{"id":12573,"date":"2022-05-05T21:05:46","date_gmt":"2022-05-05T18:05:46","guid":{"rendered":"https:\/\/kifarunix.com\/?p=12573"},"modified":"2024-03-09T14:28:00","modified_gmt":"2024-03-09T11:28:00","slug":"install-and-configure-snort-3-on-rocky-linux","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/install-and-configure-snort-3-on-rocky-linux\/","title":{"rendered":"Install and Configure Snort 3 on Rocky Linux"},"content":{"rendered":"\n<p>In this tutorial, you will learn how to install and configure Snort 3 on Rocky Linux. <a href=\"https:\/\/www.snort.org\/snort3\" target=\"_blank\" rel=\"noreferrer noopener\">Snort<\/a> is a lightweight network intrusion detection system. It features rules-based logging and can perform content searching\/matching in addition to detecting a variety of other attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, and much more. Snort has a real-time alerting capability, with alerts being sent to syslog, a separate &#8220;alert&#8221; file, or even to a Windows computer via Samba.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Install and Configure Snort 3 on Rocky Linux<\/h2>\n\n\n\n<p>As of this writing, Rocky Linux default repositories do not provide Snort packages. As such, to install Snort 3 on Rocky Linux, then you need to build from the source.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Build and Install Snort 3 from Source Code<\/h3>\n\n\n\n<p>For a successful build and installation of Snort 3 on Rocky Linux, there are a number of build tools and dependencies that needs to be installed prior to the build process.<\/p>\n\n\n\n<p>Install EPEL and enable Powertools Repositories;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>dnf install epel-release<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>dnf config-manager --set-enabled powertools<\/code><\/pre>\n\n\n\n<p>Next, install required build tools and libraries;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>dnf -y install bison flex libtool nghttp2 libnghttp2-devel \\\nlibpcap-devel pcre-devel openssl-devel libdnet-devel \\\nlibtirpc-devel git gcc-c++ libunwind-devel cmake hwloc-devel \\\nluajit-devel xz-devel libnfnetlink-devel libmnl-devel \\\nlibnetfilter_queue-devel uuid-devel libsafec-devel<\/code><\/pre>\n\n\n\n<p>Download and install latest version of the Snort&nbsp;DAQ&nbsp;(<em>Data Acquisition<\/em>&nbsp;library). DAQ is not available on the default Ubuntu repos and hence, you need to build and install it from the source;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>mkdir snort-source-files &amp;&amp; cd snort-source-files<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\ngit clone https:\/\/github.com\/snort3\/libdaq.git\ncd libdaq\n.\/bootstrap\n.\/configure\nmake\nmake install\n<\/code><\/pre>\n\n\n\n<p>Download and install <a href=\"https:\/\/github.com\/gperftools\/gperftools\/releases\" target=\"_blank\" rel=\"noreferrer noopener\">google\u2019s thread-caching malloc, Tcmalloc, a memory allocator<\/a> optimized for high concurrency situations which will provide better speed for the trade-off of higher memory usage. This is an optional dependency but highly recommended.<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>cd ..\/\nwget https:\/\/github.com\/gperftools\/gperftools\/releases\/download\/gperftools-2.9.1\/gperftools-2.9.1.tar.gz\ntar xzf gperftools-2.9.1.tar.gz\ncd gperftools-2.9.1\/\n.\/configure\nmake\nmake install\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Install Snort 3 on Rocky Linux from Source Code<\/h4>\n\n\n\n<p>Now that we have all required dependencies in place, download and install Snort 3 on Rocky Linux;<\/p>\n\n\n\n<p>From the <a href=\"https:\/\/github.com\/snort3\/snort3\/releases\" target=\"_blank\" rel=\"noreferrer noopener\">releases page<\/a>, get the latest release version of Snort tarball and download it. The command below downloads Snort 3.1.28.0 which is the current latest release as of this writing.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd ..