Setting up Snort 3.0.0 on Ubuntu 14 and 16

A big thanks to our wonderful Snort community member, Noah Dietrich, who was gracious enough to write an installation and setup guide for Snort 3.0.0's most current build (as of today) (b241).

We placed this on the Snort.org Documents page under "Snort Setup Guides".  If you are interested in getting started with Snort 3.0's latest build, please check it out.

Snort++ Build 225 Available Now on Snort.org!

Snort++ build 225 is now available on Snort.org.  This is the latest monthly update available for download.  You can also get the latest updates from github (snortadmin/snort3) which is updated weekly.

There are too many changes to list here so check the ChangeLog for details.

Enhancements:

• implement RPC over HTTP by adding dce_http_server and dce_http_proxy
• port disable_replace option from snort 2.x and add snort2lua support
• port ssh tunnel over http detection

Bug Fixes:

• fix stream splitter handling during final flush of session data
• fix appid to use HTTP inspection events to detect webdav methods
• fix unit test build to work w/o REG_TEST
• fix shell to add missing newline to Lua execution error responses
• fix support for content strings with escaped quotes ("foo\"bar")
•    thanks to secres@linuxmail.org for reporting the issue
• fix various reload issues
• fix various thread sanitizer issues
• fix session disposal to always be after logging
• fix appid pattern matching issues
• fix appid dns flow counts
• fix shell resume after command line --pause
• fix sd_pattern validation boundary conditions

Other Changes:

• build: don't disable asserts when compiling with code coverage
• autoconf: update to latest versions of autoconf-archive macros
• main: add asynchronous, broadcastable analyzer commands
• add salt to flow hash
• normalize peg names to lower snake_case
• update default manuals

Please submit bugs, questions, and feedback to bugs@snort.org or the Snort-Users mailing list.

Happy Snorting!
The Snort Release Team

Translating a Snort 2.9.X configuration file into a Snort 3.0 configuration file

Enter Snort2Lua

One of the major differences between Snort 2.9.X and Snort 3.0 is the configuration. Snort 2.9.X configuration files are written in Snort-specific syntax while Snort 3.0 configuration files are written in Lua. Snort2Lua is a program specifically designed to convert Snort 2.9.X configuration files into Lua files that Snort 3.0 can understand.

Basic Usage

Snort2Lua is included in the Snort 3.0 distribution. The Snort2Lua source code is located in the tools/snort2lua directory. The program is automatically built and installed.

Translating your configuration

To run Snort2Lua, the only requirement is a file containing Snort 2.9.X syntax. Assuming your configuration file is named snort.conf, run the command

• snort2lua –c snort.conf

Snort2Lua will output a file named snort.lua. Assuming your snort.conf file is a valid Snort 2.9.X configuration file, than the resulting snort.lua file will always be a valid Snort 3.0 configuration file; any errors that occur are because Snort 3.0 currently does not support all of the Snort 2.9.X options.

Every keyword from the Snort configuration can be found in the output file. If the option or keyword has changed, then a comment containing both the option or keyword’s old name and new name will be present in the output file.

Translating a rule file

Snort2Lua can also accommodate translating individual rule files. Assuming the Snort 2.9.X rule file is named snort.rules and you want the new rule file to be name updated.rules, run the command

• snort2lua –c snort.rules -r updated.rules

Snort2Lua will output a file named updated.rules. That file, updated.rules, will always be a valid Snort 3.0 rule file. Any rule that contains unsupported options will be a comment in the output file.

Understanding the Output

Although Snort2Lua outputs very little to the console, there are several things that occur when Snort2Lua runs.  This is a list of Snort2Lua outputs.

The console.   Every line that Snort2Lua is unable to translate from the Snort 2.9.X format to the Snort 3.0 format is considered an error. Upon exiting, Snort2Lua will print the number of errors that occurred. Snort2Lua will also print the name of the error file. 

The output file.  As previously mentioned, Snort2Lua will create a Lua file with valid Snort 3.0 syntax.  The default Lua file is named snort.lua.  This file is the equivalent of your main Snort 2.9.X configuration file.

The rule file.   By default, all rules will be printed to the Lua file.  However, if a rule file is specified on the command line, any rules found in the Snort 2.9.X configuration will be written to the rule file instead

The error file.  By default, the error file is snort.rej. It will only be created if errors exist.  Every error referenced on the command line can be found in this file.  There are two reasons an error can occur.

1)   The Snort 2.9.X configuration file has invalid syntax. If Snort 2.9.X cannot parse the configuration file, neither can Snort2Lua.  In the example below, Snort2Lua could not convert the line 'config bad_option'.  Since that is not valid Snort 2.9.X syntax, this is a syntax error.

2)    The Snort 2.9.X configuration file contains preprocessors and rule options that are not supported in Snort 3.0.  If Snort 2.9.X can parse a line that Snort2Lua cannot parse, than Snort 3.0 does not support something in the line.  As Snort 3.0 begins supporting these preprocessors and rule options, Snort2Lua will also begin translating these lines. One example of such an error is dcerpc2.

Additional .lua and .rules files. Every time Snort2Lua parses the include or binding keyword, the program will attempt to parse the file referenced by the keyword.  Snort2Lua will then create one or two new files.  The new files will have a .lua or .rules extension appended to the original filename.

Snort2Lua Documentation

Additional information is available in the Snort2Lua section of the Snort 3.0 manual.