Interface Settings¶

The Interface Settings window configures settings for a Snort instance. The window opens when creating a new instance or editing an existing instance.

General Settings¶

Enable: Controls whether this instance is enabled or disabled.
Interface ID: The unique identifier Netgate Nexus generated and assigned to the instance.

Note

This field is not present when creating a new instance, only when editing an existing instance.
Interfaces: A selection list that defines the interface(s) upon which this instance monitors network traffic.
Description: A text description for this instance, for example to state its purpose.

Overrides¶

These optional fields define network address variables that inform Snort about types of services found on servers. By default, Snort uses the entire Home Network for all of these values.

Defining these variables can help streamline targeted rules. For example, so Snort does not check certain SQL rules against a server that does not run an SQL daemon.

Override values can be set for DNS, FTP, HTTP, SIP, SMTP, IMAP, SQL, SSH, and Telnet servers.

Options¶

Send alerts to syslog

Controls whether Snort logs alerts to the system log. This can be useful when logging to a remote host that can parse the logs for other purposes.

Inline IPS

When enabled, Snort will inspect traffic inline instead of performing passive sniffing. This consumes much more processing power and potentially lowers total throughput, but it allows Snort to block an attack before it reaches a host instead of reacting to traffic that has already passed.

Default is disabled.

Unified2 alerts

When enabled, Snort logs alerts using the Unified2 binary format log file in the logging subdirectory for this interface.

Default is disabled.

Block on alert

When enabled, Snort will temporarily drop all new connections to and from hosts that trigger alerts.

Default is disabled.

Warning

The best practice is to leave this option disabled initially to avoid unintentionally blocking desired connections. Monitor alerts during an evaluation period, adjust the configuration as needed, and then enable blocking once the potential for false positive matches has been lowered to acceptable levels.

Kill states on block

When enabled, Snort will kill any open connection states for hosts that triggered a block. This terminates any ongoing connections to or from blocked hosts.

Default is disabled.

Which addresses to block

Controls which addresses Snort blocks when traffic generates an alert.

Note

Hosts in Pass Lists will not be blocked.

Both: Blocks both the source and destination address. This is the default behavior.
Source Only: Blocks the source address from the alert but not the destination.
Destination Only: Blocks the destination address from the alert but not the source.

Performance¶

Fast pattern matcher

Selects the pattern-matching search engine Snort uses to match packets against rules.

AC-BNFA

Safest option for low-end systems. Lowers memory and CPU usage, but is not as fast as other options.

This is the default choice.

AC Full

Increased memory usage and performance.

Hyperscan

Higher memory usage, greatly increased performance that can take advantage of hardware acceleration.

May not function properly on all hardware. Only functions on amd64 architecture and a CPU with SSSE3 functionality.

Optimal functionality can be reached with additional CPU features such as SSE4.2, POPCNT, BMI, BMI2, and AVX2.

Split ANY-ANY port group

Splits up processing for the ANY-ANY port group Snort uses when processing rules that apply to all ports or large lists of ports.

Default is disabled.

Search optimization

Enables search optimization.

Default is disabled.

Skip stream-inserted packets

When enabled, Snort does not evaluate stream inserted packets against the detection engine.

Default is disabled.

Disable checksum checking

When enabled, Snort does not check the checksums on packets to improve performance.

Default is disabled.

Advanced¶

Home Net

Sets the network(s) that Snort will treat as internal and protected.

Default: Uses a default set of addresses which includes local networks, WAN IP addresses, gateway IP addresses, VPN networks and Virtual IP addresses.
Any: Matches any address.
Custom: Defines a custom list of networks either by manual entry or by selecting one or more Address Lists or Pass Lists.

External Net

Default
The default value is any address or network not included in the Home Net.

Any
Matches any address.

Custom
Defines a custom list of networks either by manual entry or by selecting one or more Address Lists or Pass Lists.

Pass List: Selects a Pass Lists to ensure Snort never blocks certain hosts.
Suppression List: Selects a Suppression Lists to suppress alerts from certain rules, sources, or destinations.

Interface Rulesets¶

Ruleset Selection List¶

Selects one or more Rulesets to enable for this instance.

Warning

Talos LightSPD rules are exclusive and cannot be used with other rulesets.

Ruleset Tabs¶

This section contains a tab for each enabled ruleset to view and offer granular control over which policies, categories, and rules are enabled for this instance.

SnortReg Policy

Some rulesets support policies which enable and disable rules within the ruleset easily based on common goals. This lets users avoid manually enabling or disabling many individual rules if their needs match available policies.

The available policies vary by ruleset, but common choices include:

Balanced

A balanced configuration that aims to provide a good balance of security, performance, and acceptable false positive rates.

This is the Default policy.

Security

Increases security at the risk of more false positive matches alerting on expected/desired traffic.

Max-Detect

Detects as much as possible (e.g. enables all rules).

Connectivity

Aims to provide improved connectivity by lowering security and lowering false positive rates.

No-Rules-Active

Disables all rules in the ruleset.

Categories

This list contains all categories available within a ruleset.

Check a ruleset to enable it. Click Edit to open the Rules Override Editor.

Rules Override Editor: This interface edits individual rule categories and allows users to enable, disable, or suppresses individual rules within a category.

Reputation¶

Enables IP reputation preprocessor functionality in Snort which provides simple methods to act on traffic from hosts that have previously triggered alerts.

Enable

Controls whether the reputation preprocessor is enabled.

Default is disabled.

Max Memory

Sets a memory limit, in MB, Snort may allocate for this task.

Scan RFC1918 (Private) addresses

Enables inspection for private addresses: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.

Encapsulated IP to match

Specifies which address to use when a packet contains encapsulated traffic.

Inner IP: Matches the encapsulated (inner) IP address in the packet.
Outer IP: Matches the outer IP address on the packet.
All (inner and outer): Matches both the inner and outer IP address on the packet.

Priority

Chooses which list Snort gives priority when matching packets that result in a conflict, such as a source is on a block list while the destination is on an allow list.

Block list: Blocks matched traffic even if the other host is on the allow list.
Allow list: Allows matched traffic even if the other host is on the block list.

Allow List Intent

Do not block
Removes allowed hosts from block lists.

Trust
Passes allowed hosts without further processing.

Allow Lists: An Address Lists to use as the allow list.
Block Lists: An Address Lists to use as the block list.

Customization¶

This section gives the user low-level control over the Snort 3 configuration.

Danger

This section is for highly advanced users who are deeply familiar with Snort 3 configuration. Most users will not need to touch anything in this section.

Custom Includes (Lua)

These fields allow adding Lua configuration snippets without overriding the entire Snort 3 configuration.

Custom Lua config head: Snort will place the Lua code from this field at the top of the generated configuration file.
Custom Lua config tail: Snort will place the Lua code from this field at the end of the generated configuration file.

Raw Config

These fields allow viewing the generated configuration or setting a manual configuration.

Custom raw config override: This field allows the user to insert their own manually-crafted full raw snort.lua configuration file.
Generated raw config (readonly): This field contains the full raw configuration currently in place for Snort.

Config Path

This field contains the full path to the snort configuration directory for this instance.