Documents

The following setup guides have been contributed by members of the Snort Community for your use. Comments and questions on these documents should be submitted directly to the author by clicking on their names below.

Snort 3 Setup Guides
Rules Writers Guide to Snort 3 Rules
Yaser Mansour
Snort 3 on FreeBSD 11
Yaser Mansour
Snort 3 Multiple Packet Threads Processing
Yaser Mansour
Snort 3.1.0.0 on CentOS Stream
Yaser Mansour
Snort 3.1.0.0 on OracleLinux 8
Yaser Mansour
Snort 3.0.0-a4 on OpenSuSe 42.3
Boris Gomez
Snort Deployment Guides
How to make some Home Routers mirror traffic to Snort
William Parker
RSyslog rate limiting configuration
William Parker
Changing from IDS to IPS with NFQueue
James Lay
Snort IPS Tutorial
Vladimir Koychev
Snort IPS using DAQ AFPacket
Yaser Mansour
Snort Related Whitepapers
Inline Normalization using Snort 2.9.0
Russ Combs
Target Based Stream Reassembly
Judy Novak
Using Perfmon and Performance Profiling to Tune Snort Preprocessors and Rules
Steve Sturges
HTTP Evasions Revisited
Daniel Roelker
Target Based Fragmentation Reassembly
Judy Novak
VRT Methodology Whitepaper
Vulnerability Research Team (VRT)
Optimization of Pattern Matches for IDS
Marc Norton
Snort Setup Guides
Snort 2.9.16.1 on CentOS8
Milad Rezaei
Snort 2.9.9.x on OpenSuSE Leap 42.2
Boris Gomez
Snort 2.9.0.x with PF_RING inline deployment
Metaflows Google Group
Snort 3.1.18.0 on Ubuntu 18 & 20
Noah Dietrich
Webcast Slides
Introduction to Snort: Part 1
Nick Moore
Pimp My Snort
Leon Ward
Writing Effective Rules, Part II
Matt Olney
Performance Tuning: Rules & Preprocessors
Writing Effective Rules, Part I
Matt Olney
OpenAppId Detection Webinar
Costas Kleopa
Effective Problem Reporting: How to Get Your Problems Noticed and Fixed
Intro to Snort
Ed Mendez
Using the Host Attribute Table in Snort
OpenAppId Community Webinar
Costas Kleopa
Snort Tuning 101
Nick Moore
Using Multiconfig
John Gay
Open Source Community Webinar
Joel Esler
Preprocessor Documentation

All preprocessor docs from the Snort tarball are linked here for simple indexing and reading. Download these documents individually from the snort-faq repository.


README.GTP
README.PLUGINS
README.PerfProfiling
README.SMTP
README.UNSOCK
README.active
README.alert_order
README.asn1
README.counts
README.csv
README.daq
README.dcerpc2
README.decode
README.decoder_preproc_rules
README.dnp3
README.dns
README.event_queue
README.file
README.file_ips
README.filters
README.flowbits
README.frag3
README.ftptelnet
README.gre
README.ha
README.http_inspect
README.imap
README.ipip
README.ipv6
README.modbus
README.multipleconfigs
README.normalize
README.ppm
README.reload
README.reputation
README.rzb_saac
README.sensitive_data
README.sfportscan
README.sip
README.ssh
README.ssl
README.stream5
README.tag
README.thresholding
README.unified2
README.variables
README.pop
README.pcap_readmode
Latest rule documents - Search
1:64240
This rule detects an attempted directory traversal attack against vulnerable versions of the Jenkins File Parameter plugin by looking for relative path traversal characters in the vulnerable parameter.
1:64239
This rule detects an attempted directory traversal attack against vulnerable versions of the Jenkins File Parameter plugin by looking for relative path traversal characters in the vulnerable parameter.
1:64238
This rule detects an attempted directory traversal attack against vulnerable versions of the Jenkins File Parameter plugin by looking for relative path traversal characters in the vulnerable parameter.
1:64237
Use-after-free vulnerability in the mozilla::dom::indexedDB::IDBKeyRange::cycleCollection::Trace function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to execute arbitrary code via vectors related to crafted IndexedDB data. Impact: CVSS base score 10.0 CVSS impact score 10.0 CVSS exploitability score 10.0 confidentialityImpact COMPLETE integrityImpact COMPLETE availabilityImpact COMPLETE Details: Ease of Attack:
1:64236
Use-after-free vulnerability in the mozilla::dom::indexedDB::IDBKeyRange::cycleCollection::Trace function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to execute arbitrary code via vectors related to crafted IndexedDB data. Impact: CVSS base score 10.0 CVSS impact score 10.0 CVSS exploitability score 10.0 confidentialityImpact COMPLETE integrityImpact COMPLETE availabilityImpact COMPLETE Details: Ease of Attack:
1:64235
This rule specifically matches on a known set of credentials used for downloading CNC commands as well as exfilitration via IceDrive