Snort Setup Guide

Additional Resources

Note

If you run into any errors please reach out on piazza or attend office hours to get these issues resolved.

Installing Snort

1.0 - Update VM

First, you need to make sure that the VM is up-to-date with the latest packages available. Run the command below in the terminal.

sudo apt-get update

1.1 - Install Snort(In the Terminal)

Once the prompt is returned, next we need to install snort. Run the command below to install sort.

While snort is installing in the terminal, if you are asked "Do you want to continue" enter y to continue.

sudo apt install snort

Configuring Snort

2.0 - Reaching the Config Screen

Now you should see this screen. To contiune hit the "TAB" key and then hit "enter".

2.1 - Setting the Newtork Interface

Now this screen should appear below

Next, we have to specify which network interface snort can listen on.

☁️ Cloud VMs ☁️

Enter: ens160

💻 Laptop VMs 💻

Enter: enp0s3

Once the interface is entered, contiune by hitting the "TAB" key and then hit "enter".

Important

If you entered the wrong Network interface see the "Troubleshooting FAQ(Frequently Asked Questions)" at the bottom of this page

2.2 - Setting the IP address

Find your IP address by looking at your terminal prompt.

Disclaimer: The IP address indicated below in yellow is an example and Not your IP Address.

Important

If you entered the wrong IP Address see the "Troubleshooting FAQ(Frequently Asked Questions)" at the bottom of this page

Once you have found your IP address add it to the Snort config, hit the "TAB" key and then hit "enter".

2.3 - Confirming Network Interface

The Package configuration menu will appear again. To contiune hit the "TAB" key and then hit "enter".

Now you should see the network interface chosen from section 2.1.

Continue with "TAB" and "enter"

Initializing Snort

3.0 - Opening up snort.conf

Now Snort should be installed and configured. Next, you have to edit the config file to set your IP address.

Run the command below in the terminal.

sudo gedit /etc/snort/snort.conf

3.1 - Finding and Updating "ipvar HOME_NET"

Next hold down the control key(ctl) + "f"

Then enter this into the search bar.

ipvar HOME_NET

Then change the value from "any" to the IP address found from step 2.2.

Important

Once "ipvar HOME_NET" is updated, make sure to Save the file.

Testing Snort

4.0 - Running a Test Command

Finally, run a test command to make sure that snort is configured correctly.

Run the command below in the terminal.

sudo snort -T -c /etc/snort/snort.conf

Now confirm that the terminal outputs this screen.

Step 4.1 - Optional Way to Start Snort

Additionally, you can start snort with the "-v" flag to run Snort while displaying the current version 2.9.7.0.

sudo snort -v

Congrats on Completing the Snort Setup Guide. :D

   ,,_   
  o"  )~    -*> Snort! <*-
   ''''

Troubleshooting FAQ(Frequently Asked Questions)

What if I entered the wrong Network Interface or IP Address?