業務用エアコン関連の技術情報、エラーコード、環境問題対策に関する別サイト「エアコンの安全な修理･適切なフロン回収」

openSUSE Tumbleweed :　SNORT3 インストール

2026.06.24

SNORT3

 Snortは、IPネットワーク上でリアルタイムのトラフィック分析とパケットロギングを実行できるオープンソースのネットワーク侵入検知システムです。

「プロトコル分析」「コンテンツ検索」「マッチング」を実行でき、「バッファオーバーフロー」「ステルスポートスキャン」「CGI攻撃」「SMBプローブ」「OSフィンガープリント試行」「セマンティックURL攻撃」「サーバメッセージブロック探査」など、さまざまな攻撃検出に使用できます。

1.事前準備

1.1 必須パッケージのインストール

1.openssl-develのインストール

# zypper -n install openssl-devel

2.cmakeのインストール

# zypper -n  install cmake

バージョン確認
# cmake --version
cmake version 4.2.3

CMake suite maintained and supported by Kitware (kitware.com/cmake).
1.2 その他必要なパッケージのインストール
# zypper install libpcap-devel pcre2-devel hwloc-devel  zlib-devel luajit-devel pkgconf libmnl-devel libunwind-devel

# zypper install libnfnetlink-devel gcc-c++ make
1.3 LibDAQのインストール
# zypper install git
# git clone https://github.com/snort3/libdaq.git

Cloning into 'libdaq'...
remote: Enumerating objects: 2691, done.
remote: Counting objects: 100% (313/313), done.
remote: Compressing objects: 100% (125/125), done.
remote: Total 2691 (delta 240), reused 212 (delta 188), pack-reused 2378 (from 2)
Receiving objects: 100% (2691/2691), 1.26 MiB | 15.34 MiB/s, done.
Resolving deltas: 100% (1932/1932), done.

# cd libdaq/
# zypper install autoconf
# zypper install automake
# zypper install libtool
# ./bootstrap

# ./configure -disable-dependency-tracking
# make && make install

# ln -s /usr/local/lib/libdaq.so.3 /lib/

共有ライブラリの追加
# ldconfig

ライブラリの確認
# ldconfig -p|grep daq
        libdaq.so.3 (libc6,x86-64) => /usr/local/lib/libdaq.so.3
        libdaq.so.3 (libc6,x86-64) => /lib/libdaq.so.3
        libdaq.so (libc6,x86-64) => /usr/local/lib/libdaq.so

1.4 オプションパッケージのインストール

1.LZMAとUUIDのインストール

# zypper install xz-devel libuuid-devel

2.Tcmallocのインストール

# zypper install gperftools-devel

2. Snort3のインストール

# wget https://www.rpmfind.net/linux/opensuse/tumbleweed/repo/oss/x86_64/libdnet-devel-1.18.2-1.1.x86_64.rpm
# zypper install libdnet-devel-1.18.2-1.1.x86_64.rpm

# cd
# git clone https://github.com/snort3/snort3.git
# cd snort3/
# export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:$PKG_CONFIG_PATH
# export PKG_CONFIG_PATH=/usr/local/lib64/pkgconfig:$PKG_CONFIG_PATH
# export CFLAGS="-O3"
# export CXXFLAGS="-O3 -fno-rtti"

# zypper install flex

# ./configure_cmake.sh --prefix=/usr/local/snort --enable-tcmalloc
-------------------------------------------------------

-- Configuring done
-- Generating done
-- Build files have been written to: /root/snort3/build

# cd build/
# pwd
/root/snort3/build

# make -j$(nproc)
# make -j$(nproc) install

バージョン確認

# /usr/local/snort/bin/snort -V

   ,,_     -*> Snort++ <*-
  o"  )~   Version 3.12.2.0
   ''''    By Martin Roesch & The Snort Team
           http://snort.org/contact#team
           Copyright (C) 2014-2026 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using DAQ version 3.0.27
           Using libpcap version 1.10.6 (64-bit time_t, with TPACKET_V3)
           Using LuaJIT version 2.1.1756211046
           Using LZMA version 5.8.3
           Using OpenSSL 3.5.3 16 Sep 2025
           Using PCRE2 version 10.47 2025-10-21
           Using ZLIB version 1.3.1

