Configuring Snort 3 – how?
To get the most out of Snort 3, one must configure it correctly. The right configuration will provide the best performance and best detection rates. In this section, we will look at how Snort configuration is done.
Snort 3 configuration is done mainly via the following:
- Command-line arguments.
- Configuration files.
Command-line arguments
Snort is a system that is written using the C/C++ language. It is possible to pass values to certain Snort variables from the command line. These are called command-line arguments or parameters.
Let us look at one example of how Snort is executed on the command line:
snort -V
Here, Snort is run with a single command-line parameter, namely -V, which prints out the Snort version. Let us look at another example:
snort -c /usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules -i ens3 -A alert_fast -s 65535 -k none
Here, we see the Snort program being executed with several...
