configuring-snort-ids-for-intrusion-detection

为入侵检测配置 Snort IDS

何时使用

• 部署基于网络的入侵检测系统，以监控关键网络边界的流量
• 编写自定义 Snort 规则，以检测特定于组织的威胁、攻击模式或策略违规
• 调整现有规则集以减少误报，同时保持检测覆盖率
• 将 Snort 告警与 SIEM 平台集成，实现集中式安全监控
• 通过生成测试流量并确认检测来验证网络安全控制

不要使用 作为端点检测的替代方案、在没有 TLS 检查的情况下监控加密流量，或作为没有补充防御措施的单一安全控制。

前置条件

• 从源代码或包管理器安装的 Snort 3.x（使用 snort --version 验证）
• 在 span 端口或网络分路器上配置为混杂模式的网络接口
• 用于数据包捕获集成的 DAQ（数据采集库）
• 注册的 Snort 账户，用于从 snort.org 下载 Snort Subscriber（付费）或 Community 规则集
• PulledPork 3 或类似的规则管理工具，用于自动更新规则集
• 足够的 CPU 和内存，以便以线速进行内联流量检查

工作流

步骤 1：安装并验证 Snort 3

# Install dependencies (Ubuntu/Debian)
sudo apt install -y build-essential libpcap-dev libpcre3-dev libnet1-dev \
  zlib1g-dev luajit hwloc libdumbnet-dev bison flex libcmocka-dev \
  libnetfilter-queue-dev libmnl-dev autotools-dev libluajit-5.1-dev \
  pkg-config cmake libhwloc-dev liblzma-dev openssl libssl-dev cpputest \
  libsqlite3-dev uuid-dev

# Install DAQ from source
git clone https://github.com/snort3/libdaq.git
cd libdaq && ./bootstrap && ./configure && make && sudo make install

# Install Snort 3
git clone https://github.com/snort3/snort3.git
cd snort3 && ./configure_cmake.sh --prefix=/usr/local
cd build && make -j$(nproc) && sudo make install
sudo ldconfig

# Verify installation
snort -V

步骤 2：配置网络接口

# Disable offloading features that interfere with packet inspection
sudo ethtool -K eth1 gro off lro off tso off gso off rx off tx off

# Enable promiscuous mode
sudo ip link set eth1 promisc on

# Create systemd service for persistent interface configuration
sudo tee /etc/systemd/system/snort-iface.service << 'EOF'
[Unit]
Description=Configure Snort capture interface
Before=snort.service

[Service]
Type=oneshot
ExecStart=/sbin/ethtool -K eth1 gro off lro off tso off gso off rx off tx off
ExecStart=/sbin/ip link set eth1 promisc on
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable snort-iface.service

步骤 3：使用 Lua 配置配置 Snort 3

# Create Snort directory structure
sudo mkdir -p /usr/local/etc/snort/{rules,builtin_rules,lists,appid}
sudo mkdir -p /var/log/snort

# Edit the main Snort configuration
sudo tee /usr/local/etc/snort/snort.lua << 'LUAEOF'
-- Snort 3 Configuration

-- Network variables
HOME_NET = '10.10.0.0/16'
EXTERNAL_NET = '!$HOME_NET'

-- Path variables
RULE_PATH = '/usr/local/etc/snort/rules'
BUILTIN_RULE_PATH = '/usr/local/etc/snort/builtin_rules'

-- Configure DAQ
daq = {
    module_dirs = { '/usr/local/lib/daq' },
    modules = { { name = 'afpacket', variables = { 'buffer_size_mb=256' } } }
}

-- Decoder configuration
normalizer = { tcp = { ips = true } }

-- Stream inspection
stream = { }
stream_tcp = { policy = 'linux', session_timeout = 180 }
stream_udp = { session_timeout = 30 }
stream_icmp = { }

-- HTTP inspection
http_inspect = { }

-- DNS inspection
dns = { }

-- SSL/TLS inspection
ssl = { }

-- SMB inspection
dce_smb = { }

-- File identification and processing
file_id = { rules_file = '/usr/local/etc/snort/file_magic.rules' }

-- Port scan detection
port_scan = {
    protos = 'all',
    scan_types = 'all',
    memcap = 10000000
}

-- Reputation-based filtering
-- reputation = {
--     blacklist = RULE_PATH .. '/blocklist.rules'
-- }

-- IPS rules
ips = {
    enable_builtin_rules = true,
    include = RULE_PATH .. '/snort3-community.rules',
    variables = {
        nets = { HOME_NET = HOME_NET, EXTERNAL_NET = EXTERNAL_NET },
        ports = {
            HTTP_PORTS = '80 8080 8443',
            SSH_PORTS = '22',
            DNS_PORTS = '53'
        }
    }
}

