Snort: A Comprehensive Guide to Network Intrusion Detection and Prevention

Table of Contents#

1. What Is Snort?
2. Core Components of Snort
3. Installation & Initial Setup
4. Configuration Fundamentals
5. Rule Writing: The Heart of Snort
6. Deployment Strategies: Where to Place Snort
7. Best Practices for Production
8. Advanced Use Cases
9. Troubleshooting Common Issues
10. Snort 2 vs. Snort 3: What's New?
11. Conclusion
12. References

1. What Is Snort?#

Snort is a multi-mode network security tool developed by Martin Roesch in 1998. It was later maintained by Sourcefire (founded by Roesch) and is now developed by Cisco, which acquired Sourcefire in 2013. With over 5 million downloads, Snort is the world's most widely deployed open-source intrusion prevention system. It operates in three primary modes:

a. Packet Sniffer#

Captures and displays raw network packets (like tcpdump).
Example: snort -v (verbose mode) prints packet headers to the console.

b. Packet Logger#

Logs packets to disk for later analysis.
Example: snort -l /var/log/snort -b (logs to /var/log/snort in binary format).

c. NIDS/NIPS#

The most powerful mode: detects (NIDS) or blocks (NIPS) malicious traffic using rule-based logic.

Key Definitions#

• NIDS: Passively monitors traffic (e.g., via a network tap or SPAN port) and alerts on threats.
• NIPS: Inline deployment (sits between network segments) to block malicious traffic in real time.
• Signature-Based Detection: Matches traffic against known attack patterns (rules).
• Behavior-Based Inspection: Compares network activity against predefined rules to detect emerging threats that may not have known signatures.

2. Core Components of Snort#

Snort's functionality relies on five interdependent components:

a. Packet Decoder#

Parses raw network packets into a structured format (e.g., TCP, UDP, ICMP). It handles protocol-specific nuances (e.g., TCP sequence numbers, IP fragmentation).

b. Preprocessors#

Normalize traffic and detect evasion techniques (e.g., fragmented packets, HTTP obfuscation). Critical preprocessors include:

• stream5 (Snort 2) / stream_tcp (Snort 3): Reassembles TCP streams to detect fragmented attacks.
• http_inspect: Normalizes HTTP traffic (e.g., URL decoding) to prevent evasion.
• smtp_inspect: Analyzes SMTP traffic for malware attachments.

c. Detection Engine#

The "brain" of Snort: matches decoded packets against rules to trigger alerts/actions.

d. Output Modules#

Logs alerts or sends them to external tools (e.g., syslog, SIEM). Common outputs:

• unified2: Binary format for efficient logging (recommended for production).
• alert_syslog: Sends alerts to system logs.
• alert_file: Writes alerts to a text file.

e. Rule Set#

A collection of rules that define what Snort should detect. Rules are either:

• Official: Maintained by Cisco Talos (updated daily).
• Community: Developed by the Snort community and QA'd by Cisco Talos (freely available).
• Custom: Written by users for specific threats/policies.

3. Installation & Initial Setup#

Snort runs on Linux, Windows, and macOS. Below we cover Snort 2.9.x on Ubuntu 22.04 (widely documented and available via apt) and provide guidance for Snort 3 (the current actively developed version).

a. Prerequisites#

• A Linux machine with sudo privileges.
• A network interface (e.g., eth0) to monitor.
• Internet access for rule updates.

b. Installing Snort 2.9.x (via apt)#

# Update package lists
sudo apt update && sudo apt upgrade -y
 
# Install Snort and dependencies
sudo apt install snort libpcap-dev libpcre3-dev libdnet-dev -y
 
# Verify installation
snort --version

c. Installing Snort 3 (from source)#

Snort 3 is not available as a packaged binary—installation requires building from source. The fastest way to try Snort 3 is with Docker:

# Pull and run the official Snort 3 Docker image
sudo docker pull ciscotalos/snort3
sudo docker run --name snort3 -h snort3 -u snorty -w /home/snorty -d -it ciscotalos/snort3 bash
sudo docker exec -it snort3 bash

For a production installation from source on Ubuntu, install the required dependencies:

sudo apt install build-essential libpcap-dev libpcre3-dev libnet1-dev zlib1g-dev \
  luajit hwloc libdnet-dev libdumbnet-dev bison flex liblzma-dev openssl libssl-dev \
  pkg-config libhwloc-dev cmake cpputest libsqlite3-dev uuid-dev libcmocka-dev \
  libnetfilter-queue-dev libmnl-dev autotools-dev libluajit-5.1-dev libunwind-dev libfl-dev

Then download the latest release from GitHub and follow the official Snort 3 installation guide.