テスト実行

# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua

--------------------------------------------------
search engine (ac_bnfa)
                instances: 2
                 patterns: 438
            pattern chars: 2602
               num states: 1832
         num match states: 392
             memory scale: KB
             total memory: 71.2812
           pattern memory: 19.6484
        match list memory: 28.4375
        transition memory: 22.9453
appid: MaxRss diff: 3584
appid: patterns loaded: 300
--------------------------------------------------
pcap DAQ configured to passive.

Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting

3. ネットワークインターフェースの設定

ネットワーク インタフェースを確認

# ip a

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:0c:29:2e:42:73 brd ff:ff:ff:ff:ff:ff
    altname enp2s1
    altname enx000c292e4273
    inet 192.168.11.83/24 brd 192.168.11.255 scope global noprefixroute ens33
       valid_lft forever preferred_lft forever

ネットワーク・インターフェース名はens33である

ネットワークインターフェイスをプロミスキャスモードに設定する。こうすることで、ネットワークデバイスはすべてのネットワークパケットをキャプチャし、検査できるようになる。

# ip link set dev ens33 promisc on

設定を確認

# ip a | grep ens33 | grep mtu

2: ens33: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000

ネットワーク・インタフェースのオフロード・ステータスを確認。インタフェースのネッ トワーク・トラフィックを監視する必要がある場合は、オフロードを無効にする必要がある

現在の状況を確認

# ethtool -k ens33 | grep receive-offload
generic-receive-offload: on
large-receive-offload: off [fixed]

generic-receive-offload: onになっているのでoffにする

# ethtool -K ens33 gro off

現在の状況を再度確認

# ethtool -k ens33 | grep receive-offload
generic-receive-offload: off
large-receive-offload: off [fixed]

LROとGROのオフロードステータスはオフ状態になっている

Snortネットワークインターフェース用のsystemdサービスを新規作成する

# vi /etc/systemd/system/snort3-nic.service

下記内容を記述
[Unit]
Description=Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/sbin/ip link set dev ens33 promisc on
ExecStart=/usr/sbin/ethtool -K ens33 gro off lro off
TimeoutStartSec=0
RemainAfterExit=yes

[Install]
WantedBy=default.target

変更を適用する

# systemctl daemon-reload
# systemctl enable snort3-nic.service
Created symlink /etc/systemd/system/default.target.wants/snort3-nic.service → /etc/systemd/system/snort3-nic.service.
# systemctl start snort3-nic.service

4. Snortコミュニティ・ルールセットを追加

1.Snortルール用のフォルダを作成し、SnortのWebサイトからコミュニティルールセットをダウンロードし、所定のルールディレクトリーに配置

# mkdir /usr/local/snort/etc/snort/rules
# wget -qO- https://www.snort.org/downloads/community/snort3-community-rules.tar.gz | tar xz -C /usr/local/snort/etc/snort/rules/

2.Snortメイン設定ファイルを編集

# vi /usr/local/snort/etc/snort/snort.lua

24行目変更
HOME_NET = '192.168.11.0/24'

28行目変更
EXTERNAL_NET = '!$HOME_NET'

188行目当たりのips項目の最後に追加
ips =
{
    -- use this to enable decoder and inspector alerts
    -- enable_builtin_rules = true,
    

    -- use include for rules files; be sure to set your path
    -- note that rules files can include other rules files
    -- (see also related path vars at the top of snort_defaults.lua)

    variables = default_variables,
    rules = [[
      include /usr/local/snort/etc/snort/rules/snort3-community-rules/snort3-community.rules
    ]]
}

3.Snortのメインコンフィグレーションの変更をテスト

# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua

--------------------------------------------------
pcap DAQ configured to passive.

Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting

5. カスタムルールの追加

5.1 Snort rulesディレクトリにファイルを作成する

# touch /usr/local/snort/etc/snort/rules/local.rules

# vi /usr/local/snort/etc/snort/rules/local.rules
下記内容を記述
alert icmp any any -> $HOME_NET any (msg:"Incoming ICMP"; sid:1000001; rev:1;)

5.2.Snortメイン設定ファイルを編集
カスタム ルール ファイル ディレクトリをメイン構成に含めるためSnortメイン設定ファイルを編集

# vi /usr/local/snort/etc/snort/snort.lua

199行目当たりに追加
ips =
{
    -- use this to enable decoder and inspector alerts
    --enable_builtin_rules = true,

    -- use include for rules files; be sure to set your path
    -- note that rules files can include other rules files
    -- (see also related path vars at the top of snort_defaults.lua)

    variables = default_variables,
    rules = [[
      include /usr/local/snort/etc/snort/rules/local.rules
      include /usr/local/snort/etc/snort/rules/snort3-community-rules/snort3-community.rules
    ]]
}

5.3. Snortのメインコンフィグレーションの変更をテスト

# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua

--------------------------------------------------
pcap DAQ configured to passive.

Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting

6. OpenAppIDエクステンションをインストール

OpenAppIDエクステンションをインストールすると、Snortはアプリケーションレイヤーレベルでネットワーク脅威を検出できるようになります

6.1. OpenAppIDエクステンションダウンロードと展開

# wget https://www.snort.org/downloads/openappid/33380 -O OpenAppId-33380.tgz
# tar -xzvf  OpenAppId-33380.tgz

6.2. 解凍したフォルダ(odp)を以下のディレクトリにコピー

# cp -R odp /usr/local/lib/

6.3. Snortメイン設定ファイルを編集し、OpenAppIDフォルダの場所を定義

# vi /usr/local/snort/etc/snort/snort.lua

100行目当たりのappidセクションに追加
appid =
{
    -- appid requires this to use appids in rules
    --app_detector_dir = 'directory to load appid detectors from'
    app_detector_dir = '/usr/local/lib',
    log_stats = true,

}
appid_listener =
{
    json_logging = true,
    file = "/var/log/snort/appid-output.log",
}

--[[
reputation =

6.4. Snortのメインコンフィグレーションの変更をテスト

# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua

--------------------------------------------------
pcap DAQ configured to passive.

Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting

すべてのコンフィギュレーションが正しくセットアップされていることを確認する

# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -R /usr/local/snort/etc/snort/rules/local.rules -i ens33 -A alert_fast -s 65535 -k none

リモートコンピュータからサーバのIPアドレスにpingコマンドを送信します。これにより、ホストサーバーのコンソールウィンドウにアラートログが表示されます

pcap DAQ configured to passive.
Commencing packet processing
Retry queue interval is: 200 ms
++ [0] ens33
06/24-12:27:37.209896 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:37.209896 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:37.209944 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:37.210017 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:38.212117 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:38.212117 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:38.212151 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:38.212214 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:39.219320 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:39.219320 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:39.219355 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:39.219417 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:40.230373 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:40.230373 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
06/24-12:27:40.230408 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
06/24-12:27:40.230475 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14

7. Snort systemdサービスの設定

7.1. Snortサービス用のユーザの作成

# useradd -r -s /usr/sbin/nologin -M snort

7.2. ログフォルダの作成とパーミッションの設定
Snortログ用のディレクトリフォルダを作成し、フォルダパーミッションを設定

# mkdir /var/log/snort
# chmod -R 5775 /var/log/snort
# chown -R snort:snort /var/log/snort

7.3. Systemdサービスファイルの作成

# touch /etc/systemd/system/snort3.service

# vi /etc/systemd/system/snort3.service
下記内容を記述
[Unit]
Description=Snort3 IDS Daemon Service
After=syslog.target network.target

[Service]
Type=simple
ExecStart=/usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort -D -i ens33 -m 0x1b -u snort -g snort
ExecStop=/bin/kill -9 $MAINPID

[Install]
WantedBy=multi-user.target

Snortサービスをリロードして有効にする

# systemctl daemon-reload
# systemctl enable --now snort3
Created symlink '/etc/systemd/system/multi-user.target.wants/snort3.service' → '/etc/systemd/system/snort3.service'.

