun 24 12:33:05 Lepard snort[56019]: instances: 334
Jun 24 12:33:05 Lepard snort[56019]: patterns: 10779
Jun 24 12:33:05 Lepard snort[56019]: pattern chars: 175202
Jun 24 12:33:05 Lepard snort[56019]: num states: 123205
Jun 24 12:33:05 Lepard snort[56019]: num match states: 10502
8. Snort IDS Logging
8.1. Configure Snort JSON logging
# vi /usr/local/snort/etc/snort/snort.lua
Per line 261 -- 7. Add alert_json at the end of the configure outputs section
---------------------------------------------------------------------------
-- 7. configure outputs
---------------------------------------------------------------------------
-- event logging
-- you can enable with defaults from the command line with -A <alert_type>
-- uncomment below to set non-default configs
--alert_csv = { }
--alert_fast = { }
--alert_full = { }
--alert_sfsocket = { }
--alert_syslog = { }
--unified2 = { }
-- packet logging
-- you can enable with defaults from the command line with -L <log_type>
--log_codecs = { }
--log_hext = { }
--log_pcap = { }
-- additional logs
--packet_capture = { }
--file_log = { }
alert_json =
{
file = true,
limit = 50,
fields = 'timestamp msg pkt_num proto pkt_gen pkt_len dir src_addr src_port dst_addr dst_port service rule priority class action b64_data'
}
8.2. Restart Snort
# systemctl restart snort3
8.3. Check log files
Ping command from a remote computer to the server, stored in the Snort alert_json.txt file.
# tail -f /var/log/snort/alert_json.txt
{ "timestamp" : "06/24-12:39:36.015799", "msg" : "Incoming ICMP", "pkt_num" : 2373, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:36.015860", "msg" : "Incoming ICMP", "pkt_num" : 2374, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:37.018717", "msg" : "Incoming ICMP", "pkt_num" : 2382, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:37.018717", "msg" : "Incoming ICMP", "pkt_num" : 2383, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:37.018765", "msg" : "Incoming ICMP", "pkt_num" : 2384, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:37.018830", "msg" : "Incoming ICMP", "pkt_num" : 2385, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:38.025393", "msg" : "Incoming ICMP", "pkt_num" : 2387, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:38.025394", "msg" : "Incoming ICMP", "pkt_num" : 2388, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:38.025551", "msg" : "Incoming ICMP", "pkt_num" : 2389, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:38.025761", "msg" : "Incoming ICMP", "pkt_num" : 2390, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
This completes the installation and configuration of Snort 3.