d. Initial Configuration#

Snort's main config file is /etc/snort/snort.conf. Edit key variables:

1. Set HOME_NET and EXTERNAL_NET#

HOME_NET is your trusted network (e.g., internal LAN). EXTERNAL_NET is everything else (untrusted).
Edit /etc/snort/snort.conf:

# Replace with your network (e.g., 192.168.1.0/24)
var HOME_NET 192.168.1.0/24
var EXTERNAL_NET any

2. Enable Rule Directories#

Uncomment the line that includes official rules:

include $RULE_PATH/local.rules
include $RULE_PATH/community.rules

3. Test Configuration#

Check for syntax errors:

sudo snort -T -c /etc/snort/snort.conf

You should see: Snort successfully validated the configuration!

e. Download Official Rules#

Official rules require an OINKCODE (free registration at Snort.org). Replace YOUR_OINKCODE with your code:

# Create rule directory
sudo mkdir -p /etc/snort/rules
 
# Download rules (Snort 2.9.x)
sudo wget https://www.snort.org/rules/snortrules-snapshot-29200.tar.gz?oinkcode=YOUR_OINKCODE -O snortrules.tar.gz
 
# Extract rules
sudo tar -xvf snortrules.tar.gz -C /etc/snort/

Alternatively, the Community Ruleset is freely available without an OINKCODE:

sudo wget https://www.snort.org/rules/community -O community-rules.tar.gz
sudo tar -xvf community-rules.tar.gz -C /etc/snort/

4. Configuration Fundamentals#

The /etc/snort/snort.conf file is divided into logical sections. Let's break down the most important parts:

a. Variables#

Define reusable values (e.g., networks, ports):

# Example: Trusted DNS servers
var DNS_SERVERS $HOME_NET
var HTTP_PORTS 80,8080
var SMTP_PORTS 25,465,587

b. Preprocessors#

Enable/disable preprocessors to optimize performance. Example (Snort 2.9.x):

# Enable TCP stream reassembly
preprocessor stream5: sessionsize 2048, timeout 30
 
# Enable HTTP inspection
preprocessor http_inspect: global

In Snort 3, preprocessors are called inspectors and use a different syntax (see Snort 2 vs. Snort 3).

c. Output Modules#

Configure where Snort sends alerts/logs. Unified2 is recommended for production:

# Log alerts to unified2 format (binary, efficient)
output unified2: filename snort.log, limit 128
 
# Send alerts to syslog (for SIEM integration)
output alert_syslog: LOG_AUTH LOG_ALERT

d. Rule Inclusion#

Include official and custom rules:

# Official rules
include $RULE_PATH/snort.rules
 
# Custom rules (your own)
include $RULE_PATH/local.rules

5. Rule Writing: The Heart of Snort#

Snort rules are the backbone of its detection capability. A rule follows this structure:

<action> <protocol> <source IP> <source port> <direction> <dest IP> <dest port> (<options>)

Let's dissect each part with examples.

a. Action#

Defines what Snort does when a rule matches:

• alert: Log and alert (NIDS mode).
• log: Log only.
• pass: Ignore the packet.
• drop: Block the packet (NIPS mode, inline only).
• reject: Block and send a reset (TCP) or icmp-unreachable (UDP/ICMP).

b. Protocol#

The network protocol (e.g., tcp, udp, icmp).

c. Source/Dest IP/Port#

• any: Matches any IP/port.
• $HOME_NET: Trusted network (from snort.conf).
• $EXTERNAL_NET: Untrusted network.

d. Direction#

• ->: From source to destination.
• <-: From destination to source.
• <>: Bidirectional.

e. Options#

Add context and specificity (required: msg, sid, rev). Common options:

• msg: Human-readable description of the threat.
• sid: Snort ID (unique identifier; use >1000000 for custom rules).
• rev: Rule revision (increment when updating a rule).
• content: Matches a string in the packet payload (case-sensitive).
• pcre: Matches a regular expression (powerful but slower).
• reference: Links to external resources (e.g., CVE databases).
• flow: Specifies session properties (e.g., to_server, established).
• classtype: Categorizes the alert (e.g., trojan-activity).