\/\nwget https:\/\/github.com\/snort3\/snort3\/archive\/refs\/tags\/3.1.28.0.tar.gz<\/code><\/pre>\n\n\n\n<p>Extract and navigate to Snort 3 source directory, compile and install it;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tar xzf 3.1.28.0.tar.gz<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>cd snort3-3.1.28.0<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>.\/configure_cmake.sh --prefix=\/usr\/local --enable-tcmalloc<\/code><\/pre>\n\n\n\n<p>Sample build summary.<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>...\n-------------------------------------------------------\nsnort version 3.1.28.0\n\nInstall options:\n    prefix:     \/usr\/local\n    includes:   \/usr\/local\/include\/snort\n    plugins:    \/usr\/local\/lib64\/snort\n\nCompiler options:\n    CC:             \/usr\/bin\/cc\n    CXX:            \/usr\/bin\/c++\n    CFLAGS:            -fvisibility=hidden   -DNDEBUG -g -ggdb  -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-free  -O2 -g -DNDEBUG\n    CXXFLAGS:          -fvisibility=hidden   -DNDEBUG -g -ggdb  -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-free  -O2 -g -DNDEBUG\n    EXE_LDFLAGS:        \n    MODULE_LDFLAGS:     \n\nFeature options:\n    DAQ Modules:    Static ()\n    libatomic:      System-provided\n    Flatbuffers:    OFF\n    Hyperscan:      OFF\n    ICONV:          ON\n    Libunwind:      ON\n    LZMA:           ON\n    RPC DB:         Built-in\n    SafeC:          OFF\n    TCMalloc:       ON\n    JEMalloc:       OFF\n    UUID:           OFF\n-------------------------------------------------------\n\n-- Configuring done\n-- Generating done\n-- Build files have been written to: \/root\/snort-source-files\/snort3-3.1.28.0\/build\n<\/code><\/pre>\n\n\n\n<p>Navigate to the build directory and compile and install Snort 3 on Rocky Linux;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd build\nexport PKG_CONFIG_PATH=$PKG_CONFIG_PATH:\/usr\/local\/lib64\/pkgconfig:\/usr\/local\/lib\/pkgconfig\nmake\nmake install<\/code><\/pre>\n\n\n\n<p>Once the installation completes, update shared libraries;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ln -s \/usr\/local\/lib\/libtcmalloc.so.4 \/lib\/<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>ln -s \/usr\/local\/lib\/libdaq.so.3 \/lib\/<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>ldconfig<\/code><\/pre>\n\n\n\n<p>Verify Snort 3 Installation by checking the version;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>snort -V<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\n\n   ,,_     -*> Snort++ <*-\n  o\"  )~   Version 3.1.28.0\n   ''''    By Martin Roesch &#038; The Snort Team\n           http:\/\/snort.org\/contact#team\n           Copyright (C) 2014-2022 Cisco and\/or its affiliates. All rights reserved.\n           Copyright (C) 1998-2013 Sourcefire, Inc., et al.\n           Using DAQ version 3.0.7\n           Using LuaJIT version 2.1.0-beta3\n           Using OpenSSL 1.1.1k  FIPS 25 Mar 2021\n           Using libpcap version 1.9.1 (with TPACKET_V3)\n           Using PCRE version 8.42 2018-03-20\n           Using ZLIB version 1.2.11\n           Using LZMA version 5.2.4\n<\/code><\/pre>\n\n\n\n<p>The above confirms that Snort 3 installation is successful and is working fine.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Obtaining Snort Command Line Help<\/h3>\n\n\n\n<p>To obtain Snort command line help, simply execute either of the commands below and check the difference;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>snort --help<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>snort -?<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>Snort has several options to get more help:\n\n-? list command line options (same as --help)\n--help this overview of help\n--help-commands [&lt;module prefix&gt;] output matching commands\n--help-config [&lt;module prefix&gt;] output matching config options\n--help-counts [&lt;module prefix&gt;] output matching peg counts\n--help-limits print the int upper bounds denoted by max*\n--help-module &lt;module&gt; output description of given module\n--help-modules list all available modules with brief help\n--help-modules-json dump description of all available modules in JSON format\n--help-plugins list all available plugins with brief help\n--help-options [&lt;option prefix&gt;] output matching command line options\n--help-signals dump available control signals\n--list-buffers output available inspection buffers\n--list-builtin [&lt;module prefix&gt;] output matching builtin rules\n--list-gids [&lt;module prefix&gt;] output matching generators\n--list-modules [&lt;module type&gt;] list all known modules\n--list-plugins list all known modules\n--show-plugins list module and plugin versions\n\n--help* and --list* options preempt other processing so should be last on the\ncommand line since any following options are ignored.  