Introduction
Welcome to the Introduction to Snort IDS lab.
Snort is an open-source network intrusion prevention system (NIPS) and network intrusion detection system (NIDS) capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching, and matching, and is commonly used to actively block or passively detect a variety of attacks and probes, such as buffer overflows, stealth port scans, web application attacks, and more.
At a high level, an IDS answers a different question from a packet sniffer. A sniffer helps you observe traffic. An IDS tries to decide whether some of that traffic deserves attention. Snort does this by combining packet inspection with a rule language. In other words, it turns raw traffic into security-relevant events.
In this lab, you will learn the basics of Snort. You will explore its configuration file, learn how to validate the configuration syntax, and run Snort in two of its primary operational modes: Sniffer mode and Packet Logger mode.
Inspect Snort Configuration File
In this step, you will explore the primary configuration file used by Snort. Understanding this file is essential because it dictates how Snort behaves, what network it protects, and which rules it applies.
Configuration matters because detection quality depends heavily on context. An IDS that does not know which addresses belong to your environment cannot reason well about inbound versus internal traffic. Variables like HOME_NET are therefore not cosmetic settings. They are part of how Snort models the network it is defending.
The main configuration file for Snort is located at /etc/snort/snort.conf. This file contains various settings, including network variables, paths to rule files, and preprocessor configurations.
Let's start by navigating to your project directory, which is your default workspace.
cd ~/project
One of the most important variables in the Snort configuration file is HOME_NET. This variable defines the internal network that Snort is supposed to protect. By default, it is often set to any, meaning Snort will monitor all network traffic.
You can use the grep command to search for the HOME_NET variable inside the configuration file. The grep command is a powerful tool in Linux used to search for specific text patterns within files. Because the configuration file is protected, we need to use sudo to run the command with administrative privileges.
sudo grep "ipvar HOME_NET" /etc/snort/snort.conf
You should see an output similar to this:
ipvar HOME_NET any
This output confirms that the HOME_NET variable is currently set to any. In a real-world production environment, you would typically change this to match your specific internal IP subnet (for example, 192.168.1.0/24) to reduce false positives and improve performance.
You can also view the entire configuration file using the less command if you want to explore further, though it is quite long. For now, knowing where the file is and how to find key variables is sufficient.
Test Configuration Syntax
In this step, you will learn how to test the Snort configuration file for syntax errors.
Validation before deployment is a critical operational practice. A detection rule or config file is only useful if the engine can actually load it. Syntax testing is the IDS equivalent of compiling code before release: it catches broken changes early and prevents blind spots in production.
Whenever you make changes to the snort.conf file, it is highly recommended to test the configuration before actually starting or restarting the Snort service. If there is a typo or a misconfiguration, Snort will fail to start, which could leave your network unmonitored.
Snort provides a built-in testing mode. You can use the -T flag to tell Snort to test the configuration and the -c flag to specify the path to the configuration file you want to test.
Run the following command to test the default configuration:
sudo snort -T -c /etc/snort/snort.conf
Because Snort needs to access network interfaces and system-level files, you must run it with sudo to grant it administrative privileges.
As the command runs, Snort will output a lot of information to the terminal. It is initializing preprocessors, loading rules, and validating the syntax.
Scroll to the bottom of the output. You are looking for a specific success message that looks like this:
--== Initialization Complete ==--
,,_ -*> Snort! <*-
o" )~ Version 2.9.15.1 GRE (Build 68)
'''' By Martin Roesch & The Snort Team: http://www.snort.org/contact#team
Copyright (C) 2014-2019 Cisco and/or its affiliates. All rights reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using libpcap version 1.10.1 (with TPACKET_V3)
Using PCRE version: 8.39 2016-06-14
Using ZLIB version: 1.2.11
Rules Engine: SF_SNORT_DETECTION_ENGINE Version 3.0 <Build 1>
Preprocessor Object: SF_GTP Version 1.1 <Build 4>
Preprocessor Object: SF_CORVUS Version 1.1 <Build 4>
...
