Click here for "Safe Air Conditioner Repair and Proper Freon Recovery".

OpenSUSE15.3 ; Install SNORT

1.SNORT Install

Snort is a network-type IDS (intrusion detection system). It captures packets flowing on the network and detects suspicious packets.
The source file is used directly from

1.1 advance preparation

Install the required libraries

1.2 SNORT and daq download and installation

①Download and install daq

Update the generated configuration file in the system with "autoreconf".

②SNORT installation
If you do not want to use the Lua programming interface, add the option "-disable-open-appid".

Create a soft link between "/usr/sbin/snort" and the binary file "/usr/local/bin/snort".

1.3 Create users and groups

1.4 Directories, file creation, permissions

white_list.rules, black_list.rules , local.rules  creation

Copy all "*.conf" files and "*.map" files from the Snort source to the Snort system folder.

1.5 Download the rules

①Download the community rules.
Go to the root/ folder, unzip and copy the rules to the correct system directory

Use the "sed" command to comment out the unnecessary lines in "snort.conf".
If you do not want to install anything other than the community rules, you can use this command to comment out the rest

②Install the Oinkmaster script
Download the Oinkmaster script.

Copy to the "/usr/local/bin/" folder (the same folder where the "snort" binary was placed after the Snort source was compiled).
Create a soft link to the "/usr/sbin/" directory.

Edit oinkmaster.conf
To update the rules, enter the URL containing the Oinkcode in "/etc/snort/etc/oinkmaster.conf".
Enter your original oinkcode, which you can get for free by registering on the "" page.
Make sure the path "tmpdir = /tmp/" is valid.

Create a script to update the Snort rules

Download snort rules

1.6 Editing the Snort configuration file

1.7Check your settings

①Check the configuration file.

If normal, the following message will appear

ERROR: /etc/snort/rules/snort.conf(292) => Unable to open the IIS Unicode Map file '/etc/snort/rules/'.
If you get an error like the above, copy the file in question as follows
Also, if you get the error "/etc/snort/rules/snort.conf(325) => Invalid keyword '}'".
relevant line
decompress_swf { deflate lzma } \
# decompress_swf { deflate lzma } \   Comment out

②Preparing for operational testing

Open "local.rules" and enter the line "alert icmp any any -> $HOME_NET any (msg: "ICMP test"; sid:10000001; rev:001;)" for testing.

③Test Snort in a terminal
Use the "ip addr" command to check the network interface first, and then start Snort from the console or terminal.

When pinging this server from a PC in the same network, the following message is displayed in the server's console

1.8Checking the log file

1.9 Creating "snort.service"

Set the network interface "eth0" to the following according to your environment.

Finally, start, stop and status of Snort service.