To ensure options like\n--markup and --plugin-path take effect, place them ahead of the help or list\noptions.\n\nOptions that filter output based on a matching prefix, such as --help-config\nwon't output anything if there is no match.  If no prefix is given, everything\nmatches.\n\nReport bugs to bugs@snort.org.\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Configuring Snort 3 on Rocky Linux<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Configure Network Interface Cards<\/h4>\n\n\n\n<p>First off, put the interface on which Snort is listening for network traffic on <code>promiscuous<\/code> mode so that it can be able to see all of the network traffic sent to it rather than seeing only the traffic originating from within the Snort 3 server alone.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ip link set dev enp0s8 promisc on<\/code><\/pre>\n\n\n\n<p>Verify;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ip add sh enp0s8<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>3: enp0s8: &lt;BROADCAST,MULTICAST,<strong>PROMISC<\/strong>,UP,LOWER_UP&gt; mtu 1500 qdisc fq_codel state UP group default qlen 1000\n    link\/ether 08:00:27:84:be:8b brd ff:ff:ff:ff:ff:ff\n    inet 192.168.60.22\/24 metric 100 brd 192.168.60.255 scope global dynamic enp0s8\n       valid_lft 377sec preferred_lft 377sec\n    inet6 fe80::a00:27ff:fe84:be8b\/64 scope link \n       valid_lft forever preferred_lft forever<\/code><\/pre>\n\n\n\n<p>Disable Interface Offloading to prevent Snort from truncating large packets larger than 1518 bytes. You can check if this feature is enabled;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ethtool -k enp0s8 | grep receive-offload<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>generic-receive-offload: on\nlarge-receive-offload: off &#91;fixed]<\/code><\/pre>\n\n\n\n<p>GRO is enabled while LRO is fixed and hence cannot be changed.<\/p>\n\n\n\n<p>Then disable;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ethtool -K enp0s8 gro off lro off<\/code><\/pre>\n\n\n\n<p>The two NIC changes are temporary. To ensure the changes persists across system reboot, create and enable a systemd service unit to implement the changes;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\ncat > \/etc\/systemd\/system\/snort3-nic.service << 'EOL'\n[Unit]\nDescription=Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot\nAfter=network.target\n\n[Service]\nType=oneshot\nExecStart=\/usr\/sbin\/ip link set dev enp0s8 promisc on\nExecStart=\/usr\/sbin\/ethtool -K enp0s8 gro off lro off\nTimeoutStartSec=0\nRemainAfterExit=yes\n\n[Install]\nWantedBy=default.target\nEOL\n<\/code><\/pre>\n\n\n\n<p>Reload systemd configuration settings;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl daemon-reload<\/code><\/pre>\n\n\n\n<p>Start and enable the service on boot;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl enable --now snort3-nic.service<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Install Snort 3 Rulesets on Rocky Linux<\/h4>\n\n\n\n<p>Rulesets is the main artery for Snorts&nbsp;intrusion detection engine. There are three types of Snort Rules:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Community Rules<\/li>\n\n\n\n<li>Registered Rules<\/li>\n\n\n\n<li>Subscriber Rules<\/li>\n<\/ul>\n\n\n\n<p>In this tutorial, we will install the community Snort rules;<\/p>\n\n\n\n<p>Create Snort Rules directory. In the <strong><code>\/usr\/local\/etc\/snort\/snort_defaults.lua<\/code><\/strong> config file, the default rules path (RULE_PATH), is defined as <code><strong>\/usr\/local\/etc\/rules<\/strong><\/code>.