A command-line network intrusion detection system

Running Snort

When Snort is configured and validated, you can run it with a single-use command:

snort -d -l /var/log/snort/ -h IP-ADDRESS -A console-c /etc/snort/snort.conf

Note that this command is a general purpose command for sniffing packets at the designated IP address, writing the log to standard output (-A console), as well as a file (-l), and using the listed configuration file (-c). The output starts with a copyright notice, followed by a description of the rules used and a listing of any rules that are obsolete or missing, and, finally, an ongoing list of events on the IP address.

Individual log entries begin with the date and the time, followed by the activity, its classification, and the source of the activity. An activity is given a priority number, generally on a scale of 1 (severe) to 4 (mild), although you can assign priorities as high as you wish when you write or modify a rule. If you are new to packet sniffing, you may be alarmed at the frequency and persistency of activities on a modern computer, so remember that Snort logs all packet activity, not just potentially suspicious activity, and is only as good as the installed rules. False positives will be common (Figure 7). Log entries are also written to /var/log/snort.

Figure 7: A typical log entry: You may see false positives because Snort logs all packet activity.

Most likely, though, you will want Snort to be running all the time, especially on a network. If your system uses systemd, create and edit as root the file /lib/systemd/system/snort.service and include the code provided in Listing 1 to the file.

Listing 1

Editing /lib/systemd/system/snort.service

Description=Snort NIDS Daemon
After=syslog.target network.target
ExecStart=/usr/local/bin/snort -q -u snort -g snort -c /etc/snort/snort.conf -i eth0

Save the file, and then reload systemctl with:

systemctl daemon-reload

Snort will then be started at login or with the command:

systemctl start snort

Further Information

I have provided a bare bones outline for getting Snort ready to use. The Snort man page includes dozens of options. Trying to detail all the options here would be unrealistic. For further information, consult the latest Snort documentation [6] – which, despite the title displayed, is intended for version 3.0, not version 2.9.16. Snort is a mature piece of software that addresses complex issues, so be prepared to invest considerable time and experimentation if you want to get the most from it.

If you want to learn more about intrusion detection but prefer a desktop environment, spend some time with Sguil (Figure 8). Sguil relies heavily on Snort but also includes a number of related tools, including Barnyard2, tcpdump, and Wireshark. However, because Snort heavily comments its configuration files, it may be all you need to protect your system to your satisfaction. Where you go from here is up to you.

Figure 8: Sguil is a graphical app that relies heavily on Snort, as well as related tools.

The Author

Bruce Byfield is a computer journalist and a freelance writer and editor specializing in free and open source software. In addition to his writing projects, he also teaches live and e-learning courses. In his spare time, Bruce writes about Northwest Coast art (http://brucebyfield.wordpress.com). He is also co-founder of Prentice Pieces, a blog about writing and fantasy at https://prenticepieces.com/.

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • The New Snort

    Get ready for a bigger and better Snort. If you're used to protecting your systems with this trusty intrusion detection tool, you'll appreciate the new features in the latest version.

  • Snort

    Search out hidden attacks with the Snort intrusion detection system.

  • Snort Helpers

    Snort is the de facto standard for open source network intrusion detection. The developer community has kept a fairly low profile for a couple of years, but extensions like Snorby, OpenFPC, and Pulled Pork have given the old hog a new lease on life.

  • Security Visualization Tools

    Spot intruders with these easy security visualization tools.

  • Netfilter's Recent Module

    Netfilter’s Recent module builds a temporary blacklist to keep intruders off your network.

comments powered by Disqus