configuring-snort-ids-for-intrusion-detection

Files (4)

• LICENSE
• SKILL.md
• api-reference.md · references/
• agent.py · scripts/

SKILL.md (first lines)

# Configuring Snort IDS for Intrusion Detection

## When to Use

- Deploying a network-based intrusion detection system to monitor traffic at key network boundaries
- Writing custom Snort rules to detect organization-specific threats, attack patterns, or policy violations
- Tuning existing rulesets to reduce false positives while maintaining detection coverage
- Integrating Snort alerts with SIEM platforms for centralized security monitoring
- Validating network security controls by generating test traffic and confirming detection

**Do not use** as a replacement for endpoint detection, for monitoring encrypted traffic without TLS inspection, or as the sole security control without complementary defenses.

## Prerequisites

- Snort 3.x installed from source or package manager (`snort --version` to verify)
- Network interface configured for promiscuous mode on a span port or network tap
- DAQ (Data Acquisition Library) installed for packet capture integration
- Registered Snort account for downloading Snort Subscriber (paid) or Community rulesets from snort.org
- PulledPork 3 or similar rule management tool for automated ruleset updates
- Sufficient CPU and memory for inline traffic inspection at line rate

## Workflow

### Step 1: Install and Verify Snort 3

```bash
# Install dependencies (Ubuntu/Debian)
sudo apt install -y build-essential libpcap-dev libpcre3-dev libnet1-dev \
  zlib1g-dev luajit hwloc libdumbnet-dev bison flex libcmocka-dev \
  libnetfilter-queue-dev libmnl-dev autotools-dev libluajit-5.1-dev \
  pkg-config cmake libhwloc-dev liblzma-dev openssl libssl-dev cpputest \
  libsqlite3-dev uuid-dev

# Install DAQ from source
git clone https://github.com/snort3/libdaq.git
cd libdaq && ./bootstrap && ./configure && make && sudo make install

# Install Snort 3
git clone https://github.com/snort3/snort3.git
cd snort3 && ./configure_cmake.sh --prefix=/usr/local
cd build && make -j$(nproc) && sudo make install
sudo ldconfig

# Verify installation
snort -V
```

### Step 2: Configure Network Interfaces

```bash
# Disable offloading features that interfere with packet inspection
sudo ethtool -K eth1 gro off lro off tso off gso off rx off tx off

# Enable promiscuous mode
sudo ip link set eth1 promisc on

# Create systemd service for persistent interface configuration
sudo tee /etc/systemd/system/snort-iface.service << 'EOF'
[Unit]
Description=Configure Snort capture interface
Before=snort.service

[Service]
Type=oneshot
ExecStart=/sbin/ethtool -K eth1 gro off lro off tso off gso off rx off tx off
ExecStart=/sbin/ip link set eth1 promisc on
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable snort-iface.service
```

### Step 3: Configure Snort 3 with Lua Configuration

```bash
# Create Snort directory structure
sudo mkdir -p /usr/local/etc/snort/{rules,builtin_rules,lists,appid}
sudo mkdir -p /var/log/snort

# Edit the main Snort configuration
sudo tee /usr/local/etc/snort/snort.lua << 'LUAEOF'
-- Snort 3 Configuration

-- Network variables
HOME_NET = '10.10.0.0/16'
EXTERNAL_NET = '!$HOME_NET'

-- Path variables
RULE_PATH = '/usr/local/etc/snort/rules'
BUILTIN_RULE_PATH = '/usr/local/etc/snort/builtin_rules'

-- Configure DAQ
daq = {
    module_dirs = { '/usr/local/lib/daq' },
    modules = { { name = 'afpacket', variables = { 'buffer_size_mb=256' } } }
}

-- Decoder configuration
normalizer = { tcp = { ips = true } }

-- Stream inspection
stream = { }
stream_tcp = { policy = 'linux', session_timeout = 180 }
stream_udp = { session_timeout = 30 }
stream_icmp = { }

-- HTTP inspection
http_inspect = { }

-- DNS inspection
dns = { }

-- SSL/TLS inspection
ssl = { }

-- SMB inspection
dce_smb = { }

From mukul975/Anthropic-Cybersecurity-Skills, Apache-2.0.

More from mukul975/Anthropic-Cybersecurity-Skills