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mkdir \/usr\/local\/etc\/rules<\/code><\/pre>\n\n\n\n<p>Download Snort 3 community rules from <a href=\"https:\/\/www.snort.org\/downloads\/#snort-3.0\" target=\"_blank\" rel=\"noreferrer noopener\">Snort 3 downloads page<\/a>;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wget -qO- \\\nhttps:\/\/www.snort.org\/downloads\/community\/snort3-community-rules.tar.gz \\\n| tar xz -C \/usr\/local\/etc\/rules\/<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>ls -1 \/usr\/local\/etc\/rules\/snort3-community-rules\/<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>AUTHORS\nLICENSE\nsid-msg.map\nsnort3-community.rules\nVRT-License.txt<\/code><\/pre>\n\n\n\n<p>Now that we have the rules to get us started in place, you need to configure Snort 3.<\/p>\n\n\n\n<p>Open the main configuration file for editing;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim \/usr\/local\/etc\/snort\/snort.lua<\/code><\/pre>\n\n\n\n<p>Set the networks to protect against attacks as the value for the <code><strong>HOME_NET<\/strong><\/code> variable. This can be a single IP address, subnets... For simplicity, i just set this to the subnet of Snort 3 interface. The <strong><code>EXTERNAL_NET<\/code><\/strong> is anything other than our HOME_NET;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>...\n-- HOME_NET and EXTERNAL_NET must be set now\n-- setup the network addresses you are protecting\nHOME_NET = '192.168.60.22\/32'\n\n-- set up the external network addresses.\n-- (leave as \"any\" in most situations)\n-- EXTERNAL_NET = 'any'\nEXTERNAL_NET = '!$HOME_NET'\n...\n<\/code><\/pre>\n\n\n\n<p>Save the changes and exit the file.<\/p>\n\n\n\n<p>Next, update the paths to your rules in the&nbsp;<code><strong>\/usr\/local\/etc\/snort\/snort.lua<\/strong><\/code>&nbsp;configuration file.<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>ips =\n{\n    -- use this to enable decoder and inspector alerts\n    --enable_builtin_rules = true,\n\n    -- use include for rules files; be sure to set your path\n    -- note that rules files can include other rules files\n    -- (see also related path vars at the top of snort_defaults.lua)\n    variables = default_variables,\n<strong>    rules = [[ \n    include $RULE_PATH\/snort3-community-rules\/snort3-community.rules\n    ]]<\/strong>\n}\n<\/code><\/pre>\n\n\n\n<p>Save and exit the configuration file.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Installing Snort OpenAppID<\/h3>\n\n\n\n<p>OpenAppID is an application layer plugin that enables Snort to detect various applications, &nbsp;Facebook, Netflix, Twitter, and Reddit, used in the network. Run the commands below download from <a href=\"https:\/\/www.snort.org\/downloads\/#snort-3.0\" target=\"_blank\" rel=\"noreferrer noopener\">Snort 3 downloads page<\/a> and install Snort OpenAppID;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wget https:\/\/www.snort.org\/downloads\/openappid\/23020 -O OpenAppId-23020.tgz\ntar -xzvf OpenAppId-23020.tgz\ncp -R odp \/usr\/local\/lib\/<\/code><\/pre>\n\n\n\n<p>Next, edit the Snort 3 configuration file and define the location of the OpenAppID libraries;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim \/usr\/local\/etc\/snort\/snort.lua<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>appid =\n{\n    -- appid requires this to use appids in rules\n    --app_detector_dir = 'directory to load appid detectors from'\n    <strong>app_detector_dir = '\/usr\/local\/lib',<\/strong>\n    <code><strong>log_stats = true,<\/strong><\/code>\n}<\/code><\/pre>\n\n\n\n<p>Save and exit the configuration file.