Snortサービスを開始

# systemctl start snort3

ステータスを確認

# systemctl status snort3

● snort3.service - Snort3 IDS Daemon Service
     Loaded: loaded (/etc/systemd/system/snort3.service; enabled; preset: disabled)
     Active: active (running) since Wed 2026-06-24 12:33:05 JST; 1min 33s ago
 Invocation: 50ac8606b9c442d7aa275c00b793a0bf
   Main PID: 56019 (snort3)
      Tasks: 2 (limit: 4541)
        CPU: 1.765s
     CGroup: /system.slice/snort3.service
             mq56019 /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort -D -i ens33 -m 0x1b -u snort -g snort

Jun 24 12:33:05 Lepard snort[56019]:                       any: 8
Jun 24 12:33:05 Lepard snort[56019]:                 to_server: 69
Jun 24 12:33:05 Lepard snort[56019]:                 to_client: 48
Jun 24 12:33:05 Lepard snort[56019]: --------------------------------------------------
Jun 24 12:33:05 Lepard snort[56019]: search engine (ac_bnfa)
Jun 24 12:33:05 Lepard snort[56019]:                 instances: 334
Jun 24 12:33:05 Lepard snort[56019]:                  patterns: 10779
Jun 24 12:33:05 Lepard snort[56019]:             pattern chars: 175202
Jun 24 12:33:05 Lepard snort[56019]:                num states: 123205
Jun 24 12:33:05 Lepard snort[56019]:          num match states: 10502

8. Snort IDS ロギング

8.1. Snort JSONロギングの設定

# vi /usr/local/snort/etc/snort/snort.lua

261行目当たりの-- 7. configure outputsセクションの最後にalert_jsonを追加
---------------------------------------------------------------------------
-- 7. configure outputs
---------------------------------------------------------------------------

-- event logging
-- you can enable with defaults from the command line with -A <alert_type>
-- uncomment below to set non-default configs
--alert_csv = { }
--alert_fast = { }
--alert_full = { }
--alert_sfsocket = { }
--alert_syslog = { }
--unified2 = { }

-- packet logging
-- you can enable with defaults from the command line with -L <log_type>
--log_codecs = { }
--log_hext = { }
--log_pcap = { }

-- additional logs
--packet_capture = { }
--file_log = { }
alert_json =
{
    file = true,
    limit = 50,
    fields = 'timestamp msg pkt_num proto pkt_gen pkt_len dir src_addr src_port dst_addr dst_port service rule priority class action b64_data'
}

8.2. Snortを再起動

# systemctl restart snort3

8.3. ログファイルを確認
リモートコンピュータからサーバにpingコマンドを実行する。Snort alert_json.txtファイルに保存されます。

# tail -f /var/log/snort/alert_json.txt

{ "timestamp" : "06/24-12:39:36.015799", "msg" : "Incoming ICMP", "pkt_num" : 2373, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:36.015860", "msg" : "Incoming ICMP", "pkt_num" : 2374, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:37.018717", "msg" : "Incoming ICMP", "pkt_num" : 2382, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:37.018717", "msg" : "Incoming ICMP", "pkt_num" : 2383, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:37.018765", "msg" : "Incoming ICMP", "pkt_num" : 2384, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:37.018830", "msg" : "Incoming ICMP", "pkt_num" : 2385, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:38.025393", "msg" : "Incoming ICMP", "pkt_num" : 2387, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:38.025394", "msg" : "Incoming ICMP", "pkt_num" : 2388, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:38.025551", "msg" : "Incoming ICMP", "pkt_num" : 2389, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "06/24-12:39:38.025761", "msg" : "Incoming ICMP", "pkt_num" : 2390, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }

以上でSnort 3のインストールと設定が完了

ページのトップへ