Prerequisties

yum install flex bison libpcap libpcap-devel zlib zlib-devel glibc-headers gcc-c++ make -y

Enstalling Dependencies

tar -zxf libdnet-1.11.tar.gz
cd libdnet-1.11
./configure && make && make install

tar -zxf pcre-8.39.tar.gz
cd pcre-8.39
./configure && make && make install

Installing DAQ

tar -zxf daq-2.0.6.tar.gz
cd daq-2.0.6
./configure && make && make install

Installing Snort

tar -zxf snort-2.9.11.tar.gz
cd snort-2.9.11
./configure --enable-sourcefire --disable-open-appid
make && make install

Configuring Snort Rules

mkdir -p /etc/snort/rules
mkdir /usr/local/lib/snort_dynamicrules

cp etc/*.conf* /etc/snort
cp etc/*.map /etc/snort

wget https://www.snort.org/downloads/community/community-rules.tar.gz
tar -zxf community-rules.tar.gz -C /etc/snort/rules

sed -i 's/include \$RULE\_PATH/#include \$RULE\_PATH/' /etc/snort/snort.conf

echo '' >> /etc/snort/snort.conf
echo '# enable community rule' >> /etc/snort/snort.conf
echo 'include $RULE_PATH/community-rules/community.rules' >> /etc/snort/snort.conf

sed -i 's/var RULE_PATH ..\/rules/var RULE_PATH .\/rules/' /etc/snort/snort.conf
sed -i 's/var WHITE_LIST_PATH ..\/rules/var WHITE_LIST_PATH .\/rules/' /etc/snort/snort.conf
sed -i 's/var BLACK_LIST_PATH ..\/rules/var BLACK_LIST_PATH .\/rules/' /etc/snort/snort.conf

touch /etc/snort/rules/white_list.rules
touch /etc/snort/rules/black_list.rules
touch /etc/snort/rules/local.rules

snort -T -c /etc/snort/snort.conf

Usage Modes

Sniffer Mode

snort -v

Packet Logger Mode

mkdir log
snort -dev -l ./log

Network Intrusion Dteection Mode

mkdir log
snort -dev -l ./log -h 192.168.1.0/24 -c /etc/snort/snort.conf