<\/p>\n\n\n\n<p>Create Snorts Log directory;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>mkdir \/var\/log\/snort<\/code><\/pre>\n\n\n\n<p>Next, run syntax checking;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>snort -c \/usr\/local\/etc\/snort\/snort.lua<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\n--------------------------------------------------\no\")~   Snort++ 3.1.28.0\n--------------------------------------------------\nLoading \/usr\/local\/etc\/snort\/snort.lua:\nLoading snort_defaults.lua:\nFinished snort_defaults.lua:\nLoading file_magic.lua:\nFinished file_magic.lua:\n\tssh\n\thost_cache\n\tpop\n\tso_proxy\n\tstream_tcp\n\tmms\n\tsmtp\n\tgtp_inspect\n\tpackets\n\tdce_http_proxy\n\tstream_icmp\n\tnormalizer\n\tips\n\tbinder\n\twizard\n\tappid\n\tfile_id\n\tstream_udp\n\thttp2_inspect\n\thttp_inspect\n\tftp_data\n\tsearch_engine\n\tftp_server\n\tport_scan\n\tdce_http_server\n\tdce_smb\n\tdce_tcp\n\tnetflow\n\tiec104\n\tcip\n\ttelnet\n\tssl\n\tsip\n\trpc_decode\n\tmodbus\n\thost_tracker\n\tstream_user\n\tstream_ip\n\tback_orifice\n\ttrace\n\tclassifications\n\tdnp3\n\tactive\n\tprocess\n\tftp_client\n\tdecode\n\tdaq\n\talerts\n\tstream\n\tnetwork\n\treferences\n\tarp_spoof\n\toutput\n\thosts\n\tdns\n\tdce_udp\n\timap\n\tfile_policy\n\ts7commplus\n\tstream_file\nFinished \/usr\/local\/etc\/snort\/snort.lua:\n--------------------------------------------------\npcap DAQ configured to passive.\n\nSnort successfully validated the configuration (with 0 warnings).\no\")~   Snort exiting\n<\/code><\/pre>\n\n\n\n<p>Create Custom local rules for the purposes of testing our Snort setup.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim \/usr\/local\/etc\/rules\/local.rules<\/code><\/pre>\n\n\n\n<p>Create a rule to detect ping tests;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>alert icmp any any -&gt; $HOME_NET any (msg:\"ICMP connection test\"; sid:1000001; rev:1;)<\/code><\/pre>\n\n\n\n<p>Save and exit the local rules file. Check the syntax;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>snort -c \/usr\/local\/etc\/snort\/snort.lua -R \/usr\/local\/etc\/rules\/local.rules<\/code><\/pre>\n\n\n\n<p>Next, run the test by executing the command below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>snort -c \/usr\/local\/etc\/snort\/snort.lua -R \/usr\/local\/etc\/rules\/local.rules -i enp0s8 -A alert_fast -s 65535 -k none<\/code><\/pre>\n\n\n\n<p>On another terminal, ping your Snort server.<\/p>\n\n\n\n<p>While the ping runs, you should see the alert lines written to standard output;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>...\n05\/05-13:57:05.549004 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-13:57:06.559196 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-13:57:07.579311 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-13:57:08.603201 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-13:57:09.627219 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-13:57:10.651640 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-13:57:11.679266 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-13:57:12.699300 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-13:57:13.723307 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n...\n<\/code><\/pre>\n\n\n\n<p>When cancelled, you should see Packet statistics;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>Packet Statistics\n--------------------------------------------------\ndaq\n                 received: 129\n                 analyzed: 119\n                  dropped: 6\n              outstanding: 10\n                    allow: 119\n                 rx_bytes: 15783\n--------------------------------------------------\ncodec\n                    total: 119         \t(100.000%)\n                      arp: 4           \t(  3.361%)\n                      eth: 119         \t(100.000%)\n                    icmp4: 68          \t( 57.143%)\n                     ipv4: 115         \t( 96.639%)\n                      tcp: 41          \t( 34.454%)\n                      udp: 6           \t(  5.042%)\n--------------------------------------------------\nModule Statistics\n--------------------------------------------------\nappid\n                  packets: 115\n        processed_packets: 115\n           total_sessions: 5\n       service_cache_adds: 4\n             bytes_in_use: 608\n             items_in_use: 4\n--------------------------------------------------\narp_spoof\n                  packets: 4\n--------------------------------------------------\nback_orifice\n                  packets: 6\n--------------------------------------------------\nbinder\n              raw_packets: 4\n                