Running Snort

When Snort is configured and validated, you can run it with a single-use command:

snort -d -l /var/log/snort/ -h IP-ADDRESS -A console-c /etc/snort/snort.conf

Note that this command is a general purpose command for sniffing packets at the designated IP address, writing the log to standard output (-A console), as well as a file (-l), and using the listed configuration file (-c). The output starts with a copyright notice, followed by a description of the rules used and a listing of any rules that are obsolete or missing, and, finally, an ongoing list of events on the IP address.

Individual log entries begin with the date and the time, followed by the activity, its classification, and the source of the activity. An activity is given a priority number, generally on a scale of 1 (severe) to 4 (mild), although you can assign priorities as high as you wish when you write or modify a rule. If you are new to packet sniffing, you may be alarmed at the frequency and persistency of activities on a modern computer, so remember that Snort logs all packet activity, not just potentially suspicious activity, and is only as good as the installed rules. False positives will be common (Figure 7). Log entries are also written to /var/log/snort.

Figure 7: A typical log entry: You may see false positives because Snort logs all packet activity.

Most likely, though, you will want Snort to be running all the time, especially on a network. If your system uses systemd, create and edit as root the file /lib/systemd/system/snort.service and include the code provided in Listing 1 to the file.

[Unit]
Description=Snort NIDS Daemon
After=syslog.target network.target
[Service]
Type=simple
ExecStart=/usr/local/bin/snort -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Install]
WantedBy=multi-user.target

Save the file, and then reload systemctl with:

systemctl daemon-reload

Snort will then be started at login or with the command:

systemctl start snort

Further Information

I have provided a bare bones outline for getting Snort ready to use. The Snort man page includes dozens of options. Trying to detail all the options here would be unrealistic. For further information, consult the latest Snort documentation [6] – which, despite the title displayed, is intended for version 3.0, not version 2.9.16. Snort is a mature piece of software that addresses complex issues, so be prepared to invest considerable time and experimentation if you want to get the most from it.

If you want to learn more about intrusion detection but prefer a desktop environment, spend some time with Sguil (Figure 8). Sguil relies heavily on Snort but also includes a number of related tools, including Barnyard2, tcpdump, and Wireshark. However, because Snort heavily comments its configuration files, it may be all you need to protect your system to your satisfaction. Where you go from here is up to you.

Figure 8: Sguil is a graphical app that relies heavily on Snort, as well as related tools.