Snort IDS Deployment: Rules Configuration Guide

Hands-on Snort IDS deployment: Snort 3 install, NIC capture, rule writing and updates, alert log analysis. Build real-time network intrusion detection with open source.

Snort is the most widely used open-source network IDS. It matches traffic on a NIC against a rule set and flags port scans, exploit traffic, and malware C2 in real time. This write-up uses Snort 3: install, capture, rules, alerts.

Use Cases

This fit:

• Mid-size orgs that need low-cost network IDS
• Span/TAP off a gateway or core switch; north-south traffic
• Depth with firewall and WAF; cover application-layer blind spots
• Lab traffic analysis and attack-behavior replay

Prerequisites

• Linux (Ubuntu 22.04+ or CentOS 7+), at least 2 CPU cores, 4GB RAM
• One management NIC and one monitored NIC (or SPAN/port mirror)
• root

How It Works

Snort is a four-stage pipeline: capture → decode → detect → alert. DAQ (Data Acquisition) grabs packets; the engine walks the protocol stack; parsed results are matched against loaded rules; hits fire alert/block/drop. Snort 3 vs 2.x: real multithreading and a cleaner rule syntax. Detection throughput is several times higher. New installs should be Snort 3.

Procedure

Step 1: Install Snort 3

Ubuntu/Debian via official PPA:

`sudo add-apt-repository ppa:oisf/snort3
sudo apt update
sudo apt install -y snort3`

Confirm version:

`snort -V
# Snort++ 3.1.x.x`

Step 2: Configure the Capture NIC

Promiscuous mode on the capture NIC; list interfaces Snort 3 supports:

`sudo ip link set eth1 promisc on
snort --daq-dir /usr/local/lib/daq --help 2>&1 | grep -i interface
snort -c /usr/local/etc/snort/snort.lua --daq afpacket -i eth1`

Capture-only smoke test:

`sudo snort -c /usr/local/etc/snort/snort.lua --daq afpacket -i eth1 -A alert_fast`

Step 3: Configure and Update Rules

Snort 3 main config is snort.lua. Rules enter via ips.rules. Enable community rules:

`sudo sed -i 's/^# include \\$RULE_PATH\\/snort3-community.rules/include \\$RULE_PATH\\/snort3-community.rules/' /usr/local/etc/snort/snort.lua
sudo snort -c /usr/local/etc/snort/snort.lua --daq afpacket -i eth1 -T`

-T is test mode. When config is clean, start the daemon:

`sudo systemctl start snort3
sudo systemctl enable snort3`

Step 4: Write Custom Rules

Add rules in /usr/local/etc/rules/local.rules and include them from snort.lua:

`alert tcp any any -> $HOME_NET 22 (msg:\"SSH brute force attempt\"; flow:to_server,established; content:\"SSH-2.0\"; sid:1000001; rev:1;)`

This rule matches SSH handshake traffic to local port 22. Syntax check:

`sudo snort -c /usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules -T`

Verification

Running Snort 3 writes alerts to the log:

`tail -f /var/log/snort/alert_fast.txt`

Simulate with a local nmap scan and confirm the rule fires:

`nmap -sS 192.168.1.10
# Alert log showing \"SSH brute force attempt\" means detection succeeded`

FAQ

FAQ 1: Snort 3 or Suricata?

Both are mainstream open-source IDS. Snort 3: mature rules ecosystem, lots of docs, classic IDS. Suricata: native threads, GPU offload, stronger inline IPS; better for high throughput. Teams already on Suricata should stay. New deploys: pick by throughput.

FAQ 2: Rule hits, no alert output?

Walk this order: (1) NIC is promiscuous and traffic actually hits the tap; (2) snort -T confirms rule syntax and path; (3) alert file permissions — Snort must write /var/log/snort; (4) tcpdump to confirm capture itself.

FAQ 3: How does Snort 3 auto-update rules?

Open-source: refresh the snort3-community-rules package by hand. Commercial rules (Talos/ET) need a subscription. Cron a pull, then systemctl restart snort3.

Summary

Snort gives real-time traffic detection at near-zero cost. Pair it with a firewall and a log platform for a detect-to-respond loop. Ship alerts into ELK or Wazuh for correlation. Auto-push high-frequency source IPs to the firewall. Detect, then block.