new_flows: 5\n                 inspects: 9\n--------------------------------------------------\ndetection\n                 analyzed: 119\n               hard_evals: 68\n             raw_searches: 24\n          cooked_searches: 2\n             pkt_searches: 26\n                   alerts: 34\n             total_alerts: 34\n                   logged: 34\n--------------------------------------------------\nnormalizer\n          test_tcp_ts_nop: 1\n--------------------------------------------------\npcre\n               pcre_rules: 178\n              pcre_native: 178\n--------------------------------------------------\nport_scan\n                  packets: 115\n                 trackers: 8\n--------------------------------------------------\nsearch_engine\n     non_qualified_events: 34\n         qualified_events: 34\n           searched_bytes: 5452\n--------------------------------------------------\nstream\n                    flows: 5\n--------------------------------------------------\nstream_icmp\n                 sessions: 1\n                      max: 1\n                  created: 1\n                 released: 1\n--------------------------------------------------\nstream_tcp\n                 sessions: 1\n                      max: 1\n                  created: 1\n                 released: 1\n             instantiated: 1\n                   setups: 1\n            data_trackers: 1\n              segs_queued: 21\n            segs_released: 21\n                segs_used: 21\n          rebuilt_packets: 2\n            rebuilt_bytes: 392\n          client_cleanups: 1\n          server_cleanups: 1\n        partial_fallbacks: 1\n                 max_segs: 17\n                max_bytes: 3196\n--------------------------------------------------\nstream_udp\n                 sessions: 3\n                      max: 3\n                  created: 3\n                 released: 3\n              total_bytes: 2541\n--------------------------------------------------\nwizard\n                tcp_scans: 17\n                udp_scans: 3\n               udp_misses: 3\n--------------------------------------------------\nAppid Statistics\n--------------------------------------------------\ndetected apps and services\n              Application: Services   Clients    Users      Payloads   Misc       Referred  \n                     dhcp: 2          0          0          0          0          0         \n                     icmp: 1          0          0          0          0          0         \n                  unknown: 1          0          0          0          0          0         \n--------------------------------------------------\nSummary Statistics\n--------------------------------------------------\nprocess\n                  signals: 1\n--------------------------------------------------\ntiming\n                  runtime: 00:00:50\n                  seconds: 50.745225\n                 pkts\/sec: 2\no\")~   Snort exiting\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"snort-logging\"><a href=\"#snort-logging\">Configure Snort 3 Logging<\/a><\/h4>\n\n\n\n<p>To write Snort 3 events to log files, you need to configure alert settings. There are different Snort logging options that are explained well in the <a href=\"https:\/\/snort-org-site.s3.amazonaws.com\/production\/release_files\/files\/000\/013\/583\/original\/snort_manual.html?X-Amz-Algorithm=AWS4-HMAC-SHA256&amp;X-Amz-Credential=AKIAIXACIED2SPMSC7GA%2F20200822%2Fus-east-1%2Fs3%2Faws4_request&amp;X-Amz-Date=20200822T085438Z&amp;X-Amz-Expires=3600&amp;X-Amz-SignedHeaders=host&amp;X-Amz-Signature=7a91dcc103afbbbac582f5211d6e679bc4ab762746d3eeca945dc82c6fbdaa2d#_logger_modules\" target=\"_blank\" rel=\"noreferrer noopener\">Snort 3 manual, Logger Modules section<\/a>. To output the event data to a file, in brief format (as defined in the command line above by option <code><strong>-A alert_type<\/strong><\/code>), open the <strong><code>snort.lua<\/code><\/strong> configuration and head over to the outputs section.