-- Alert output
alert_fast = {
    file = true,
    packet = false,
    limit = 100
}

-- Unified2 output for Barnyard2/SIEM integration
-- alert_unified2 = { limit = 128 }

-- JSON alert output
alert_json = {
    file = true,
    limit = 100,
    fields = 'timestamp pkt_num proto pkt_gen pkt_len dir src_addr src_port dst_addr dst_port service rule action'
}

-- Syslog output
-- alert_syslog = { level = 'info', facility = 'local1' }

LUAEOF

步骤 4：下载并配置规则集

# Download Snort 3 Community Rules
wget https://www.snort.org/downloads/community/snort3-community-rules.tar.gz
tar xzf snort3-community-rules.tar.gz
sudo cp snort3-community-rules/snort3-community.rules /usr/local/etc/snort/rules/

# Install PulledPork 3 for automated rule management
git clone https://github.com/shirkdog/pulledpork3.git
cd pulledpork3
sudo python3 setup.py install

# Configure PulledPork
sudo tee /usr/local/etc/pulledpork3/pulledpork.conf << 'EOF'
registered_ruleset = true
oinkcode = <YOUR_OINK_CODE>
snort_path = /usr/local/bin/snort
local_rules = /usr/local/etc/snort/rules/local.rules
sorule_path = /usr/local/etc/snort/so_rules/
snort_version = 3.0.0.0
blocklist_path = /usr/local/etc/snort/lists/
pid_path = /var/run/snort.pid
ips_policy = balanced
EOF

# Run PulledPork to fetch and process rules
sudo pulledpork3 -c /usr/local/etc/pulledpork3/pulledpork.conf

步骤 5：编写自定义检测规则

# Create local rules file
sudo tee /usr/local/etc/snort/rules/local.rules << 'EOF'
# Detect reverse shell on common ports
alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (
    msg:"LOCAL Possible Reverse Shell on port 4444";
    flow:established,to_server;
    content:"/bin/sh"; nocase;
    sid:1000001; rev:1;
    classtype:trojan-activity;
    priority:1;
)

# Detect Mimikatz execution indicators over SMB
alert tcp any any -> $HOME_NET 445 (
    msg:"LOCAL Mimikatz Lateral Movement via SMB";
    flow:established,to_server;
    content:"|FF|SMB";
    content:"mimikatz"; nocase; distance:0;
    sid:1000002; rev:1;
    classtype:trojan-activity;
    priority:1;
)

# Detect DNS tunneling (high-entropy long subdomain queries)
alert udp $HOME_NET any -> any 53 (
    msg:"LOCAL Possible DNS Tunneling - Long Query Name";
    content:"|01 00|"; offset:2; depth:2;
    byte_test:1,>,50,12;
    sid:1000003; rev:1;
    classtype:policy-violation;
    priority:2;
)

# Detect cleartext password transmission via FTP
alert tcp $HOME_NET any -> any 21 (
    msg:"LOCAL FTP Cleartext Password Detected";
    flow:established,to_server;
    content:"PASS "; depth:5;
    sid:1000004; rev:1;
    classtype:policy-violation;
    priority:2;
)

# Detect potential port scan (SYN flood pattern)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (
    msg:"LOCAL Possible Port Scan SYN Flood";
    flow:stateless;
    flags:S,12;
    threshold:type both, track by_src, count 100, seconds 10;
    sid:1000005; rev:1;
    classtype:attempted-recon;
    priority:2;
)
EOF

步骤 6：验证配置并运行

# Validate configuration
snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq -T

# Run Snort in IDS mode on the capture interface
sudo snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq \
  -i eth1 -l /var/log/snort -D

# Test rules against a PCAP file
snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq \
  -r test_traffic.pcap -l /var/log/snort/test/ -A fast

# Create systemd service for production deployment
sudo tee /etc/systemd/system/snort.service << 'EOF'
[Unit]
Description=Snort 3 IDS
After=network.target snort-iface.service

[Service]
Type=simple
ExecStart=/usr/local/bin/snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq -i eth1 -l /var/log/snort -D
ExecReload=/bin/kill -SIGHUP $MAINPID
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable --now snort.service

步骤 7：监控告警并调整规则

# View real-time alerts
tail -f /var/log/snort/alert_fast.txt

# Parse JSON alerts for analysis
cat /var/log/snort/alert_json.txt | python3 -m json.tool

# Identify top triggered rules for tuning
grep -oP 'sid:\d+' /var/log/snort/alert_fast.txt | sort | uniq -c | sort -rn | head -20

