Signature Based Intrusion Detection System Using Snort — Complete Documentation & Simulation

Overview & System Context

Signature Based Intrusion Detection System Using Snort: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~2789 Words · Real Software Screenshots: 3 1. Executive Overview & Technical Background Time: 35 minutes | Level: Network Security | Docker: docker run -it --rm --privileged ubuntu:22.04 bash Snort is the world's most widely deployed open-source Network Intrusion Detection System (NIDS). Originally written by Martin Roesch in 1998, it uses signature-based, protocol analysis, and anomaly-based inspection. This lab covers Snort 2.x (widely deployed) with references to Snort 3 architecture improvements.

I Ubuntu 22.04 ships Snort 2.9.15. Snort 3 (3.x) is available but requires building from source. The rule format is largely the same; Snort 3 uses Lua-based configuration ( snort.lua ) instead of snort.conf . I The DAQ (Data Acquisition) abstraction is what allows Snort to run in inline IPS mode (using NFQ or IPFW to drop packets) without changing the detection engine code.

Figure 1: 8 Best HIDS Tools. Host-Based Intrusion Detection System 2023 - DNSstuff I unified2 is the binary output format used in production deployments. It's designed to be written at high speed without blocking the detection engine. Barnyard2 reads unified2 files and sends alerts to databases (MySQL, PostgreSQL) or SIEMs. I Snort 3 key differences: uses snort.lua (Lua), all preprocessors are now inspectors loaded as plugins, rules include service:http metadata, and ips block replaces -c config file sections. Migration from 2.x: snort2lua tool converts snort.conf → snort.lua automatically.

Snort uses rules to analyze network traffic discover potential threats or network anomalies. Alerts can be dispatched to an analyst or trigger remediation scripts or other actions. Snort is widely used by Blue Teams protecting networks of all sizes and is considered a robust part of network security infrastructure. Cisco purchased the snort project in 2013 and incorporated it in its Sourcefire line of products. The core snort software remains open source with a GPL2+ license.

Figure 2: Best Free Intrusion Detection Software for 2026 Snort can be used in a variety of scenarios to protect networks from cyber threats . Some practical use cases for Snort include: Snort can be used to detect and block network-based attacks, such as denial of service (DoS) attacks, SQL injection or network service attacks such as the well known ETERNALBLUE exploit. Snort will analyze network traffic in real-time, alerting and potentially taking action to prevent the attack from succeeding.

Snort can be used to monitor network traffic for any suspicious activity, such as an unusually high amount of traffic; think multiple Microsoft Remote Desktop (RDP) logins or High number of HTTP POST requests . This can help identify potential security threats allowing the network administrator assess a potential incident. Snort can be configured to use a set of rules that are designed to detect known implants or malware signatures. Common examples would be Cobal Strike (installer / C2 traffic) and the Metasploit based Meterpreter . When malware is detected, Snort can alert the network administrator or trigger actions to mitigate damage from the malware.

Figure 3: Snowl – snort gui – the best UI for Snort IDS/IPS These are the most common use cases for a snort deployment. It should be kept in mind that due to the ability to create custom rules, the possibilities for what Snort can monitor and alert on is endless. In order to get started with Snort easily, we recommend starting with Snort 2.9 which is available in the Ubuntu 22.04 repositories. Installation is a simple matter of the standard apt-get install .

Using this method ensures you have a production ready version that is easy to maintain and update when required through the standard update processes. Using the Cisco Talos docker container is the fastest way to get Snort 3 up and running. Primarily suited for initial testing, the docker container has a full snort installation and can be used to quickly process a network capture (pcap) within a few minutes.

Snort 3 comes with a number of new capabilities and features. Jump in with the following docker commands. 2. System Architecture & Core Working Principles As snort 3 does not come as packaged binaries it is necessary to install from source to deploy on Ubuntu. The full installation guide is available from the snort.org website . Specifically for Ubuntu deployments you will need the following required packages.

The rules can be downloaded from snort.org and are available as the Community Rule set , as well as the official Cisco rules. The official rules require a free registration (30 day delay) or a paid subscription for immediate access to newly released rules. While the community rules are an excellent resource the official rules are essential for getting good coverage and registration or a subscription should be done.

In addition there are excellent rules available from Emerging Threats (Proofpoint) with the option of Free or a Paid for offering. The Oinkcode is an API key associated with a registered account. Using the oinkcode you are able to access the rule updates programatically using a tool such as Pulled Pork . Whichever version or method you are using running the following confirms that snort is installed and ready to go: These examples show a number of practical uses for snort as a command line tool and demonstrates how the system works in a hands on capacity.

In this mode, Snort reads packets from the network interface and compares them to the set of rules specified in the configuration file. Output options are configured in the snort.conf file. Logging to pcap can be configured in the file or we can use the command line option below to write the pcap.