Example 1: Simple TCP Alert#

Alert on TCP traffic from the internet to your LAN on port 22 (SSH):

alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"External SSH Connection Attempt"; sid:1000001; rev:1;)

Example 2: HTTP Content Match#

Alert on HTTP requests containing the string malware.exe (indicates a download):

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"HTTP Download of Malicious File"; content:"malware.exe"; sid:1000002; rev:2; reference:url,virustotal.com; )

Example 3: Regex Match (PCRE)#

Detect DNS queries for .tk domains (common in phishing):

alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"DNS Query for .tk Domain"; pcre:"/\.(tk)\b/"; sid:1000003; rev:1;)

Example 4: NIPS Rule (Block Traffic)#

Block TCP traffic from a known malicious IP (1.2.3.4) to your LAN:

drop tcp 1.2.3.4 any -> $HOME_NET any (msg:"Block Malicious IP"; sid:1000004; rev:1;)

Best Practices for Rule Writing#

1. Be Specific: Avoid broad rules (e.g., any any -> any any)—they cause false positives.
2. Use SID/Rev Correctly:
   • Official rules: sid < 1000000.
   • Custom rules: sid > 1000000.
   • Increment rev when updating a rule.
3. Test Rules: Use snort -r test.pcap -c snort.conf to validate rules against a PCAP file.
4. Add References: Link to CVEs, malware databases, or internal docs (e.g., reference:cve,2023-1234).

6. Deployment Strategies: Where to Place Snort#

Snort's effectiveness depends on where you deploy it. The two main modes are passive (monitoring) and inline (prevention).

a. Passive Deployment (NIDS Mode)#

• How It Works: Snort monitors traffic via a SPAN port (switch mirror) or network tap (physical device). It does not alter traffic—safe for monitoring.
• Best For:
  • Monitoring critical servers (e.g., database, file server).
  • Compliance (e.g., PCI-DSS requires network monitoring).
• Topology: Connect Snort to a SPAN port of your core switch to capture all traffic.

b. Inline Deployment (NIPS Mode)#

• How It Works: Snort sits between two network segments (e.g., firewall and internal LAN). It blocks malicious traffic in real time.
• Best For:
  • Perimeter defense (protecting your LAN from the internet).
  • Blocking known malware/exploits.
• Topology: Place Snort inline with a router/firewall. Use NFQUEUE (Linux) or WinDivert (Windows) to forward traffic to Snort.

c. Common Deployment Topologies#

1. Perimeter: Snort inline between your firewall and internet—blocks external threats.
2. Internal: Passive on a SPAN port to monitor internal traffic (e.g., lateral movement by attackers).
3. Distributed: Multiple Snort sensors across branch offices—centralize alerts with a SIEM.

Example: Inline Deployment on Linux (NFQUEUE)#

1. Enable IP Forwarding:

   sudo sysctl -w net.ipv4.ip_forward=1

2. Configure iptables to Forward Traffic to Snort:

   # Forward all TCP traffic to NFQUEUE (queue 1)
   sudo iptables -A FORWARD -p tcp -j NFQUEUE --queue-num 1

3. Run Snort in Inline Mode:

   sudo snort -Q -c /etc/snort/snort.conf -i eth0

   • -Q: Use NFQUEUE (inline mode).
   • -i eth0: Monitor interface eth0.

7. Best Practices for Production#

Follow these rules to ensure Snort is secure, efficient, and reliable:

a. Rule Management#

• Use Official Rules: Update them daily (Cisco Talos releases rules for new threats).
• Minimize Custom Rules: Only write rules for threats not covered by official sets.
• Test Rules: Use snort -T -c snort.conf to validate syntax. Use pcap files (e.g., from Malware-Traffic-Analysis.net) to test detection.

b. Performance Optimization#

• Tune Preprocessors: Disable preprocessors for protocols you don't use (e.g., smtp_inspect if you don't run an SMTP server).
• Use Fast Mode: Add -q to suppress non-critical output: snort -q -c snort.conf -i eth0.
• Hardware Acceleration: Use a NIC with TCP offloading (e.g., Intel X710) to reduce CPU load.
• Leverage Hyperscan (Snort 3): Enables faster pattern matching using the Hyperscan regex engine.

c. Logging & Alerting#

• Integrate with SIEM: Send unified2 logs to tools like Splunk, Elasticsearch, or IBM QRadar for correlation and analysis.
• Use the Elastic Snort Integration: Elastic provides a dedicated Snort integration for ingesting Snort logs into the Elastic Stack.
• Rotate Logs: Use logrotate to prevent disk space exhaustion. Example /etc/logrotate.d/snort:

  /var/log/snort/*.log {
      daily
      rotate 7
      compress
      missingok
      notifempty
  }

d. Security & Updates#

• Run as Non-Root: Snort doesn't need root privileges. Create a user snort and run:

  sudo snort -u snort -g snort -c snort.conf -i eth0

• Update Snort: Patch vulnerabilities by upgrading Snort regularly:

  sudo apt update && sudo apt upgrade snort -y

• Least Privilege: Restrict access to Snort logs/rules (e.g., chmod 600 /etc/snort/snort.conf).

e. Testing#

• Test Inline Mode: Use a lab environment to avoid disrupting production traffic.
• Validate Rules: Use snort -r test.pcap -c snort.conf to check if rules trigger on known malicious traffic.