Snort successfully validated the configuration!
Snort exiting
The key phrase here is Snort successfully validated the configuration!. This means your snort.conf file is syntactically correct and ready to be used.
Run Snort in Sniffer Mode
In this step, you will run Snort in Sniffer mode.
Sniffer mode is the most basic way to use Snort. In this mode, Snort simply reads the packets flowing across the network and displays them on the console in a continuous stream. It acts very much like the popular tcpdump utility.
This is useful pedagogically because it shows that IDS technology still starts with packets. Before Snort can alert on traffic, it has to capture and decode that traffic correctly. Learning Sniffer mode first keeps the packet-level foundation visible instead of treating alerts as something magical.
To run Snort in sniffer mode, you use the -v (verbose) flag. This tells Snort to print the TCP/IP packet headers to the screen.
Since network traffic can be overwhelming and flood your terminal, we will also use the -n flag followed by a number. This tells Snort to capture only a specific number of packets and then automatically exit.
Run the following command to capture and display 5 packets:
sudo snort -v -n 5
You will see output similar to the following, showing the packet headers:
Running in packet dump mode
--== Initializing Snort ==--
Initializing Output Plugins!
pcap DAQ configured to passive.
Acquiring network traffic from "eth0".
...
05/18-14:32:10.123456 192.168.1.10:54321 -> 8.8.8.8:53
UDP TTL:64 TOS:0x0 ID:12345 IpLen:20 DgmLen:63
Len: 35
...
===============================================================================
Snort exiting
If you want to see even more detail, you can combine flags. For example, adding -d displays the application data (payload) of the packet, and -e displays the link-layer (MAC address) headers.
Let's try capturing 2 packets with full details (headers, data, and link-layer info):
sudo snort -vde -n 2
This mode is incredibly useful for troubleshooting network connectivity issues or quickly inspecting what type of traffic is currently traversing your network interface.
Run Snort in Packet Logger Mode
In this step, you will learn how to run Snort in Packet Logger mode.
While Sniffer mode is great for real-time viewing, it is not practical for long-term monitoring or detailed analysis. Packet Logger mode solves this by saving the captured packets to the disk in a format that can be analyzed later using tools like Wireshark or Snort itself.
Saved packet evidence is important because alerts and packets complement each other. An alert tells you that a rule fired. The packet record lets you confirm what actually happened and investigate details the alert summary may not include. Mature monitoring stacks often preserve both.
First, you need to create a directory to store the log files. Let's create a directory named snort_logs inside your project folder.
mkdir -p ~/project/snort_logs
To run Snort in Packet Logger mode, you use the -l flag followed by the path to your logging directory. We will also use -dev to capture full packet details and -n 10 to capture exactly 10 packets before exiting.
Run the following command:
sudo snort -dev -l ~/project/snort_logs -n 10
Snort will capture 10 packets and write them to the directory you specified. You won't see the packets printed on the screen this time, but you will see the initialization and exit summaries.
Once Snort has finished running, you can verify that the log file was created by listing the contents of the snort_logs directory:
ls -l ~/project/snort_logs
You should see a file named snort.log. followed by a timestamp, similar to this:
total 4
-rw------- 1 root root 1234 May 18 14:45 snort.log.1684421100
This file is saved in a binary format (pcap). You cannot read it directly with a text editor like nano or cat. Instead, you would typically use a tool like tcpdump or read it back into Snort using the -r (read) flag for further analysis.
Summary
Congratulations! You have successfully completed the Introduction to Snort IDS lab.
In this lab, you learned the fundamental concepts of Snort. You explored the main configuration file (snort.conf) and learned how to validate its syntax using the -T flag to prevent startup errors. You also practiced running Snort in Sniffer mode to view live network traffic on your terminal, and in Packet Logger mode to save captured packets to a directory for future analysis. These foundational skills are essential for anyone looking to utilize Snort for network security monitoring and intrusion detection.
