SNORT - Base Documentation
Common Snort Command Use Cases
Start Snort in Packet Logging Mode
To run Snort in packet logging mode, where Snort logs all packets for later analysis:
snort -dev -l /var/log/snort -h 192.168.1.0/24 -c /etc/snort/snort.conf
This command starts Snort in the `-dev` (development mode) with `-l` specifying the log directory and `-h` indicating the network range for the traffic you want to analyze.
Start Snort in Intrusion Detection Mode
To start Snort in IDS mode, where it inspects network traffic in real-time for security threats:
snort -A console -c /etc/snort/snort.conf -i eth0
This command runs Snort in `-A console` mode to output alerts to the console, using the configuration file specified (`snort.conf`), and monitoring the `eth0` interface.
Run Snort with Specific Rule Sets
To run Snort with a specific set of rules for more focused detection:
snort -c /etc/snort/snort.conf -i eth0 -R /etc/snort/rules/local.rules
This runs Snort with custom rule sets defined in `local.rules`, which may include organization-specific or experimental rules.
Run Snort with Inline Mode (IPS)
To run Snort in Inline (IPS) mode, where Snort actively blocks traffic based on detected threats:
snort -Q -c /etc/snort/snort.conf -i eth0
The `-Q` option enables Inline mode, allowing Snort to drop malicious traffic in real-time based on the configured rules.
Display Snort Version Information
To check the current version of Snort installed on the system:
snort -V
This will output the version of Snort, including the version number and some system details about the installation.
Check the Status of Snort Daemon
To check if the Snort daemon is running and active:
systemctl status snort
This command checks the status of the `snort` service to confirm it is running or stopped.
Advanced Snort Command Options
Run Snort with Output to a Specific File
To direct Snort's output to a specific file for logging purposes:
snort -l /var/log/snort -c /etc/snort/snort.conf -A full
This logs all alerts to `/var/log/snort` with a full alert output format for in-depth analysis.
Run Snort with Real-Time Alerts
To enable real-time alerts based on network traffic:
snort -A full -c /etc/snort/snort.conf -i eth0 -l /var/log/snort
The `-A full` option ensures Snort outputs complete alert information to the specified log directory.
Specify a Specific Detection Engine
Snort provides multiple detection engines. To specify a specific one:
snort -c /etc/snort/snort.conf -i eth0 -D -g detect
This command runs Snort in the background with the `-D` option (detached mode) and specifies the `detect` engine.
Enable Performance and Memory Optimization
To optimize Snort for high-performance environments, use the following options:
snort -c /etc/snort/snort.conf -i eth0 -A none -D --disable-memcap
This command runs Snort without memory cap and disables alert logging, optimizing it for performance.
Test Snort Configuration for Errors
To test the Snort configuration file for syntax or rule issues before starting Snort:
snort -T -c /etc/snort/snort.conf
The `-T` option checks the configuration file (`snort.conf`) for errors without starting Snort or processing network traffic.
Load and Use Custom Rules
To load a custom rule file into Snort and begin monitoring:
snort -c /etc/snort/snort.conf -i eth0 -R /etc/snort/rules/custom.rules
This command instructs Snort to use the rules in `custom.rules` in addition to the default configuration.
Security Concepts
Network Intrusion Detection and Prevention
Snort is primarily used to detect and prevent network intrusions. By analyzing network traffic against a predefined set of rules, Snort identifies malicious activities, such as port scans, buffer overflows, and protocol violations.
To protect a network from unauthorized access or potential threats, Snort can be deployed in both IDS (Intrusion Detection System) and IPS (Intrusion Prevention System) modes.
Example in IDS mode:
snort -A console -c /etc/snort/snort.conf -i eth0
Example in IPS mode:
snort -Q -c /etc/snort/snort.conf -i eth0
Anomaly Detection and Signature-Based Detection
Snort supports both anomaly detection and signature-based detection. Signature-based detection involves comparing network traffic to a set of predefined attack signatures, while anomaly detection involves identifying deviations from normal traffic patterns.
Example of enabling a custom signature:
alert tcp any any -> 192.168.1.0/24 80 (msg:"HTTP GET request"; flags:S; sid:1000001;)
This rule generates an alert for HTTP GET requests targeting the `192.168.1.0/24` network on port 80.
Preventing Distributed Denial of Service (DDoS) Attacks
Snort can be configured to detect and block patterns indicative of DDoS attacks, such as SYN flood, UDP flood, or ICMP flood. In IPS mode, Snort can actively drop traffic matching these patterns.
Example rule to detect a SYN flood:
alert tcp any any -> any any (flags:S,12; msg:"SYN flood detected"; sid:1000002;)
This rule alerts when a SYN flood is detected on the network.
Malware Detection
Snort can also be used to detect malware by identifying known signatures or anomalies in network traffic that correspond to malicious software behavior.
For example, to detect an HTTP payload known to be associated with malware:
alert http any any -> any any (msg:"Malicious HTTP payload"; content:"malicious_payload"; sid:1000003;)
Troubleshooting
Snort Not Starting
If Snort fails to start, verify that the configuration file is correctly set up and that all required dependencies are installed:
snort -T -c /etc/snort/snort.conf
The `-T` option will test the configuration and provide details about any errors.
High Memory Usage
Snort can consume a significant amount of memory, especially when inspecting large traffic volumes. To mitigate high memory usage, try optimizing the rule sets or adjust memory allocation parameters in the Snort configuration.
Example of disabling memory cap:
snort -c /etc/snort/snort.conf -D --disable-memcap
Missed Alerts
If Snort is missing alerts or not generating alerts when expected, check the following: 1. Ensure Snort is using the correct rule set and that the rules are updated. 2. Verify that the `alert` keyword is correctly configured in your Snort rule files. 3. Check the `snort.conf` file for any errors in logging configurations.
Example of configuring full alerts:
snort -A full -c /etc/snort/snort.conf -i eth0
Rule Syntax Errors
If you encounter syntax errors in Snort rules, run Snort with the `-T` flag to test the configuration and rule files:
snort -T -c /etc/snort/snort.conf
This will verify the rules for syntax issues.