8. Advanced Use Cases#

Snort is flexible—here are some advanced scenarios:

a. Inline Prevention with NFQUEUE (Linux)#

As shown earlier, NFQUEUE lets Snort block traffic inline. Use it with iptables to filter specific ports/protocols.

b. Integrating with SOAR (Security Orchestration)#

SOAR tools like Palo Alto Cortex XSOAR or IBM Resilient can automate responses to Snort alerts. For example:

1. Snort detects a malware download.
2. SOAR automatically quarantines the infected host.
3. SOAR sends a Slack alert to the security team.

c. Custom Preprocessors#

Write your own preprocessor (Snort 2) or inspector plugin (Snort 3) to detect custom threats. Snort 3 provides over 200 plugins and a modular architecture for extending functionality.

d. Cloud Deployment#

• AWS: Use VPC Traffic Mirroring to send traffic from your EC2 instances to a Snort sensor.
• Azure: Use Network Watcher to capture traffic and forward it to Snort.

9. Troubleshooting Common Issues#

Snort can be finicky—here's how to fix common problems:

a. False Positives#

• Cause: Overly broad rules (e.g., content:"login" matches legitimate HTTP logins).
• Fix:
  • Add more specific content matches (e.g., content:"admin/login.php").
  • Use pcre with word boundaries (e.g., pcre:"/admin\/login\.php\b/").
  • Adjust preprocessors (e.g., disable http_inspect if it's normalizing legitimate traffic).

b. No Alerts (Passive Mode)#

• Check Interface: Ensure Snort is monitoring the correct interface (snort -i eth0).
• Check HOME_NET: Verify HOME_NET is set to your network (e.g., 192.168.1.0/24).
• Test with PCAP: Run snort -r malicious.pcap -c snort.conf—if it alerts, Snort is working; the issue is your deployment (e.g., SPAN port not configured).

c. Performance Bottlenecks#

• Check CPU/Memory: Use top to see if Snort is using 100% CPU.
• Reduce Rule Set: Disable unused rules (e.g., comment out include $RULE_PATH/imap.rules if you don't use IMAP).
• Use Fast Mode: Add -q to reduce console output.

d. Rule Syntax Errors#

• Test Configuration: Run snort -T -c snort.conf—it will point to syntax errors (e.g., missing ; in options).
• Validate SID: Ensure no duplicate sid (use grep "sid:" /etc/snort/rules/* to check).

10. Snort 2 vs. Snort 3: What's New?#

Snort 3 (also called Snort++) is a major rewrite that brings significant improvements over Snort 2. As of 2026, Snort 3 is the actively developed version (latest release: 3.12.2.0), while Snort 2.9.x is in maintenance mode.

Key Differences#

Should You Use Snort 2 or Snort 3?#

• New deployments: Consider Snort 3 for its performance improvements and modern architecture.
• Existing Snort 2 deployments: Plan a migration—rules can be converted using snort2lua.
• Learning/education: Snort 2 has more tutorials and documentation available; Snort 3 documentation is growing.

For a detailed comparison, see the Snort Blog: Major differences between Snort 3 and Snort 2.

11. Conclusion#

Snort is a powerful, flexible tool for network security—but it requires careful configuration and rule management. To recap:

• Start Small: Deploy Snort passively first to learn its behavior.
• Master Rule Writing: Focus on specificity to avoid false positives.
• Integrate with Tools: Use SIEM/SOAR to turn alerts into actionable insights.
• Stay Updated: Rules and Snort itself evolve—regular updates are non-negotiable.
• Consider Snort 3: If starting fresh, evaluate Snort 3 for its multi-threading and modern features.

Snort is not a "set it and forget it" tool—but with practice, it can become your network's first line of defense against threats.

12. References#

1. Official Snort Website: Snort.org
2. Snort 3 Documentation: Snort 3 User Manual
3. Snort 3 Rule Writing Guide: Snort 3 Rule Writing Guide
4. OINKCODE Registration: Snort OINKcodes
5. Snort 3 on GitHub: snort3/snort3
6. NFQUEUE Inline Setup: libnetfilter_queue
7. Elastic Snort Integration: Elastic Snort Integration
8. Malware PCAPs for Testing: Malware-Traffic-Analysis.net
9. Snort 2 vs. Snort 3: Snort Blog: Major Differences
10. Snort Wikipedia: Snort (software)