To test everything is working and to understand how the alerting / logging works lets create a simple rule that we can trigger at any time. This rule will detect any use of the icmp protocol (second entry in rule). That matches the source / dest (any -> any variable), and will then use the msg: as the alert text.

The following example is a bit different to previous. It says to print the alerts to the console (-A console) and uses the (-q) parameter to be quiet. Stopping the debugging and startup information from appearing and providing clean output. We can specify the local.rules file as the config or the snort.conf (as it should be including the local.rules file). If you ping the host or network that is listening you should see the alerts printed to the console.

Using our previous test rule for icmp we are able to demonstrate the drop and reject options for rules. To demostrate we will simply replace the alert with reject . The sid will also be incremented otherwise there will be an error when starting with two rules with the same sid . Restarting snort and running the same ping -c 2 10.1.1.44 we will receieve the following output: The first packet gets a response, however the subsequent packet is rejected with an icmp port unreachable .

3. Software Implementation, Frameworks & Protocols Using the reject option causes snort to send a TCP reset or an ICMP port unreachable packet, that will break the session. Using drop and sdrop will only work if Snort is running inline as it does as advertised and simply will drop the packets in this mode.

Similar to tcpdump we can provide BPF filters on the command line to limit the traffic we are inspecting and capturing. The following example limits captured traffic to a single host, that can be the source or destination. After copying the official rules into the /etc/snort/rules/ , quite a lot of rules are actually disabled. This is due to the fact that the default configuration is trying to balance alert noise vs coverage. It is up to the administrator to enable many of the rules.

An interesting set of rules to look at when getting started is the app-detect.rules these detect many types of application on the network - many of those that have remote control features often used by attackers but also legitimitaly. Firstly the configuration file has the rule file disabled. Furthermore the app-detect.rules rules are disabled by default. This is an interesting rule, VNC is an application that allows GUI access to a console. While VNC can be used by administrators it is also used by attackers. An example is the payloads for VNC found within Metasploit.

So this is an example of the app-detect.rules that we want to enable by removing the '#' from the start of the line. Another set of rules that are disabled by default in the Ubuntu package are the malware-rules. We want to enable these as they will provide coverage of attacker favorites such as Cobalt Strike beacons or installers. Remove the comment from the start of these lines to enable the use of the malware rules.

These rules contain detections for interesting tools such as Cobalt Strike and Meterpreter . If these are triggering on the internal network you will certainly want to know about it. Snort has been around for 25 years and is still a powerful and effective tool for those who defend networks from threats. The above tutorial and examples are not intended to cover everything but to give you a practical starting point from which to build up your Snort skillset and build some key knowledge for when planning a deployment.

Even if you do not plan on throwing it on a network immediately, being able to quickly spin up a docker container or an install can be very helpful. Run it over some pcaps from the network or an incident and you may just find some bread crumbs to follow. In recent years the trend has moved from Network Intrusion Detection (nids) to Endpoint Detection and Response (edr). This makes sense with increasingly encrypted network traffic. However, snort and other network tools still give visibility to a great deal of interestings on the wire and not everything runs an EDR client.

A practical Detection Engineering laboratory demonstrating how Snort IDS can detect network reconnaissance and common web application attacks through custom signature development, attack simulation, and real-time traffic monitoring.  Successfully detected network reconnaissance and web application attacks in real time.  Applied an iterative Detection Engineering workflow consisting of rule development, testing, tuning, validation, and analysis.

 Produced comprehensive technical documentation including a Project Journal, Troubleshooting Guide, and Final Project Report. 4. Practical Deployment, Analysis & Case Studies This repository focuses on understanding how intrusion detection works—not simply installing Snort. Every rule included in this project was developed, tested, validated, and refined through practical attack simulation in an isolated virtual laboratory.

Modern organizations rely on Intrusion Detection Systems (IDS) to identify malicious network activity before it escalates into a security incident. Among the most widely used open-source IDS solutions, Snort provides signature-based detection capable of identifying reconnaissance techniques, protocol anomalies, and web application attacks through customizable detection rules.

This project demonstrates the design, implementation, and validation of a practical Snort-based Detection Engineering laboratory using Ubuntu Server , Apache2 Web Server , and Kali Linux within an isolated VirtualBox environment. Unlike projects that focus solely on software installation, this laboratory emphasizes the complete engineering lifecycle of intrusion detection: Throughout the project, multiple network reconnaissance techniques and common web application attacks were successfully simulated and detected using custom Snort rules. Each detection signature was tested against live traffic generated from Kali Linux, allowing rule behavior to be analyzed and improved based on actual network observations.

The primary objective of this repository is to demonstrate practical skills in Detection Engineering , Linux Administration , Network Security , and Technical Documentation through a reproducible cybersecurity laboratory rather than a theoretical implementation. This repository reflects an iterative engineering process involving planning, implementation, troubleshooting, testing, rule refinement, validation, and comprehensive documentation.

