Lion Cipher Lab
Set up Snort 3 to watch your own network (open-source IDS)
- SOC Analyst / Blue Team
- Beginner
- ~90 min
- Free · no account required
Why it matters
A firewall decides what is allowed through. It does not tell you what actually happened. An intrusion detection system does the other half of the job: it reads the traffic crossing a link and raises a named, explainable alert when something matches a pattern of known-bad activity. Snort is the original — the engine that essentially invented open-source network detection, is now maintained by Cisco Talos, and whose rule syntax became the lingua franca that other engines copied. Standing one up yourself is the single fastest way to stop thinking of detection as a magic box and start thinking of…
What you'll learn
- what an IDS is, and how it differs from a firewall
- why `apt install snort` does not give you Snort 3, and what to do instead
- building libdaq and Snort 3 from source on Ubuntu
- verifying an install with snort -V and snort --daq-list
- identifying the interface that actually carries your traffic
- running Snort in sniffer mode (-L dump) and packet-logger mode (-l)
- validating a Snort configuration with -T before you trust it
- loading the free Talos community ruleset
- writing a local rule and watching it fire on traffic you generate
- reading an alert_fast line field by field (gid:sid:rev, class, priority, protocol, endpoints)
Steps in this lab
- Rules of engagement: your own wire, and nothing else
- What an IDS actually is — and why it is not a firewall
- The thing nobody tells beginners: placement beats rules
- Get to a Linux terminal (zero assumptions)
- The trap: `apt install snort` does NOT give you Snort 3
- Install the build dependencies
- Build and install libdaq (Snort's ears)
- Build and install Snort 3 itself
- Prove the install: snort -V and --daq-list
- Pick the interface that actually carries your traffic
- Sniffer mode first — watch raw packets with no rules at all
- Packet-logger mode — write what you see to disk
- Validate the configuration before you trust it (-T)
- Get the free Talos community ruleset
- Run Snort in IDS mode against the community ruleset
- Write your own rule and make it fire — safely, on your own ping
- Read the alert line field by field
- Why the 4,000 community rules stayed silent — the limits of signatures
- Snort vs Suricata vs Zeek — which, and why
- What you actually built, and what to keep