Snort 3 Installation and Rule Configuration Guide

Snort 3 replaces the flat configuration file of Snort 2 with a Lua-based configuration, plugin modules and a rewritten rule engine, which means an existing deployment cannot simply be upgraded in place - the configuration and rules must be translated. This guide covers the build dependencies that trip up first-time installers, the Lua configuration model, how rules are loaded and organised, the module options worth tuning before you enable IPS mode, and the migration path with snort2lua for teams coming from Snort 2.

Dependencies and LibDAQ

# build essentials
cmake g++ flex bison pkg-config zlib libpcre libdnet openssl hwloc luajit libpcap

git clone https://github.com/snort3/libdaq.git
cd libdaq
./bootstrap
./configure --prefix=/usr/local/lib/daq_s3
make install
ldconfig

LibDAQ is the abstraction layer between Snort and its data source. Installing it into a non-standard prefix is normal, but you must then tell the dynamic linker where to find it, or Snort will start and immediately fail to find a DAQ module. Optional dependencies change capability rather than basic function: Hyperscan accelerates regex and sd_pattern matching, LuaJIT is required for configuration, and zlib unlocks decompression for archive inspection.

The Lua configuration model

# snort.lua
ips = {
  include = 'rules.txt',
  enable_builtin_rules = true,
}

stream_tcp = {
  policy = 'linux',
  reassemble_async = true,
  overlap_limit = 10,
}

alert_fast = {
  file = true,
  packet = false,
  output = 'alert.txt',
}

Configuration is executable Lua executed at load time, so the same file can compute values conditionally. Modules fall into families: codecs for protocol decoding, inspectors for protocol analysis and normalisation, IPS action and option modules for detection, search engines for pattern matching, and loggers for output. Enumerate what is available with snort --help-modules and inspect parameters with snort --help-config stream_tcp.

Rules: external files and includes

snort -c snort.lua -R cool.rules -r some.pcap -A cmg
sort -c snort.lua -R rules.txt

Only one rule file can be given with -R, so real deployments use a master file that includes others, or the ips.include directive in the Lua configuration. Keeping rules in files rather than inline in the configuration is what allows a rules manager or subscription update to work without touching your tuned module settings.

Tuning before you enforce

• Stream normalisation - stream_tcp.policy should reflect the dominant OS in your network. Evasion resistance depends on reassembly behaviour matching the target stack.
• Overlap limits - cap overlapping TCP segments; unlimited reassembly is an attack surface as well as a memory risk.
• Alert output - start with a text or cmg logger while validating, then move to unified2/JSON for a SIEM pipeline.
• Run in detect-only first - validate rule accuracy against real traffic for at least a full business cycle before switching to drop.

Migrating from Snort 2

snort2lua -c snort.conf
snort2lua -c snort.conf -r snort.rules -o snort3.lua

The converter handles the mechanical translation, but its output needs review: deprecated keywords are dropped or replaced, threshold syntax changed, and some preprocessors became inspectors with different option names. Treat the converted file as a starting point, diff it against the module reference, and test with a pcap that exercises your existing rules.

Related: Suricata IDS/IPS configuration and rules deployment for a comparison point, and Zeek network security monitoring for the transaction-log counterpart to signature detection.

原文链接：https://docs.snort.org/start/installation