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim \/usr\/local\/etc\/snort\/snort.lua<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>---------------------------------------------------------------------------\n-- 7. configure outputs\n---------------------------------------------------------------------------\n\n-- event logging\n-- you can enable with defaults from the command line with -A <alert_type>\n-- uncomment below to set non-default configs\n--alert_csv = { }\n<strong>alert_fast = { \n        file = true, \n        packet = false,\n        limit = 10,\n}<\/strong>\n--alert_full = { }\n--alert_sfsocket = { }\n--alert_syslog = { }\n--unified2 = { }<\/alert_type>\n<\/code><\/pre>\n\n\n\n<p>The setting will cause snort to write logs to <code><strong>alert_fast.txt<\/strong><\/code> file.<\/p>\n\n\n\n<p>Save and exit the configuration and run syntax checking.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>snort -c \/usr\/local\/etc\/snort\/snort.lua<\/code><\/pre>\n\n\n\n<p>Run the command again, this time, without the option, <code><strong>-A alert_fast<\/strong><\/code>, but with an option to specify the log directory, <code><strong>-l \/var\/log\/snort<\/strong><\/code>.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>snort -c \/usr\/local\/etc\/snort\/snort.lua -R \/usr\/local\/etc\/rules\/local.rules -i enp0s8 -s 65535 -k none -l \/var\/log\/snort\/<\/code><\/pre>\n\n\n\n<p>Run the ping test again.<\/p>\n\n\n\n<p>If you check on the logs directory, you should see an <code><strong>alert_fast.txt<\/strong><\/code> file created. You can tail this file;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>tail -f \/var\/log\/snort\/alert_fast.txt<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\n05\/05-14:01:33.468399 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-14:01:34.492480 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-14:01:35.516336 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-14:01:36.544332 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-14:01:37.564282 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-14:01:38.588384 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-14:01:39.612393 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-14:01:40.636332 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-14:01:41.664373 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-14:01:42.684480 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-14:01:43.708500 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-14:01:44.732387 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n05\/05-14:01:45.756329 [**] [1:1000001:1] \"ICMP connection test\" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.60.1 -> 192.168.60.22\n<\/code><\/pre>\n\n\n\n<p>You can include the local rules in snort.lua;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim \/usr\/local\/etc\/snort\/snort.lua<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>ips =\n{\n    -- use this to enable decoder and inspector alerts\n    --enable_builtin_rules = true,\n\n    -- use include for rules files; be sure to set your path\n    -- note that rules files can include other rules files\n    -- (see also related path vars at the top of snort_defaults.lua)\n    variables = default_variables,\n<strong>    rules = [[ \n    include $RULE_PATH\/snort3-community-rules\/snort3-community.rules\n    include $RULE_PATH\/local.rules\n    ]]<\/strong>\n}\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Running Snort as a Service<\/h3>\n\n\n\n<p>While it is possible to run Snort as a daemon in the background with command line option <code><strong>-D<\/strong><\/code>, it is also possible to create a systemd service unit for Snort.<\/p>\n\n\n\n<p>If you are going to run Snort as a service, it is prudent to run it a non privileged system user. Hence, create a non login system user account for Snort;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>useradd -r -s \/usr\/sbin\/nologin -M -c SNORT_IDS snort<\/code><\/pre>\n\n\n\n<p>Create a systemd service unit for Snort to be run as snort user. Adjust your interfaces accordingly.