Installing Snort is a very easy process. Users new to snort are strongly encouraged to read all documentation before installing and configuring Snort.

Before you install Snort, you will need to download the snort tarball and the relavant rulesets from www.snort.org . After doing this run the following commands:

  # gunzip snort-<version>.tar.gz
  # tar -xvf snort-<version>.tar
  # cd snort-<version>
  # ./configure --with-openssl --with-mysql
  # make
  # make install

After you finish building and installing Snort, you will need to copy the configuration files to an appropriate place. In this case, we are using /usr/local/etc to store these files.

  # cp <location>/snort-<version>/etc/* /usr/local/etc

Next, we need to install a ruleset. One tip: download the ruleset in the approximate directory you want the /rules directory to reside.

  # gunzip snortrules-<version>.tar.gz
  # tar snortrules-<version>.tar

The result of this should be that /rules has been untarred and placed in the intended place.