When Traditional Firewalls Become Powerless
Many administrators believe that just enabling UFW and Fail2ban makes their server secure. In reality, a traditional Firewall only opens or closes ports based on IP addresses. It is completely “blind” to the actual content inside the packets. If a hacker sends malicious code through port 80 (HTTP), which is already open, the firewall will simply let it pass.
Think of a firewall as a gate security guard who only checks ID cards. A bad actor with a valid ID but carrying explosives will still get through easily. To handle this properly, you need a deep baggage inspection layer. That is where Snort 3 – the next-generation Intrusion Detection System (IDS) – comes into play.
Why Do Hackers Easily Bypass Basic Security Layers?
Modern attacks are no longer as primitive as before. Hackers use extremely clever evasion techniques:
- SQL Injection / XSS: Packets passing through port 80 follow all connection rules, but the content contains code that destroys the database.
- Buffer Overflow: Sending a massive amount of data to a service to take remote control of the system.
- Zero-day exploits: Attacking unannounced vulnerabilities where static firewall rules haven’t been updated yet.
Without Deep Packet Inspection (DPI) capabilities, your server is like a house with the front door locked tight but the back window left wide open.
Comparing Popular Network Monitoring Solutions
When choosing a system protection tool, we usually face three main options:
- Manual log checking: This is time-consuming and useless. By the time you find a trace in the logs, the hacker has usually wiped their tracks and left long ago.
- Suricata: A formidable competitor with excellent multi-threading support. However, Snort still holds the edge thanks to its massive community and a rule repository updated continuously for decades.
- Snort 2: A “legend” of its time but now outdated. It only runs single-threaded, easily becoming a bottleneck on high-speed connections (1Gbps or higher).
Snort 3 – A Leap Forward in Performance
Snort 3 (Snort++) is not just a minor update; it is a complete architectural shift. Practical improvements include:
- Multi-threaded processing: Allows leveraging all modern CPU cores to inspect packets many times faster.
- Configuration using Lua: Config files are now more flexible, readable, and easy to automate with scripts.
- Hyperscan library: Uses Intel technology to scan for malware patterns at extremely high speeds.
- Service auto-detection: Snort 3 understands which protocol a packet belongs to without you having to specify the port manually.
Detailed Snort 3 Installation Guide on Ubuntu
Compiling from source code is the best way to optimize performance for your hardware. This process works well on Ubuntu 22.04 and 24.04.
Step 1: Install Dependencies
First, install the necessary compilation tools and libraries. This is the most important foundation.
sudo apt update && sudo apt upgrade -y
sudo apt install -y build-essential cmake libpcap-dev libpcre3-dev \
libdumbnet-dev bison flex zlib1g-dev liblzma-dev libssl-dev libhwloc-dev \
pkg-config libzstd-dev libluajit-5.1-dev libcpputest-dev \
libsqlite3-dev uuid-dev libhyperscan-devQuick tip: To manage your server securely, you should use a strong password generator for system accounts. This tool runs 100% in the browser, making it very safe.
Step 2: Install Snort DAQ
DAQ (Data Acquisition library) is the abstraction layer that helps Snort communicate with the network interface. Snort 3 requires the latest DAQ version to operate stably.
cd ~
git clone https://github.com/snort3/libdaq.git
cd libdaq
./bootstrap && ./configure && make
sudo make install
sudo ldconfigStep 3: Compile Snort 3
The compilation process can take 5-10 minutes depending on your CPU power.
cd ~
git clone https://github.com/snort3/snort3.git
cd snort3
./configure_cmake.sh --prefix=/usr/local --enable-tcmalloc
cd build
make -j$(nproc)
sudo make install
sudo ldconfigVerify the result with the command: snort -V. If you see the Snort logo appear, you’ve succeeded.
Step 4: Configure Promiscuous Mode
For Snort to “see” every packet passing through, you must put the network card into Promiscuous mode. Assuming your network interface is eth0:
sudo ip link set dev eth0 promisc onStep 5: Create a Test Rule and Run
By default, Snort is just an empty framework. You need to add a “brain” (rules) to it. Let’s try creating a rule that alerts when someone pings the server.
Open the rule file: sudo nano /usr/local/etc/snort/rules/local.rules and paste the following line:
alert icmp any any -> any any (msg:"ICMP packet detected"; sid:1000001; rev:1;)Declare this rule file in the main snort.lua configuration under the ips section, then run Snort:
sudo snort -c /usr/local/etc/snort/snort.lua -i eth0 -A alert_fastTry pinging the server from your personal computer. You will see alert lines appear immediately on the Terminal screen.
Practical Tips to Prevent System Hanging
Deploying Snort 3 in a production environment requires finesse. Here are 3 hard-learned lessons:
- Don’t be greedy and enable all rules: Enabling thousands of rules at once will consume all RAM and CPU. Only activate rules directly related to the services you are running (such as HTTP, SSH).
- Be careful with IPS (Prevention) mode: When configuring Snort to automatically drop packets, a small mistake in a rule can lock you out of your own server. Run in IDS (Alert) mode for a while before switching to IPS.
- Combine with visualization: Don’t just read dry text logs. Push Snort logs to an ELK Stack for visual dashboards, helping you detect escalating attacks in seconds.
Snort 3 is not just a tool; it is a “microscope” that helps you examine every corner of your data flow. Mastering it will make your system more resilient against today’s increasingly complex attacks.
