Create and Test Local Rules¶

Define the protected network, create a local rule and prove its behaviour with both matching and non-matching traffic.

Machine: Snort sensorUser: sudo administrator for files; unprivileged test user where possibleStarting point: validated Snort installation

Configure variables and output¶

Back up the configuration before editing it:

sudo cp /usr/local/etc/snort/overview.lua /usr/local/etc/snort/overview.lua.pre-local-rules
sudo install -d -o root -g root -m 0755 /usr/local/etc/rules

Set HOME_NET to the networks the sensor protects. Define EXTERNAL_NET from the threat model; any is convenient in a lab but can increase noise. Configure ips.include for /usr/local/etc/rules/local.rules and enable a deliberate alert output such as alert_fast.

HOME_NET = '10.0.0.0/24'
EXTERNAL_NET = 'any'

ips =
{
    enable_builtin_rules = true,
    include = '/usr/local/etc/rules/local.rules',
    variables = default_variables
}

alert_fast = { file = true }

HOME_NET is a detection boundary, not merely the sensor address. Include the protected networks visible at this sensor. Decide whether EXTERNAL_NET should be any or exclude HOME_NET based on east-west detection requirements.

Create a narrow test rule¶

Use a locally allocated SID of at least 1000000. Start with alert, not drop, and describe the lab-only purpose:

alert icmp any any -> $HOME_NET any (
    msg:"LOCAL LAB ICMP echo request";
    itype:8;
    sid:1000001;
    rev:1;
)

The itype:8 condition limits the match to echo requests instead of every ICMP packet. Consult the official rule-writing guide before adding payload or flow options.

Element	Meaning in the example
`alert`	Generate an event but allow the packet
`icmp`	Inspect ICMP traffic
`any any`	Any source; ports do not apply to ICMP
`-> $HOME_NET any`	Traffic directed towards the protected network
`itype:8`	Echo requests only
`sid`	Stable locally allocated signature ID
`rev`	Increment when rule logic changes

After the ICMP rule works, add a TCP example. This detects an inbound SSH connection attempt; it does not prove that authentication occurred:

alert tcp any any -> $HOME_NET 22 (
    msg:"LOCAL LAB inbound SSH connection attempt";
    flow:to_server;
    flags:S;
    sid:1000002;
    rev:1;
)

Validate the rule¶

Validate before starting live capture:

sudo /usr/local/bin/snort -c /usr/local/etc/snort/overview.lua -T
sudo /usr/local/bin/snort -c /usr/local/etc/snort/overview.lua \
  -i <SENSOR_INTERFACE> -A alert_fast -l /var/log/snort

From an authorised test host, send one ICMP echo request to an address inside HOME_NET. Record the source, destination and test time. Confirm one expected SID appears in /var/log/snort/alert_fast.txt.

09/11-22:01:19.086427 [**] [1:1000001:1] "LOCAL LAB ICMP echo request" [**] {ICMP} 10.0.0.21 -> 10.0.0.22

Read [1:1000001:1] as generator ID, signature ID and revision. Confirm the addresses and timestamp match the generated packet; seeing the SID alone is not enough evidence.

Then run a negative test: generate a different ICMP type or traffic outside the rule direction. The same SID should not fire. If it does, refine the rule rather than accepting the false positive.

Troubleshoot a missing alert¶

Work through the packet path in order:

Use tcpdump to prove the packet reaches the selected interface.
Confirm the packet direction agrees with the rule header.
Confirm the destination belongs to HOME_NET as Snort parsed it.
Run snort -T and verify local.rules is included once.
Confirm the live command uses the intended configuration and interface.
Confirm the logger writes to the directory being inspected.
Review shutdown statistics for filtered or dropped packets.

Tune and version the rule¶

Capture one true positive and one false positive before tuning. Identify a stable distinguishing property, change only that property, increment rev, and repeat both tests. Useful constraints include direction, TCP state, service, content location and flow. SID values must remain stable across revisions.

Clean up¶

Stop the foreground sensor, remove the lab rule if it is no longer needed, and restore the saved configuration when returning to the baseline:

sudo cp /usr/local/etc/snort/overview.lua.pre-local-rules /usr/local/etc/snort/overview.lua
sudo /usr/local/bin/snort -c /usr/local/etc/snort/overview.lua -T

Completion criteriaConfiguration validation succeeds, the positive test produces the intended SID, the negative test does not, and the rule plus evidence are documented.

↑ Back to Snort journey map