<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\ncat > \/etc\/systemd\/system\/snort3.service << EOL\n[Unit]\nDescription=Snort Daemon\nAfter=syslog.target network.target\n\n[Service]\nType=simple\nExecStart=\/usr\/local\/bin\/snort -c \/usr\/local\/etc\/snort\/snort.lua -s 65535 -k none -l \/var\/log\/snort -D -i enp0s8 -m 0x1b -u snort -g snort\nExecStop=\/bin\/kill -9 $MAINPID\n\n[Install]\nWantedBy=multi-user.target\nEOL\n<\/code><\/pre>\n\n\n\n<p>Reload systemd configs;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl daemon-reload<\/code><\/pre>\n\n\n\n<p>Set the ownership and permissions on the log file;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>chmod -R 5775 \/var\/log\/snort<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>chown -R snort:snort \/var\/log\/snort<\/code><\/pre>\n\n\n\n<p>Start and enable Snort to run on system boot. The service will run as root and then drop the privileges to Snort user created.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl enable --now snort3<\/code><\/pre>\n\n\n\n<p>Check the service to confirm if it is running;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl status snort3<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\n\u25cf snort3.service - Snort Daemon\n   Loaded: loaded (\/etc\/systemd\/system\/snort3.service; enabled; vendor preset: disabled)\n   Active: active (running) since Thu 2022-05-05 14:00:22 EDT; 4s ago\n Main PID: 60655 (snort)\n    Tasks: 2 (limit: 11256)\n   Memory: 218.3M\n   CGroup: \/system.slice\/snort3.service\n           \u2514\u250060655 \/usr\/local\/bin\/snort -c \/usr\/local\/etc\/snort\/snort.lua -s 65535 -k none -l \/var\/log\/snort -D -i enp0s8 -m 0x1b -u snort -g snort\n\nMay 05 14:00:22 localhost.localdomain systemd[1]: Started Snort Daemon.\n<\/code><\/pre>\n\n\n\n<p>That marks the end of our tutorial on how to install Snort 3 on Rocky Linux.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Reference<\/h3>\n\n\n\n<p><a href=\"https:\/\/snort-org-site.s3.amazonaws.com\/production\/document_files\/files\/000\/000\/251\/original\/Snort_3_on_Ubuntu.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&amp;X-Amz-Credential=AKIAIXACIED2SPMSC7GA%2F20200822%2Fus-east-1%2Fs3%2Faws4_request&amp;X-Amz-Date=20200822T082759Z&amp;X-Amz-Expires=172800&amp;X-Amz-SignedHeaders=host&amp;X-Amz-Signature=c15c92f1c8ef8e464c90718a179a25ee2fa5c3527d55084cb46c58ecaec7b327\" target=\"_blank\" rel=\"noreferrer noopener\">Snort 3 Installation<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Further Reading<\/h3>\n\n\n\n<p><a href=\"https:\/\/www.snort.org\/downloads\/snortplus\/snort_manual.html\" target=\"_blank\" rel=\"noreferrer noopener\">Snort 3 User Manual<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Related Tutorials<\/h3>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/install-and-configure-snort-3-on-ubuntu\/\" target=\"_blank\" rel=\"noreferrer noopener\">Install and Configure Snort 3 on Ubuntu 22.04<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/install-and-setup-suricata-on-rocky-linux\/\">Install and Setup Suricata on Rocky Linux<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this tutorial, you will learn how to install and configure Snort 3 on Rocky Linux. Snort is a lightweight network intrusion detection system. It<\/p>\n","protected":false},"author":1,"featured_media":12542,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[34,121],"tags":[319,5036,5034,320,1926,5035,5037,5038],"class_list":["post-12573","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-howtos","tag-ids","tag-install-snort-3-on-rocky-linux","tag-install-snort-rocky-linux","tag-ips","tag-snort-3","tag-snort-3-install-rocky-linux","tag-snort-ids","tag-snort-ips","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/12573"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=12573"}],"version-history":[{"count":9,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/12573\/revisions"}],"predecessor-version":[{"id":20543,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/12573\/revisions\/20543"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/12542"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=12573"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=12573"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=12573"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}