28

Chapter 2     Installing Snort and Getting Started

this directory. In this chapter, you will learn how to install Snort as a standalone prod 

uct. Later chapters will focus on other components.

Snort is available in both source code and binary forms. Pre compiled binary

packages are fine for most installations. As mentioned earlier, if you want to add or

remove certain features of Snort, you need to download the source code version and

then compile it yourself. For example, someone may be interested in SMB alerts while

another may consider it unsecure. If you want to build Snort without support for SMB

alerts, you may want to build it yourself. The same is true of other features like SNMP

traps, MySQL and so on. Another reason to compile the source code yourself may be

when a new version is released but binaries are not yet available. You may also need to

compile the Snort package if you take a snapshot of the code under development. This

chapter will provide a step by step guide to installing Snort.

The basic installation procedure is simple because you have plenty of predefined

rules available with Snort that cover most of the known intrusion signatures. However,

customization of your installation may require a lot of work.

Version 1.9.0 is used in this chapter, but the installation procedure is similar for

other versions of the software. After installation, basic information for getting started

with Snort is also provided, including basic Snort concepts, logging and alerting and

some information about Snort modes of operation.

2.2 Installing Snort

In this section you will learn how to install precompiled version of Snort as well as how

to compile and install it by yourself. Installation of the pre compiled RPM package is

very easy and requires only a few steps. However if you get Snort in source code for 

mat, the installation process may take some time and understanding.

2.2.1

Installing Snort from the RPM Package

The installation procedure of Snort from the RPM package involves the following

steps.

2.2.1.1

Download

Download the latest version from Snort web site (http://www.snort.org). At the

time of writing this book, the latest binary file is snort 1.9.0 1snort.i386.rpm.

2.2.1.2

Install

Run the following command to install Snort binaries:

rpm   install  snort 1.9.0 1snort.i386.rpm