The laboratory was designed to simulate a realistic yet isolated cybersecurity environment for developing and validating Snort IDS detection rules. A Host-Only Network was used to allow secure communication between the virtual machines while preventing attack traffic from leaving the laboratory environment. A NAT adapter was also configured to provide controlled Internet connectivity for software installation and system updates.

During testing, attack traffic generated from Kali Linux traverses the Host-Only network toward the Apache web server. Snort continuously inspects network packets, compares them against custom detection signatures, and generates real-time alerts whenever malicious patterns are identified. Rather than relying exclusively on community rule sets, this project emphasizes understanding how detection signatures are created, validated, and refined. Developing custom rules from observed traffic provided valuable insight into the practical workflow of signature-based intrusion detection and reinforced the importance of iterative testing during IDS deployment.

To validate the effectiveness of the custom Snort detection signatures, multiple attack scenarios were executed from the Kali Linux virtual machine against the Apache2 web application hosted on Ubuntu Server. Each attack generated live network traffic across the isolated Host-Only network, allowing Snort IDS to inspect packets, evaluate custom signatures, and produce real-time security alerts.

Every detection demonstrated in this repository was validated through practical testing rather than theoretical rule creation. The following workflow was repeated for every attack scenario included in this project. Every custom detection signature included in this repository was successfully validated using live attack traffic generated within the laboratory environment. The validation process emphasized observation, signature refinement, and evidence collection to ensure that each rule accurately detected its intended attack pattern.

The repository has been organized to clearly separate documentation, custom detection rules, and validation evidence. Each directory serves a specific purpose, making the project easier to understand, reproduce, and maintain. 5. Performance Evaluation & Extended Technical Observations Signature-based Intrusion Detection Lab using Snort IDS with custom web attack detection rules and validation.

The following setup guides have been contributed by members of the Snort Community for your use. Comments and questions on these documents should be submitted directly to the author by clicking on their names below. All preprocessor docs from the Snort tarball are linked here for simple indexing and reading. Download these documents individually from the snort-faq repository .

A practical, hands-on resource for security professionals, penetration testers, and defenders to understand, configure, and use Snort for network intrusion detection and prevention. I Install and configure Snort in various modes I Capture and analyze network traffic with Snort I Understand and create effective detection rules I Configure Snort as IDS for monitoring I Deploy Snort as IPS for blocking threats I Analyze PCAPs and investigate security events I Optimize Snort configuration for performance I Troubleshoot common issues I Create custom rules for specific threats Version: 1.0 Last Updated: February 2026 Status: Active Development Maintained By: Security Community Comprehensive Snort IDS/IPS guide covering installation, configuration, and advanced rule creation with practical examples.

Firewalls decide who gets in — Snort watches what they actually do once they're talking to your servers. A firewall blocks or allows traffic based on IP addresses and ports — it's the bouncer checking IDs at the door. A Network Intrusion Detection System (NIDS) is the security camera inside : it inspects the contents of packets, looking for known malicious signatures. Snort is the most famous open-source NIDS in the world, and learning to read its rules is one of the most practical skills in network defense.

A Snort rule is essentially an "if-then" statement. If a packet matches this description, then do this. Here's a rule that catches an attacker trying to steal the Linux password file ( /etc/passwd ) through a web request — a classic directory-traversal attempt: Every rule has two parts: the rule header (who and where) before the parenthesis, and the rule options (what to look for and what to say) inside it. Here's the same rule broken apart, top to bottom: Attackers almost always begin with a port scan. A stealthy Nmap "Xmas" scan lights up the FIN, PSH, and URG TCP flags all at once — like a Christmas tree — to slip past older, stateless firewalls. That flag combination practically never appears in legitimate traffic, which makes it easy for Snort to spot: The flags:FPU; option tells Snort to match only packets where the F IN, P SH, and U RG flags are simultaneously set — the fingerprint of an Xmas scan.

The difference between an IDS and an IPS is simply the action taken and where the sensor sits . An IDS watches a copy of the traffic and shouts; an IPS sits in the path and can block. Action is alert . The packet still reaches the server; a copy of the event goes to the SIEM. It's passive and out-of-band — typically fed by a SPAN/mirror port, so it can't slow traffic down but also can't stop the attack.

Action is drop . The sensor sits inline between the internet and the server. When a signature matches, the malicious packet is destroyed before it ever arrives — but a bad rule can now block legitimate traffic too. Writing NIDS rules is a balancing act. Make the content: string too broad and you drown the SOC in noise; too narrow and you miss variants of the attack.

Harvested Online Documentation & Reference Sources • https://docs.innozverse.com/network/network-security/security/lab-09-snort-network-intrusion-detection • https://hackertarget.com/snort-tutorial-practical-examples/ • https://github.com/Aegis-Alpha06/snort-web-attack-detection-lab • https://www.snort.org/documents • https://github.com/Slayerp1/snort-guide • https://www.learncybersecurity.tech/courses/comptia-security-plus/security-operations/practical-intrusion-detection-systems- snort-rules