# Suppress noisy false-positive rules
sudo tee -a /usr/local/etc/snort/rules/suppress.rules << 'EOF'
suppress gen_id 1, sig_id 2100498, track by_src, ip 10.10.1.100
suppress gen_id 1, sig_id 2100366, track by_dst, ip 10.10.5.0/24
EOF

# Verify rule count and performance
snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq -T 2>&1 | grep -i "rules loaded"

关键概念

术语	定义
IDS vs IPS	IDS 被动监控流量并生成告警；IPS 位于内联位置，可以实时主动阻止或丢弃恶意数据包
Snort 规则	检测签名，包含头部（动作、协议、源/目标、端口）和选项（内容匹配、流方向、元数据），在匹配流量时触发
预处理器	Snort 组件，在规则检查前规范化并重组协议特定流量，处理分片、流重组和协议异常
DAQ（数据采集）	Snort 3 中的抽象层，与数据包捕获机制（AF_PACKET、PCAP、NFQ）对接以接收网络数据
Oink Code	来自 snort.org 的个人注册码，下载 Snort Subscriber 或 Registered 规则集所必需
阈值/抑制	调整机制，用于控制告警频率（threshold）或完全静默来自特定来源/目标的告警（suppress）

工具与系统

• Snort 3：开源网络入侵检测和防御系统，采用基于 Lua 的配置和多线程架构
• PulledPork 3：自动化 Snort 规则管理工具，可下载、处理并部署规则集，并支持基于策略的过滤
• Barnyard2：专用后台程序，读取 Snort 的 unified2 二进制输出并写入数据库（MySQL、PostgreSQL），用于 SIEM 集成
• Snorby：基于 Web 的 Snort 告警管理控制台，提供仪表板、事件分类和报告
• tcpreplay：用于通过 Snort 重放 PCAP 文件的工具，以验证规则并测试检测能力

常见场景

场景：在网络边界部署 Snort IDS 以满足合规要求

背景：一家医疗机构需要部署网络 IDS 以满足 HIPAA 技术保障要求。该 IDS 必须监控 DMZ 与内部网络之间的流量，检测常见攻击模式，并将告警转发到现有的 Splunk SIEM。该网络在高峰时段的流量约为 500 Mbps。

方法：

1. 在配备双网卡的专用传感器上安装 Snort 3——一块用于监控（来自核心交换机的 span 端口），一块用于管理
2. 配置 AF_PACKET DAQ 并使用 512 MB 环形缓冲区，以在无丢包的情况下应对峰值吞吐量
3. 部署 Snort Community 规则以及 Emerging Threats Open 规则集作为基线检测
4. 为组织特定威胁编写自定义规则：检测离开网络的 PHI 数据模式（SSN、MRN 格式）、对 DICOM/HL7 端口的未授权访问，以及与已知恶意 IP 列表的连接
5. 配置 JSON 告警输出，并通过使用 rsyslog 的 syslog 转发到 Splunk
6. 针对 24 小时捕获的基线流量运行 Snort，以识别误报，然后为合法流量模式创建抑制规则
7. 将 Snort 启用为 systemd 服务，并配置自动重启和日志轮转

陷阱：

• 在未调优的情况下部署所有可用规则，使传感器和 SOC 被每天数千条误报淹没
• 忘记禁用网卡卸载，导致 Snort 因校验和错误或巨型帧而漏包
• 未按峰值流量确定传感器硬件规格，导致高流量时段出现丢包
• 仅依赖社区规则，而没有针对组织特定威胁和合规要求的自定义规则

输出格式

## Snort IDS Deployment Report

**Sensor**: snort-sensor-01 (10.10.1.250)
**Interface**: eth1 (span port from Core-SW1 gi0/24)
**Configuration**: /usr/local/etc/snort/snort.lua
**Ruleset**: Snort Community 3.0 + Local Rules (1,247 active rules)
**HOME_NET**: 10.10.0.0/16

### Detection Summary (24-hour baseline)

| Category | Alert Count | Top Rule SID |
|----------|-------------|--------------|
| Attempted Recon | 342 | 1:2100498 (ICMP ping) |
| Trojan Activity | 12 | 1:1000001 (Reverse shell) |
| Policy Violation | 87 | 1:1000004 (FTP cleartext) |
| Web Application Attack | 23 | 1:2100654 (SQL injection) |

### Tuning Actions Taken
- Suppressed SID 2100498 for 10.10.1.100 (monitoring server legitimate ICMP)
- Thresholded SID 1000004 to 5 alerts per source per hour
- Added 3 custom rules for PHI exfiltration detection